A fictional password management service has successfully prevented a user from accessing his forgotten passwords by requesting the one password he had installed the service to stop needing to remember.
The user, Daniel Shaw, began the morning trying to open a utility bill. The utility website asked for a password. His password manager offered to fill it, provided he first entered the master password. Shaw recognized this as a reasonable security measure until he tried to remember the master password.
"It was something memorable," he said. "I remember deciding that."
Shaw selected the recovery option, which sent a verification message to his backup email. The backup email required a password stored in the manager. A trusted device could approve the request, but that device had been replaced after the screen broke. The service congratulated him on keeping his trusted devices current.
An automated assistant suggested consulting the recovery code generated during setup. Shaw remembered printing the code and putting it somewhere safe. The location was safe enough that he could not identify it, although he was confident it was not in the folder labeled passwords because that would have been obvious.
He searched his desk, discovered an expired warranty and briefly considered whether the warranty account might still be logged in somewhere. The assistant warned him not to reuse passwords. Shaw assured it that reuse was unlikely because he could not remember a single one.
The service offered a help article explaining that its staff could not access his vault. This was the feature that had persuaded him to buy it. He reread the article with a new appreciation for how effectively a promise can be kept.
A final recovery path involved a security question Shaw had answered several years earlier. Asked to name his favorite place, he entered three places he liked, two he used to like and one he thought a security-conscious version of himself might have chosen to confuse attackers. None was correct.
The utility bill remained unpaid, but every attempted access was recorded. Shaw could view the activity log after signing in. The assistant recommended doing so to confirm whether any suspicious activity had occurred, such as repeated attempts to enter the account from his own home.
At noon, Shaw found the recovery code inside a book he had chosen because nobody would think to look there. The code worked. He immediately changed the master password to something memorable and placed the new recovery code somewhere safer.