4 ms·
This is of course implementation dependent, but ideally a recovery key is single use. You should also be notified by email or some other channel that the recove
by michaelmior 4y ago
This is of course implementation dependent, but ideally a recovery key is single use. You should also be notified by email or some other channel that the recovery key was used. Then you are immediately aware if this use was unauthorized and you can take appropriate action. This type of response is not possible for unauthorized password use.
- em-bee 4y agoyou can get notifications for logins from a new device. isn't that just as useful?
- michaelmior 4y agoI think there's at least a couple ways these are different: 1. It's easy to start ignoring such notifications if you regularly log in to new devices (or if logins expire). I don't think this is true to the same degree with notifications of recovery code usage. 2. Devices can potentially be spoofed.