OWASP ASVS

A security practitioner argues that account recovery flows remain the weakest link in authentication, and that the framing around them is wrong. Standards like NIST 800-63-4 and OWASP ASVS require notifying an account owner only after a password reset completes, staying silent at the attempt stage to prevent account enumeration. The practitioner contends the reset attempt itself is the one event no standard requires services to flag, leaving users blind to attacks in progress.