← Back to project catalogue
GP-CY-1CNWVTOCybersecurityReady

Passkey Account Recovery Threat and Assurance Study

A completed cybersecurity engineering study comparing passkey account recovery strategies across device loss, phishing, sync compromise, weak fallback channels, helpdesk abuse, recovery contacts, stolen codes, incomplete revocation and lockout.

Passkey Account Recovery Threat and Assurance Study project visual
GP-CY-1CNWVTO · Cybersecurity
  • Python 3.12
  • NumPy
  • pandas
  • Matplotlib
  • WebAuthn
  • Docker

Software compatibility

Python 3.12 or later

The retained release and clean Docker run use Python 3.12. No identity provider, passkey device, user account or external dataset is required.

Project definition

Problem statement

Passkeys remove reusable passwords from normal sign-in, but a weak account recovery path can still let an attacker replace the authenticators and take over the account.

The engineering problem is to compare recovery methods without hiding phishing, social engineering, sync-provider, revocation and lockout risks inside one average score.

Project objectives

  • Define the complete recovery lifecycle from loss detection to restored access and post-recovery review.
  • Compare eight email, messaging, code, contact, device, administrative and layered recovery strategies.
  • Evaluate nine threat families across four account contexts and four evidence conditions.
  • Keep hard identity, phishing, social engineering, revocation and availability gates visible.
  • Measure sensitivity, uncertainty and workflow failure priorities.
  • Produce an evidence structure that can be extended with service-specific observations.

Project structure

Project components

01

Strategy register

Declares eight recovery approaches with their security, availability, operational and evidence positions.

02

Threat model

Separates device loss, phishing, sync compromise, channel takeover, helpdesk abuse, contact compromise, stolen codes, persistence and denial.

03

Case model

Evaluates 1,152 strategy, threat, context and evidence combinations with explicit hard gates.

04

Decision analysis

Compares balanced, takeover, resilience and privileged-account priorities with uncertainty and sensitivity.

05

Workflow assurance

Ranks fifteen criteria across twelve recovery stages and links requirements to the retained evidence dimensions.

06

Evidence package

Retains CSV, JSON, figures, source annotations, tests and editable documentation.

Methodology

Project workflow

  1. 01
    Define the account context

    Set the protected service, user population, impact, assurance need and available authenticators.

  2. 02
    Map recovery paths

    Record every fallback channel, operator step, trusted party, waiting period and replacement action.

  3. 03
    Apply threat gates

    Test identity binding, phishing resistance, social engineering control, revocation completeness and availability.

  4. 04
    Compare strategies

    Review context scores, decision scenarios, uncertainty intervals and sensitivity.

  5. 05
    Inspect workflow risk

    Use the FMEA and assurance crosswalk to identify missing evidence and weak stages.

  6. 06
    Specify validation

    Replace normalized screening positions with measured service evidence before operational use.

Demonstration scenario

Run the complete study, compare ordinary email recovery with independent backup authenticators and the layered strategy, inspect which hard gates fail for privileged accounts, then trace the retained recommendation through uncertainty, sensitivity and the highest-priority workflow risks.

Engineering

Tools and method

Evidence model
Python structures define every strategy, dimension, threat, context, criterion and assurance requirement.
Numerical assessment
NumPy and pandas implement deterministic cases, hard gates, uncertainty, sensitivity, FMEA and assurance tables.
Standards mapping
The report connects NIST Digital Identity Guidelines, WebAuthn, FIDO guidance, platform recovery and application-security controls.
Documentation
The build creates editable Word and fixed PDF report and guide files with contents, figure and table lists.
Reproducibility
Pinned dependencies, a fixed seed, automated tests, repository validation and Docker repeat the retained study.

Testing

Evaluation

Evaluation measures

  • Eight recovery strategies across twelve assurance dimensions
  • 1,152 deterministic assessment cases
  • Nine explicit threat families and five hard assurance gates
  • Four balanced, takeover, resilience and privileged-account scenarios
  • 30,000 uncertainty draws per recovery strategy
  • 180 workflow FMEA cells and 120 assurance links
  • Eleven automated tests and twelve reproducible figures

Project boundaries

  • All zero-to-ten values are literature-informed screening positions, not measurements from a named identity provider or service.
  • The project contains no passkeys, recovery codes, identity documents, personal data, user accounts or buyer information.
  • A strong model position does not certify a production recovery workflow or prove resistance to an untested attacker.
  • A real implementation requires service-specific threat modelling, authorized testing, identity evidence, telemetry, redress and accountable approval.
  • The study is not a security certification, legal opinion or authorization to process identity evidence.
  • No information collected.

Included

  1. 01Eight passkey account recovery strategy archetypes
  2. 02Nine account takeover, persistence and availability threat families
  3. 03Four consumer, financial, workforce and privileged account contexts
  4. 041,152 deterministic assessment cases
  5. 0530,000 fixed-seed uncertainty draws per strategy
  6. 06Four decision scenarios, fifteen validation criteria and workflow FMEA
  7. 07Twelve generated analytical figures and two official WebAuthn literature figures
  8. 08Eleven automated tests and clean Docker reproduction
  9. 09Complete project files, calculations, results and analysis in a private GitHub repository
  10. 1093-page project documentation in PDF and editable Word formats
  11. 1116-page setup and usage guide in PDF and editable Word formats
  12. 1265 annotated references with a complete source matrix

Project record

No information is collected on this page.

Permanent project ID
GP-CY-1CNWVTO
Catalogued
21 Aug 2026
Completed
04 Sept 2026
Verified
04 Sept 2026
Demonstration
Included in repository

Handover

After purchase

  1. 01
    Payment is confirmed

    The project is marked unavailable and cannot be purchased again.

  2. 02
    Repository access is granted

    The buyer's submitted GitHub account receives access to the private repository.

  3. 03
    The purchase record is delivered

    The certification sheet is prepared from the reviewed buyer details and sent privately by email.