ReferenceMFA methods
Backup codes
Pre-generated one-time codes the user prints/saves. Each can be used exactly once.
Lookup secrets / Recovery codes
Spec:
Provides AAL: AAL2
Summary
Pre-generated one-time codes the user prints/saves. Each can be used exactly once.
Strengths
- Offline
- Works without any device
Weaknesses
- User must safely store them
- Limited (typically 10-12 codes per generation)
Enrollment
Generated all at once. User saves them.
Recovery
These ARE the recovery story, paired with TOTP or WebAuthn as the user's break-glass.