Circular recovery dependency
A circular dependency happens when two or more accounts need each other to open: your email needs your manager, your manager needs your authenticator, and your authenticator needs your email. Nobody can go first.
- What it is
- A circle that can't be opened
- Since
- A term coined by this site
- Does it affect you?
- Depends
What it is
A circular recovery dependency is a chain of accounts that protect each other in a closed loop: to get into the first you need the second, to get into the second you need the third, and to get into the third you need the first. Without your phone, none of them can be opened, because each one is waiting for another to open first.
A real, fairly common example: your email's password lives in your password manager. The manager asks your authenticator app for a code. And that app, when reinstalled on a new phone, restores its codes by signing in with your email. The loop closes: email → manager → authenticator → email.
- Your email keeps its password in the manager.
- The manager asks your authenticator app for its second factor.
- The authenticator app, when restored on a new phone, asks you to sign in with your email.
Each of the three pieces is correct on its own. The problem isn't any one of them: it's that, together, they leave no door in.
The loop doesn't always have three links. Sometimes it's just two: your password manager asks for an email code, and that email uses the manager itself to remember its own password. Sometimes it's four or five, spread across your bank, a second email account and a crypto app. The number of pieces matters less than one question: if you trace the whole path, do you reach somewhere that opens without your phone, or do you always loop back to the start?
When it was introduced
It isn't a term from a standard or a manufacturer: we call it this because there wasn't a simple name for something very real. The idea of a "circular dependency" comes from software engineering, where two modules that need each other can't load first. Applied to personal accounts, the phenomenon has existed for as long as someone has protected one account with another — a recovery email, a second factor, a password manager — without noticing where that chain ends.
What's new isn't the phenomenon, it's how often it happens. The more accounts someone has protected with good practices — a manager, 2FA everywhere, cloud-backed codes — the more links there are that could, without meaning to, lean on each other. Ironically, the better you "do it right," the easier it is to end up with a loop if you never review the whole picture.
Why it's used
Nobody sets out to create a loop. It happens almost exclusively to people who do things "right": they use a password manager, turn on two-step verification everywhere, keep their codes in an app with a cloud backup. Each step, on its own, is correct security advice.
The loop appears when those steps lean on each other without anyone asking which piece doesn't depend on any of the others. It's the opposite of a visible single point of failure: here there isn't one fragile piece, there are several solid pieces that, combined, leave no way in without your phone.
It's also hard to see from the inside. When you set up each account, you only look at that account: you turn on whichever second factor is most convenient at that moment, without looking back at what you already configured elsewhere. The loop only becomes visible if you map the whole path between your accounts — something almost nobody does until it's already too late.
Does it affect you?
It depends on how you've connected your accounts to each other, and it's hard to spot at a glance. Take the test: it checks the full path between your email, your manager and your app, and flags whether it closes into a loop. It isn't about having few or many accounts, it's about how they lean on each other.
Check this
- Could you say, without checking, which of your accounts you'd open first if you lost your phone?
- Do your password manager and your email use the same second factor?
- Does the app that stores your verification codes restore itself by signing in with your own email?
- Do you have something — a key, a code on paper — that doesn't depend on any of your other accounts?
None of these questions has one universally "correct" answer: what matters is that you have an answer, not silence, when you ask yourself.