Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 108 posts

Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#1

Post by joshmn »

Hi friends,

The skinny is this: I went to prison, all my personal items were stolen IRL and the same person changed a bunch of my passwords. Subsequently, I can't recover my GitHub account.

I have recovered most of my digital assets by proving I am me. Recovering my GitHub has proven to be more painful than Google's treatment regarding my Google Workspace.

I have the original phone number associated with my account, and can verify a bunch of private repos that are associated with my account—even the number of commits on one of them (almost 6900). I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed.

I maintain two relatively popular Ruby packages that have gone stale since I've been gone, and there are projects my GitHub there that I was working on prior to my incarceration—including a SaaS I had hoped to launch post-prison and two books I was ready to publish. Having said, just opening another account isn't exactly the option I want to take.

I've opened a ticket, but I'm getting the "shit out of luck because we don't know you are you" treatment. I understand that security is important, but if one can prove they are them, what's the point?

Are there other avenues I have that I haven't explored yet?

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#2

Post by qafy »

unfortunately, the techniques you are trying in order to get access to a dormant Github account are EXACTLY the same ones that github gets spammed with every day by bad actors attempting supply chain attacks. You don't have anything that proves your identity any more than any rando on the internet in Github's eyes at least. Everything you have presented here may be convincing enough to me, but probably not to GitHub's opsec policies.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#5

Post by joshmn »

clamprecht wrote: post #4

Is there a phone number associated with the account? How does GitHub want you to prove that you're you?

There is, but it's not a phone number I have access to anymore. I changed it to the said person's phone number before I surrendered so that this exact scenario did not happen. I trusted the wrong person.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#6

Post by abxyz »

> I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed.

The situation you are in is very unfortunate and I am sympathetic but in GitHub's defence, this is exactly what I hope would happen when I enable 2FA. I would be very perturbed to find out that GitHub would grant access to my account given identity documents. There are some creative solutions (e.g: a countdown to the reset with progressively more aggressive email notifications to ensure the account holder is aware) but even they are problematic. So, this sucks, but it's the price we pay for security.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#8

Post by joshmn »

abxyz wrote: post #6

> I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed. The situation you are in is very unfortunate and I am sympathetic but in GitHub's defence, this is exactly what I hope would happen when I enable 2FA. I would be very perturbed to find out that GitHub would grant access to my account given identity documents. There are some creative solution…

That's the same stance I have and why I'm torn. The little quirk here—where it makes slightly more sense—is that they received a legal notice at one point (from the US Government) about my account, there are plenty of online articles to corroborate me as me, and I have a fancy prison release ID that can help me identify me. Unfortunately this context is probably lost on the individuals who work their Zendesk.

The policies are rather draconian as others have mentioned. Anyone could be the victim of theft; mine just has an awkward paper trail attached to it.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#9

Post by abxyz »

joshmn wrote: post #8
abxyz wrote: post #6

> I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed. The situation you are in is very unfortunate and I am sympathetic but in GitHub's defence, this is exactly what I hope would happen when I enable 2FA. I would be very perturbed to find out that GitHub would grant access to my account given identity documents. There are some creative solution…

That's the same stance I have and why I'm torn. The little quirk here—where it makes slightly more sense—is that they received a legal notice at one point (from the US Government) about my account, there are plenty of online articles to corroborate me as me, and I have a fancy prison release ID that can help me identify me. Unfortunately this context is probably lost on the individuals who work their Zendesk. The pol…

I think the disconnect between you and GitHub support is that you're positioning this as a problem of proving your identity whereas for GitHub support it is a policy. The GitHub policy is: you lose your 2FA, you lose your account. Verifying your identity is not relevant. GitHub provides extensive tooling to protect your account (multiple methods of 2FA, recovery codes etc.) and so from their perspective, while this is deeply unfortunate, the policy is very clear and allowing you access to the account would be a major security issue (not for your account specifically, but for GitHub as an organization).

edit: https://docs.github.com/en/site-policy/other-site-policies/g...

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#10

Post by xwowsersx »

Thoughts of the top of my head:

- If the most important thing is control of the Ruby gems, reach out to RubyGems.org support

- for your projects, if you have are past collaborators on those repos, they can sometimes open GH tickets referencing the project and vouch for you. Doesn't guarantee success, but adds weight

- GH (being part of MSFT) does have some channels for escalated identity verification. Lawyers or notarized ID may be needed...possibly expensive, but sometimes the only way

GH support is extremely strict on account recovery once 2FA/backup codes are gone. I wish you luck!

Post reply on HN