Setup recovery process

[iandunn]

Folks will sometimes get locked out when they lose their phone etc. Resetting a 2nd factor would ideally be independent of resetting the password, but for low-access accounts email might be better than nothing.

For high-privledge accounts, verification over video conference might be a secure option.

Maybe we require having 2 methods enabled, to reduce support requests.
Related WordPress/two-factor#485

[iandunn]

We could ask during 2fa signup that folks provide the w.org username of 2 people that can vouch for them. If they ask for recovery, we could contact those folks, ask them to confirm the original user in person or video chat, and then reply back to us. That whole process could be automated.

That’s assuming the other accounts aren’t also compromised, though. We’d also need to periodically email folks to make sure it’s still current.

For privileged accounts we’d probably still want to do it manually.

[iandunn]

We've already had the first example of the need for this

https://wordpress.slack.com/archives/C08M59V3P/p1700078774860549

[dd32]

upstream issue: WordPress/two-factor#621