Audit your own factors and find the account that unlocks the others

short · 35 min · Objective 2.1

Task

Inventory the second factors on your own accounts, classify each by strength, and trace the recovery chain to find which single account could reset the rest. That account is the one that needs the strongest protection, and almost nobody has identified it before doing this exercise.

Steps

  1. Write lab/auth/factors.csv with header account,factor_type,category,strength,recovery_codes_held for at least eight accounts. category is knowledge, possession or inherence. Record types only, never values.
  2. Mark any row where two factors fall in the same category, and write in lab/auth/single.md why that is one factor twice rather than two.
  3. Trace the recovery chain: for each account, record which address or number can reset it, in lab/auth/chain.csv with header account,reset_via,reset_target_protected_by.
  4. Identify the account that can reset the largest number of others and name it in lab/auth/keystone.md, with what protects it today and what you will change.
  5. Write lab/auth/policy.md giving the password guidance you would actually give a user, and naming two pieces of older advice you would not repeat, with the reason each one backfired.

Verify

awk -F, 'NR>1 && NF>=5 {n++} END {print n" account(s)"}' lab/auth/factors.csv
awk -F, 'NR>1 {print $3}' lab/auth/factors.csv | sort -u | wc -l
awk -F, 'NR>1 && $5 ~ /no/ {n++} END {print n" account(s) with no recovery codes"}' lab/auth/factors.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" chain entr(ies)"}' lab/auth/chain.csv
grep -Eic 'expiry|complexity|write it down|ninety|90' lab/auth/policy.md
grep -c . lab/auth/keystone.md

Eight accounts across at least two categories, a recovery chain, a named keystone account, and a policy note addressing at least one piece of obsolete advice. Accounts with no recovery codes held are the expected finding and the reason to do this.

Notes

If the audit contains a password or a code anywhere, delete the file and redo it. The record is of factor types and of structure; the values belong in a password manager and nowhere else.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.