> If the recovery mechanism allows for knowledge based recovery Basically almost every single auth method is flawed by that because it gives way to social engi

> If the recovery mechanism allows for knowledge based recovery Basically almost every single auth method is flawed by that because it gives way to social engineering attacks. Also once your email is taken over everything else is.