Direct sources. Clear status. Practical public information.
Authorization boundary: use this exercise only on accounts you own or are explicitly authorized to administer. Never put passwords, passkeys, one-time codes, recovery codes, QR codes, private logs, or real account data into public AI tools or public copy.
A passkey, multi-factor authentication (MFA), and a recovery code are not three names for the same control. They protect different stages of account access.
Three controls, three jobs
| Control | Primary job | Important boundary |
|---|---|---|
| Passkey / FIDO/WebAuthn authenticator | Uses cryptographic authentication bound to the legitimate service/domain; supported implementations can provide phishing resistance. | A passkey does not eliminate device, sync, sharing, malware, account-recovery, or service-provider risks. |
| MFA | Requires more than one factor or authenticator element for sign-in, reducing reliance on a password alone. | MFA methods differ. Manual one-time codes and SMS can add protection but are not treated by NIST as phishing-resistant authentication. |
| Recovery code | Provides an emergency route when the normal authenticator is lost or unavailable. | A recovery code is a secret. NIST describes saved recovery codes as securely stored offline; a used saved code should be invalidated/replaced by the provider. |
The owner-authorized recovery test
- Inventory: choose one account you own. Record only the service name, business owner, recovery owner, and review date—never the secrets.
- Official route: open security settings from the known official app/site, not from an email or search-ad link.
- Sign-in control: identify whether a passkey/phishing-resistant option and MFA are available. Do not disable a working method until a safe replacement and recovery path are proven.
- Recovery control: confirm that current recovery addresses/devices belong to the owner and remove only entries the responsible owner verifies as obsolete.
- Code handling: if the provider issues saved recovery codes, store them offline in a protected owner-controlled location; do not screenshot them into a shared photo library or paste them into AI/chat.
- Test safely: use the provider’s official test or a planned sign-out/sign-in on a noncritical session. Do not intentionally lock out the only administrator.
- Repair and retest: update one stale recovery route at a time, verify notifications, and record success without recording the secret itself.
A minimal evidence log
Record: account/service; authorized owner; controls enabled; recovery routes reviewed; test date; test outcome; repair made; retest outcome; next review date; and human approver. Keep the log free of passwords, codes, tokens, keys, QR images, and private configuration details.
Human stop point
Stop when ownership, admin authority, shared-device control, provider terms, enterprise policy, identity-proofing, regulated data, or the only recovery path is unclear. Involve the responsible account owner, IT/security administrator, provider, or qualified professional.
What Louisville Institute of Technology can contribute
LouisvilleIT can teach account owners to map controls, protect secrets, test recovery safely, repair one issue, and preserve non-secret evidence. It does not access accounts, certify security, override provider policy, or guarantee that an account cannot be compromised.
Official sources
- NIST SP 800-63B-4 — Authentication and Authenticator Management
- NIST — Authenticator Types
- NIST Small Business Cybersecurity — Multi-Factor Authentication
- CISA — Secure Our World MFA Tip Sheet
Sources reviewed November 2, 2026. Provider implementations and account-recovery options differ.
Public-information notice: This Pulse is a dated, source-linked research summary for general educational use. It reports what the cited sources state or what the identified public record shows as of the date reviewed. Citation does not mean endorsement, partnership, certification, or independent confirmation of every third-party assertion. This is not individualized legal, medical, tax, accounting, investment, insurance, cybersecurity, licensing, regulatory, procurement, employment, real-estate, or other professional advice. Rules, facts, availability, and eligibility can change. Verify the controlling source, jurisdiction, effective date, and your own facts, and consult the responsible agency or a qualified professional before a consequential decision. External links are provided for attribution and may change. Use this information and any reader-controlled checklist at your own discretion and risk.