Recovery

Users lose phones. Recovery is also the usual way attackers get around a second step: “I lost my phone, please turn it off.” Tenon-Auth’s answer is to never switch the second step off to let someone in.

Recovery codes (the user, alone)

When a method becomes active, show 10 recovery codes once (createRecoveryCodes).

• At sign-in, the recovery page passes the challenge with one of them: completeWithRecoveryCode(step, code).
• Each code works once. recoveryCodesRemaining says how many are left.
• After signing in with one, send the user to set up their new phone.

Access passes (your helpdesk)

For a user without their phone and without their codes:

1. Check who is asking: in person with an ID card, on a video call, or through their manager. Never because of an email or a phone call alone.
2. Issue a one-time pass: createAccessPass(userId, issuedBy). Your Helpdesk staff can also do this in the console. The pass works once, within an hour, and replaces any earlier one.
3. Give it to that person directly. They type it on the recovery page like a recovery code, then set up their new phone.

Each pass is recorded in your organization’s audit log, with who issued it.

What not to build

• A “reset two-step sign-in” link sent by email.
• Security questions.
• A helpdesk button that removes the method without the steps above.

Each of these turns your second step into a formality.