Typically it falls to an account recovery flow, which would be expected to be as strong or stronger than the account creation flow. Obviously sites implement ac

Typically it falls to an account recovery flow, which would be expected to be as strong or stronger than the account creation flow. Obviously sites implement account recovery wrong all the time though. Some systems like Google Advanced Protection Program specifically don't really have alternate means of authentication or a recovery flow. If you register multiple authenticators, you can do a break-the-glass/open-the-safe recovery, but this assumes you remembered to register all authenticators to all sites. There is a proposal to support backup keys via what might be referred to a cryptographic introduction. My primary key can include additional cryptographic data, and if I lose my primary key my backup key can prove that it was the key that was previously mentioned. There is a tech preview by Apple for PassKeys, which is a WebAuthn authenticator which isn't represented by a single piece of hardware but across all the hardware on your Apple account. This reduces the need (or I suppose, increases the trauma) needed to get to an account recovery event.