Topic: mfa

• MFA recovery codes: generating, storing and consuming them

  Recovery codes are look-up secrets: a small set of random, single-use codes issued when a second factor is enrolled, stored hashed like passwords, rate-limited, and consumed one at a time. They are the fallback when the phone or key is gone, so their issue, use and re-issue must be as guarded as the factor they replace.

  article · en · unreviewed

Machine-readable: JSON