Preface
We are currently creating a new system for our clients and are stuck on account recovery when a user loses access to everything.
The system is entirely controlled by our company in the following way:
- Our employee creates a client company profile (name*, other fields like logo, website are optional)
- Our employee “invites“ the client’s administrator to the account by entering an email and/or a phone number (we send an email and/or text inviting the client to our system)
- The client clicks on the generated URL and creates their access (adding any relevant info like their name, email/phone if it’s not already there or secondary emails/phone numbers, etc.)
- The client can now invite further members to access their company’s information
This works great and allows for account recovery assuming the user maintains access to their email or phone number.
Issues
The industry in which we work has a lot of movement and user emails and phone numbers change frequently. (Users are contractors).
Users may have access to multiple companies simultaneously. It’s not a 1:1 relationship, it’s an many:many relationship between company and user.
We foresee issues where a user is invited to join the system from company A (company A gives the contractor an internal email) then the user is added to a second company B (using the company A email). After the contract with company A is terminated, company A removes the user’s access (email, phone) and, because he’s human, the user forgets their password.
How does the user recover their account without having access to the account’s email or phone and how can we allow the user to securely change his account’s email or phone?
Yes, recovery questions are feasible, but I’ve never been a fan of this security method. People always forget what they put or they inadvertently make this information public on social media.
