CRC32 is a terrible choice if you want to use 'rescue files'. AFAIK, they're designed as a sanity check rather than resistant to collisions. Also, I don't understand how 'rescue files' would work. Does the user have to upload it to the server to be verified? It doesn't sound like 2FA at all.

How do you identity authorized devices?

@R15: As explained: To authorize a device, the user need to select the rescue files OR if he has other authorized devices, to open one and to manually authorize the new device listed (digits code required) [ on the 2 devices ].

TL;DR: be more concise. Your question is either unclear or too broad.

@A.Hersean Ok, I'll try to write a medium post to explain better with graphics and to post the link on my initial post.

@Iakano If you need to write a medium post about it then it's DEFINITELY not defined enough.

Probably the best answer to this is "No, you should never roll your own security schemes"

@RobertMennell As I seen my explanations wasn't cleared, I rewrited my post with more details. It's more long, but this finaly seems required. You said to never roll our own security scheme, but the current security schemes used in 99% of current websites are less secure than my scheme... because of OTP recover password link! You could read my medium post if you want more details :) Thanks for your time.

@Iakano says someone with a vested interest. There are MANY reasons why you should never roll your own security scheme. There are many examples why just here on Security. The default rule of thumb is unless you're going to pour the time, resources, and external objective investigation into it, you don't actually know how secure it is. That takes money. That being said there are plenty of properly implemented MFA schemes that are secure and that if done correctly should do what you want. MFA was figured out by people long ago. There's a lot of secure ways of doing it. Use one of those.

Ok @RobertMennell, so you say there is good MFA. Do you have an example of website that use a good MFA that permit to rescue the account ? Of course, without receiving email / SMS (too much attacks), without the need to buy something (like a Yubikey) and idealy without password (because users use the same password on all websites) ? I don't found any one. Thanks

What, exactly, is the point of asking for expert advice a design, when you simply intend to either ignore or argue with all of the helpful critical feedback you receive from those experts? Any good design published from even the most technically capable amongst us has been through dozens of rounds of critical feedback and adaptation. You might want to consider adopting that approach.

@StephenTouset Because theses « experts » doesn't give any proove of attack possible on this scheme. But all existing schemes used on 99% of websites are worst IMHO because as explained: 1/ Users uses same password everywhere. A lots of websites databases have been leaked, and rainbow tables are often enough to reverse the password and connect to any other user website with the known password. 2/ The « I forgot password » OTP link is a big vector of attacks. So, my sheme solve theses problems (and others).

@StephenTouset But If you have a better scheme to suggest with rescue account that not require SMS or Email, and idealy without passwords, tell me please, because every « experts » never answered to this question... they all said there is Good MFA/2FA but no one is capable to give one website that uses it without rescue account by Email/SMS.

Keep in mind that stack exchange isn't a message board and isn't really suited for extended conversations or free in-depth security reviews and re-reviews. It's best suited for specific questions like "is choosing a file on my device better than a password reset link in case someone else has the phone" or "is sending the hash of a preshared token secure against replay attacks" "should users be able to choose the recovery file name and location or should it be predetermined?".

The latest edit is barely even a question. If you want this question re-openened I highly suggest you roll back to revision 1 (which was the clearest and most concise) and just add a link to your post for further reading. At least that iteration of the question was answerable, everything you edited in after that did not help make this a more answerable question.

@CodyP Ok, it's my 2nd day on StackExchange, thanks for theses precisions, I'll try to see if I found a better site to exchange with experts.

@Caleb Ok, I'll follow your suggestion. ( But I still waiting you give me an example of « Good MFA » website that not open to common security holes I've fixed with my scheme ;-) )

As I've mentioned in my answer, recovery for most 2FA is not as simple as getting a text or email. Google accounts ask for account details, Duo and Apple use preshared codes, and Github even allows your to preauthorize Facebook as a recovery account so that a relogging in to Facebook will recover your account. These services also have the support staff to do reset over the phone if you loose all this information but can prove with other information you own the account, which you may not have.

@CodyP Google ask account details: A previous password (could also be leaked on dark net) and if you click « next question », they show me some characters of the attached email address, so it's easy guessable... Duo services is not an option (trust chain, service down or hacked...) Associate external services like FaceBook reduce privacy of the user.

I'm not going to go into detail, but it doesn't sound like your risk assessment is accurate since it's very different from a typical risk assessment and you're trying to stop small risks with big problems. If you think privacy concerns from integrating with Facebook, trust chain with Duo, and odds of pulling a previous password and guessing an email address are serious risks for your company you need to hire a large and experienced security team.