Lion Cipher Lab
Set up account recovery so 2FA never locks you out
- Identity & Access Management
- Beginner
- ~30 min
- Free · no account required
Why it matters
Turning on two-factor authentication is only half the job; the other half is making sure you can still get in if you lose your phone, and that an attacker can't use the recovery path as a back door. This is where people get hurt in both directions. On one side, someone enables 2FA, loses or replaces their phone, has no backup codes, and gets permanently locked out of their own account — which is exactly why many people avoid MFA at all. On the other side, weak recovery — an old phone number, an unprotected recovery email, easily-guessed security questions — becomes the easiest way for an…
What you'll learn
- why recovery is the weak point of MFA
- generating and safely storing backup codes
- registering a second factor as a fallback
- keeping recovery email/phone current and secure
- recognising recovery as an attack path to defend
Steps in this lab
- Recovery is the weak point of MFA — in both directions
- Start with your email — it's the master key
- Generate backup codes and store them safely
- Register a second factor as a fallback
- Audit recovery email and phone — attackers love stale ones
- Handle security questions like passwords
- Why recovery is where strong auth is won or lost