Black Hat USA 2025 | Lost & Found: The Hidden Risks of Account Recovery in a Passwordless Future

Why It Matters

Insecure recovery pathways enable account takeover at scale, threatening user trust, regulatory compliance, and brand reputation; organizations must redesign these flows before passwordless adoption becomes mainstream.

Key Takeaways

• Account recovery remains a weak link despite stronger authentication methods
• Legacy email and SMS channels expose users to SIM‑swap attacks
• Researchers audited 22 popular sites, uncovering unverified recovery methods
• Inconsistent verification lets attackers hijack accounts via compromised recovery channels
• New ARA framework offers systematic testing and best‑practice guidelines

Summary

The Black Hat USA 2025 presentation warned that account‑recovery mechanisms—intended as a safety net for forgotten passwords—are rapidly becoming the most exploitable entry point in a passwordless ecosystem. Speakers Sidra, Gabby, and their research team outlined how recovery flows rely on out‑of‑band channels such as email and SMS, which are outside the direct control of service providers and vulnerable to SIM‑swap, SS7, and phishing attacks.

Their empirical study examined 22 of the most‑visited web services, mapping each site’s “account states” and testing nine recovery scenarios ranging from unverified methods to multi‑factor interactions. The data showed that four‑fifths of users forget a password within 90 days and a quarter need recovery daily, underscoring the massive scale of the problem. Design flaws surfaced, including acceptance of unverified recovery contacts, inconsistent verification steps, and the ability to hijack accounts by exploiting misspelled or compromised recovery addresses.

A striking example cited was a site that allowed password resets using an unverified email address, enabling an attacker who controlled a typo‑adjacent address to seize the victim’s account without any additional checks. The researchers also introduced an adversary model—Alice, Eve, Mallory, and Chad—to illustrate how attackers can remain stealthy, lock out users, or spam recovery requests.

The talk concluded that without a fundamental redesign of recovery flows, even the strongest passwordless authentication (biometrics, passkeys) will be undermined. Their open‑source Auditing Recovery Architecture (ARA) framework provides a systematic way to evaluate and harden recovery processes, and the authors issued best‑practice recommendations for the industry to adopt more robust, verified recovery channels.

Original Description

We explored the Recover my account option of some of the 25 most visited websites. We considered permutations and combinations of scenarios where account recovery can be triggered by a user and how these websites allow the claiming entity (user or an adversary) to gain control over the account. We turned the authentication maze into an easy-to-follow test suite that allows security auditors and webmasters to evaluate the security of the account recovery mechanism of a given website. We learned several lessons on designing a secure and usable account recovery procedure by recovering our own user accounts thousands of times.

The wisdom passed on by the security community is one of the reasons why users mislay their authentication credentials: Pick a strong password, change it as frequently as possible, and use a password manager. Despite being unable to keep track of the many passwords we all have, the user adoption of password managers is still low.

In this talk, we will give insights on the security of account recovery procedures in the wild from the websites we tested, how to evaluate it yourself with the test suite (or auditing framework) we designed, and how to get it right with the best practice recommendations that we drafted.

By:

Sid Rao | Senior Security Research Scientist, Nokia Bell Labs

Gabriela Sonkeri | Security Engineer, Wolt

Amel Bourdoucen | User and Impact Researcher, Aalto University, F-Secure

Janne Lindqvist | Associate Professor, Aalto University

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#lost--found-the-hidden-risks-of-account-recovery-in-a-passwordless-future-46431