Passkey Account Recovery Threat and Assurance Study
A completed cybersecurity engineering study comparing passkey account recovery strategies across device loss, phishing, sync compromise, weak fallback channels, helpdesk abuse, recovery contacts, stolen codes, incomplete revocation and lockout.

Software compatibility
The retained release and clean Docker run use Python 3.12. No identity provider, passkey device, user account or external dataset is required.
Project definition
Problem statement
Passkeys remove reusable passwords from normal sign-in, but a weak account recovery path can still let an attacker replace the authenticators and take over the account.
The engineering problem is to compare recovery methods without hiding phishing, social engineering, sync-provider, revocation and lockout risks inside one average score.
Project objectives
- Define the complete recovery lifecycle from loss detection to restored access and post-recovery review.
- Compare eight email, messaging, code, contact, device, administrative and layered recovery strategies.
- Evaluate nine threat families across four account contexts and four evidence conditions.
- Keep hard identity, phishing, social engineering, revocation and availability gates visible.
- Measure sensitivity, uncertainty and workflow failure priorities.
- Produce an evidence structure that can be extended with service-specific observations.
Project structure
Project components
Strategy register
Declares eight recovery approaches with their security, availability, operational and evidence positions.
Threat model
Separates device loss, phishing, sync compromise, channel takeover, helpdesk abuse, contact compromise, stolen codes, persistence and denial.
Case model
Evaluates 1,152 strategy, threat, context and evidence combinations with explicit hard gates.
Decision analysis
Compares balanced, takeover, resilience and privileged-account priorities with uncertainty and sensitivity.
Workflow assurance
Ranks fifteen criteria across twelve recovery stages and links requirements to the retained evidence dimensions.
Evidence package
Retains CSV, JSON, figures, source annotations, tests and editable documentation.
Methodology
Project workflow
- 01Define the account context
Set the protected service, user population, impact, assurance need and available authenticators.
- 02Map recovery paths
Record every fallback channel, operator step, trusted party, waiting period and replacement action.
- 03Apply threat gates
Test identity binding, phishing resistance, social engineering control, revocation completeness and availability.
- 04Compare strategies
Review context scores, decision scenarios, uncertainty intervals and sensitivity.
- 05Inspect workflow risk
Use the FMEA and assurance crosswalk to identify missing evidence and weak stages.
- 06Specify validation
Replace normalized screening positions with measured service evidence before operational use.
Demonstration scenario
Run the complete study, compare ordinary email recovery with independent backup authenticators and the layered strategy, inspect which hard gates fail for privileged accounts, then trace the retained recommendation through uncertainty, sensitivity and the highest-priority workflow risks.
Engineering
Tools and method
- Evidence model
- Python structures define every strategy, dimension, threat, context, criterion and assurance requirement.
- Numerical assessment
- NumPy and pandas implement deterministic cases, hard gates, uncertainty, sensitivity, FMEA and assurance tables.
- Standards mapping
- The report connects NIST Digital Identity Guidelines, WebAuthn, FIDO guidance, platform recovery and application-security controls.
- Documentation
- The build creates editable Word and fixed PDF report and guide files with contents, figure and table lists.
- Reproducibility
- Pinned dependencies, a fixed seed, automated tests, repository validation and Docker repeat the retained study.
Testing
Evaluation
Evaluation measures
- Eight recovery strategies across twelve assurance dimensions
- 1,152 deterministic assessment cases
- Nine explicit threat families and five hard assurance gates
- Four balanced, takeover, resilience and privileged-account scenarios
- 30,000 uncertainty draws per recovery strategy
- 180 workflow FMEA cells and 120 assurance links
- Eleven automated tests and twelve reproducible figures
Project boundaries
- All zero-to-ten values are literature-informed screening positions, not measurements from a named identity provider or service.
- The project contains no passkeys, recovery codes, identity documents, personal data, user accounts or buyer information.
- A strong model position does not certify a production recovery workflow or prove resistance to an untested attacker.
- A real implementation requires service-specific threat modelling, authorized testing, identity evidence, telemetry, redress and accountable approval.
- The study is not a security certification, legal opinion or authorization to process identity evidence.
- No information collected.
Included
- 01Eight passkey account recovery strategy archetypes
- 02Nine account takeover, persistence and availability threat families
- 03Four consumer, financial, workforce and privileged account contexts
- 041,152 deterministic assessment cases
- 0530,000 fixed-seed uncertainty draws per strategy
- 06Four decision scenarios, fifteen validation criteria and workflow FMEA
- 07Twelve generated analytical figures and two official WebAuthn literature figures
- 08Eleven automated tests and clean Docker reproduction
- 09Complete project files, calculations, results and analysis in a private GitHub repository
- 1093-page project documentation in PDF and editable Word formats
- 1116-page setup and usage guide in PDF and editable Word formats
- 1265 annotated references with a complete source matrix
Project record
No information is collected on this page.
- Permanent project ID
- GP-CY-1CNWVTO
- Catalogued
- 21 Aug 2026
- Completed
- 04 Sept 2026
- Verified
- 04 Sept 2026
- Demonstration
- Included in repository
Handover
After purchase
- 01Payment is confirmed
The project is marked unavailable and cannot be purchased again.
- 02Repository access is granted
The buyer's submitted GitHub account receives access to the private repository.
- 03The purchase record is delivered
The certification sheet is prepared from the reviewed buyer details and sent privately by email.