NIST 800-63B-4 drops security questions for recovery

The NIST SP 800-63B-4 standard no longer recognizes knowledge-based authentication or security questions for account recovery due to poor usability and low security. Instead, the standard permits four classes of methods: saved recovery codes, issued recovery codes, recovery contacts, and repeated identity proofing. The author outlines these allowed methods, implementation details, and migration steps for development teams. Open article →