10Threat-model a password-reset flow.▼mediumNewMetaGoogleAmazon○ sign inA reset flow is a second login page with weaker checks. Interviewers use it because every step has a classic bug, and the strong answer finds them in order.Open full answer →
32Attackers keep getting in by calling your IT help desk and asking for an MFA reset. How do you redesign account recovery?▼hardNewMicrosoftGoogleCrowdStrike◆ premiumPhishing-resistant MFA is only as strong as the process that replaces it when someone loses their phone. Attackers have noticed, and so do interviewers.Open full answer →
34Design the login, MFA and account recovery flows for a consumer web app that attackers target with credential stuffing.▼hardNewGoogleMicrosoftMeta◆ premiumThe login form is the front door, but attackers use the side doors: reused passwords, guessable recovery, and MFA that can be phished or reset by a support agent.Open full answer →