Research: authentication
Account Recovery Flows That Protect Ownership
A practical recovery design for lost authenticators, compromised sessions, recovery codes and safe notifications.
Passkey Recovery Design for a Lost Device
How services should distinguish lost devices, synced credentials, recovery routes and server-side passkey revocation.