Evidence ledger
24 sources
Checked 23 Oct 2026
Evidence ledger
One row per claim in The back door sets the strength of the lock: recovering accounts without handing them to attackers: who published it, what grade it carries, when it was written, when the link was last checked, and the quote or figure it rests on. Nothing in the guide is cited from memory, so anything not in this table is not in the guide.
Checked 2026-10-23. One claim per row. Quotes are copied from the page or PDF as fetched in this
session (web fetch summaries for HTML pages; pdftotext for the two Google PDFs). Where a primary
source was blocked from this environment, the row says so and the claim is marked as secondary.
Tier key: postmortem, source, adr, casestudy, blog, paper, talk, vendor.
| # | Org | Title | Tier | Published | Checked | URL | Claim taken | Supporting quote or figure |
|---|---|---|---|---|---|---|---|---|
| 1 | Retool | When MFA isn't actually MFA | postmortem | 2023-09-13 | 2026-10-23 | https://retool.com/blog/mfa-isnt-mfa | 27 cloud customers affected; no on-prem or managed accounts | "There was no access to on-prem or managed accounts." (27 cloud customers notified 2023-08-29) |
| 2 | Retool | same | postmortem | 2023-09-13 | 2026-10-23 | https://retool.com/blog/mfa-isnt-mfa | Cloud sync of authenticator codes turned MFA into single-factor | Page says control of the Google account exposed every stored OTP, "single-factor-authentication" |
| 3 | Okta | Cross-tenant impersonation: prevention and detection | postmortem | 2023-08-31 | 2026-10-23 | https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection | Callers asked service desks to reset all MFA factors of privileged users | "convince service desk personnel to reset all Multi-factor Authentication (MFA) factors enrolled by highly privileged users" |
| 4 | Okta | same | postmortem | 2023-08-31 | 2026-10-23 | same | Mitigations: strongest authenticator for recovery, trusted networks, protected actions, service-desk verification | "Start recovery with the strongest available authenticator"; "visual verification" |
| 5 | CISA | #StopRansomware: Scattered Spider (AA23-320A) | casestudy | 2023-11-16, rev. 2025-07-29 | 2026-10-23 | https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a | Help-desk resets of passwords and MFA are a standard step | "use social engineering to convince IT helpdesk personnel to reset passwords and/or MFA tokens" |
| 6 | CISA | same | casestudy | 2023-11-16 | 2026-10-23 | same | Early calls learn the reset process | "designed to first learn what steps are needed to conduct password resets from helpdesks" |
| 7 | CISA | same | casestudy | 2023-11-16 | 2026-10-23 | same | SIM swap used to bypass MFA; FIDO/WebAuthn resistant | "resistant to phishing and not susceptible to push bombing or SIM swap attacks" |
| 8 | Microsoft | Octo Tempest crosses boundaries | casestudy | 2023-10-25 | 2026-10-23 | https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/ | Admin resets and MFA changes via help desk; scope help desk; out-of-band | "Using out-of-band communication channels is strongly encouraged"; "exclude administrative operations over Global Administrators" |
| 9 | MGM Resorts | Form 8-K | casestudy | 2023-10-05 | 2026-10-23 | https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm | About $100M September impact; under $10M one-time costs | "negative impact from the cyber security issue in September of approximately $100 million"; "less than $10 million in one-time expenses" |
| 10 | Caesars | Form 8-K | casestudy | 2023-09 | 2026-10-23 | https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm | Social-engineering attack on an outsourced IT support vendor; earliest event 2023-09-07 | "a social engineering attack on an outsourced IT support vendor used by the Company" |
| 11 | TechTarget | Okta: Caesars, MGM hacked in social engineering campaign | blog | 2023-09-19 | 2026-10-23 | https://www.techtarget.com/cybersecurity/news/366552775/Okta-Caesars-MGM-hacked-in-social-engineering-campaign | Caesars one of four victims tracked 07-29 to 08-19; MGM a fifth; attribution via partners | "relying on our cybersecurity partners for attribution" |
| 12 | Krebs on Security | Reddit breach highlights limits of SMS-based authentication | blog | 2018-08-01 | 2026-10-23 | https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/ | Reddit's SMS 2FA statement; June 14-18 compromise; learned June 19. Reddit's own post was blocked (reddit.com not fetchable), so secondary | "we learned that SMS-based authentication is not nearly as secure as we would hope" (as reproduced) |
| 13 | Engadget | Mat Honan details the Amazon and Apple security flaws | blog | 2012-08-06 | 2026-10-23 | https://www.engadget.com/2012-08-06-mat-honan-details-the-amazon-and-apple-security-flaws-that-let-h.html | Chained recovery steps; Apple said policies not followed; no specific policy change reported | "some internal policies were not followed in his case" (Apple spokesperson Natalie Kerris). Wired original was not fetchable. |
| 14 | Keycloak | Reset Credentials Flow logs in without OTP (#12759) | source | 2022-06-27 | 2026-10-23 | https://github.com/keycloak/keycloak/issues/12759 | Same-browser reset logs user in without OTP when OTP reset skipped; open; fix proposed 2026-10 | "This is security hardening IMO and it should be addressed in the wider context." (mposolda); "I don't think we're able to fix this in Keycloak 22." |
| 15 | Keycloak | Issues related to reset credentials flow (#39447) | source | 2025-05-05 | 2026-10-23 | https://github.com/keycloak/keycloak/issues/39447 | One flow for all credentials; MFA reset adds rather than replaces | "we have single flow for all credentials" |
| 16 | Ory | Bypassing AAL2 in Settings Flow Using Email OTP for Both Factors (#4317) | source | 2025-02-21 | 2026-10-23 | https://github.com/ory/kratos/issues/4317 | Email OTP from recovery plus second email OTP reaches AAL2 settings; open, no linked PR | "does not treat them as the same factor of authentication" (reply by cmmoran, 2025-03-14) |
| 17 | Delegated Recovery Specification | source | archived 2020-09-02 | 2026-10-23 | https://github.com/facebookarchive/DelegatedRecoverySpecification | Delegating recovery to another provider was specified and archived | "This repository was archived by the owner on Sep 2, 2020." (Design detail not retrievable.) | |
| 18 | NIST | SP 800-63B-4, Account Recovery | adr | 2025 | 2026-10-23 | https://pages.nist.gov/800-63-4/sp800-63b/events/ | Four recovery classes; code size; lifetimes; two recovery addresses | "at least 64 bits from an approved random bit generator"; 10 minutes text/voice, 24 hours email, 21 days US postal |
| 19 | NIST | same, Sec. 4.6 | adr | 2025 | 2026-10-23 | same | Notification on every recovery | "In all cases, account recovery SHALL cause a notification to be sent to the subscriber or their designee." |
| 20 | FIDO Alliance | Recommended Account Recovery Practices for FIDO Relying Parties | adr | 2019-02 | 2026-10-23 | https://fidoalliance.org/wp-content/uploads/2019/02/FIDO_Account_Recovery_Best_Practices-1.pdf | Weakest-link statement; multiple authenticators then re-proofing; Advanced Protection requires two keys | "The entire ecosystem is only as strong as the weakest link" (pdftotext of saved PDF) |
| 21 | Handcrafted Fraud and Extortion (IMC '14) | paper | 2014 | 2026-10-23 | https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43469.pdf | SMS 81%, email 75%, questions or manual review 14% | "recover their account 81% of the time"; "succeeding 75% of the time"; "falls to 14%" | |
| 22 | same | paper | 2014 | 2026-10-23 | same | 9 manual hijacks per million users per day; email 74.57% with about 5% bounce; remission step | "an average of 9 incidents per million"; "Email ... a success rate of 74.57%"; "email bounces in approximately 5% of the cases" | |
| 23 | Secrets, Lies, and Account Recovery (WWW '15) | paper | 2015 | 2026-10-23 | https://research.google/pubs/secrets-lies-and-account-recovery-lessons-from-the-use-of-personal-knowledge-questions-at-google/ | About 40% of US English users cannot recall answers; 37% faking; SMS over 80% | "40% of our English-speaking US users" unable to recall; "SMS reset codes (over 80%)" (from the PDF text) | |
| 24 | Amft et al. | "We've Disabled MFA for You" (CCS 2023) | paper | 2023-09-19 | 2026-10-23 | https://arxiv.org/abs/2306.09708 | 1,303 sites reviewed, 71 tested; many allowed MFA bypass with email access | abstract as fetched; exact counts not given in abstract |
| 25 | Identiverse / AWS | A Framework for Comparing Account Recovery Strategies | talk | 2022 | 2026-10-23 | https://identiverse.com/?p=2861 | "Iron triangle" of access continuity, privacy, security (abstract only) | abstract as fetched; no recording reviewed |
| 26 | BSides Exeter | Stopping account takeover at the recovery layer | talk | 2026-04-25 | 2026-10-23 | https://pretalx.com/bsides-exeter-2026/talk/YNPP3Z/ | Recovery as privileged access; post-reset cleanup (abstract only) | "Missing post-reset cleanup that leaves attacker sessions alive" |
| 27 | GitHub | Recovering your account if you lose your 2FA credentials | vendor | 2026 | 2026-10-23 | https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials | Support cannot restore; permanent loss | "If you cannot use any recovery methods, you have permanently lost access to your account." |
| 28 | Apple | Account recovery | vendor | 2026 | 2026-10-23 | https://support.apple.com/en-euro/118574 | Fixed wait; support cannot shorten; 72h confirmation | "Contacting Apple Support can't help shorten the wait."; "The waiting period is fixed." |
| 29 | Advanced Protection Program | vendor | 2026 | 2026-10-23 | https://support.google.com/accounts/answer/7539956 | Slower recovery tier. Note: verify.mjs reports 404 because the host answers HEAD with 404; GET returns 200 | "It takes a few days for Google to verify it's you." | |
| 30 | 9to5Google | Google Account recovery contacts | blog | 2025-10-15 | 2026-10-23 | https://9to5google.com/2025/10/15/google-account-recovery-contacts/ | Google launched recovery contacts; no limits on the page | "trusted family members or friends" |
Not retrieved (so not cited as fact)
- Twitter July 2020 incident: blog.x.com returned 403 and the NYDFS report page returned 404. Left out.
- Reddit's own 2018 post and the Wired original of the Honan story: blocked from this environment.
- FIDO 2025 passkey white paper and Facebook Trusted Contacts removal: seen only in secondary search summaries; not used.