Keep in mind these are all meant to be in-channel "back-up" strategies for when usual authentication methods fail and/or human error results in a complete loss

Keep in mind these are all meant to be in-channel "back-up" strategies for when usual authentication methods fail and/or human error results in a complete loss of credentials. Forcing a true side-channel workflow for re-authentication and credential recovery isn't practical for most organizations. A more secure, but frustrating for the dis-organized, approach is to email out a small set (3-5) of one-time credential-recovery passphrases (often called a scratch-list) with the initial account approval message. Another slightly more usable forced-in-channel alternative includes image file recognition where the user selects from a predefined set of pictures to use as their "shared secret" when the account is created. Typically, a salted hash of the image file is stored as the actual password value so multiple versions (slightly bit skewed) of the same visual representation can be leveraged for password expiration. Alas, all of these more secure alternatives limit the user's ability to "personalize" their shared secret and require additional bookkeeping.