I recently reevaluated my approach to identity & recovery across all the services I rely on and it’s a mess.

Apple and Google both provide sensible security settings but you can only guess how recovery might work if you are locked out of your account from their docs. Even with their advanced security programs (requiring a hardware token) I’m not entirely sure that I’m not defeating the whole purpose of these measures by putting a mobile number in my account that can be sim swapped. On the other hand I’m also not entirely sure if I could recover access from what I think I’d need to provide to prove my identity (recovery codes, trusted contacts, …)

I get why they might not want to lay out the whole process and every heuristic they use, but it’s not really reassuring.