Post

Last of four on MFA by moment, and it is the one I would lead with if I only got one. Unlock and password reset is the moment the user is locked out. Which is the moment your authenticator app is least likely to be reachable. The phone is dead, or lost, or on a desk in another building.

The laptop will not let them in. The app that proves who they are lives behind the login they cannot complete. A factor that sits behind the door it is supposed to open is not a factor. It is a dependency. The failure here is not a breach. It is a person standing at a desk not working.

And it does not fall over quietly. It falls over into someone's queue. So the requirement inverts. Everywhere else you want the strongest factor the user can hold. Here you want the strongest factor that does not depend on anything currently broken. Above: prove first, then change.