6.4.3 / v5.0.be-2.5.6 Verify forgotten password" / MFA issue

Hi all,

I'm trying to wrap my head around the requirements around MFA / forgotten password on an application I'm trying to ensure adheres to L2 requirements but services older / less tech savvy users.

• So it is made clear in the document that MFA is optional for apps of this level "Previously, the ASVS has required mandatory MFA. NIST does not require mandatory MFA. Therefore, we have used an optional designation in this chapter to indicate where the ASVS encourages but does not require a control"
• While the ASVS does not mandate the inclusion of a "Forgot Password" feature, if such a feature is implemented, it must adhere to asvs standards. Personally, a method for recovering accounts, whether built into the app or done via a help desk, is a basic service that should be mandatory for any organisation that allows it's customers to create accounts.
• It is clear that any forgotten password process must specifically use MFA "Verify forgotten password, and other recovery paths use a secure recovery mechanism, such as time-based OTP (TOTP) or other soft token, mobile push, or another offline recovery mechanism.... Unsafe out of band authenticators such as e-mail and VOIP are not permitted. PSTN and SMS authentication are currently "restricted" by NIST and should be deprecated in favor of push notifications or similar."
• Sure PSTN can be used, but being RESTRICTED and likely to be phased out means that it isn't really an option worth implementing at this point. Therefore it really sounds like MFA is not optional and is a requirement for all apps, L2 and even L3.
• Requiring newer authentication methods like time-based OTP (TOTP), soft tokens, or mobile push notifications in an application primarily serving older, less tech-savvy users for example, presents challenges, and a large portion of our user base would not accept this being mandatory.

Basically the TLDR version is:

• MFA is optional
• Account recovery is required
• Account recovery needs MFA
• Specific types of MFA are required
• These forms of MFA are not accesible to all users of L3/L2 apps

I'm submitting this as a potential issue, although maybe I'm overlooking something, if so it would be good to hear where. Thank you!

Review the MFA and forgotten-password requirements quoted in the issue and the surrounding ASVS text. Trace how the statements about optional MFA, account recovery, and permitted recovery mechanisms fit together. Done means the standard's intended requirements and any needed wording changes are clearly decided.