Gitlab Support is no longer processing MFA resets for free users
about.gitlab.com
Gitlab Support is no longer processing MFA resets for free users
1–10 of 228 posts
Re: Gitlab Support is no longer processing MFA resets for free users
#2Seems like a good way to discourage the use of mfa...
Re: Gitlab Support is no longer processing MFA resets for free users
#3> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable.
This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pieces of info proving you are who you are.
If you offer MFA, I love the idea of following best security practices for users recovering their accounts when losing MFA devices/tokens/etc., but there has to be a “best practice” that includes recovering an account after a due diligence process has been followed proving who a user is who she says if she lost all normal recovery methods.
Edit: It does look like they have a different, less “fatal” avenue to recover work related accounts (“What if this is a work account?“ FAQ), but I’d still be scared to host my FOSS repos there and make a mistake only to lose my account forever.
Re: Gitlab Support is no longer processing MFA resets for free users
#4> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…
Certifying authenticity is a manual process and costs money. Even though I think GitLab could have handled it better, I understand their reasons.
Re: Gitlab Support is no longer processing MFA resets for free users
#5> I don’t like this and I want to tell someone.
I'm sure this is meant to come across as maybe slightly tongue-in-cheek, and is also meant to provide users an outlet they feel they can vent in productively, but... it reads as dismissive, and leaves me with the impression that they don't actually care to hear any feedback.
Re: Gitlab Support is no longer processing MFA resets for free users
#6> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…
> Even crypto exchanges allow recovery if you lose all traditional recovery
Yes, and Crypto exchanges are a paid product so they would be able to provide this additional support.
Re: Gitlab Support is no longer processing MFA resets for free users
#7This looks like a page that people would find after they lose access to their account permanently. There's a lot of CYA language here. Maybe they should have this at signup for MFA or force people to read next time they login.
Re: Gitlab Support is no longer processing MFA resets for free users
#8I generally support not resetting MFA credentials, and understand where Gitlab is coming from, but wish there were an easier way for the average user. I think that easier way is getting two FIDO2 keys (they're pretty cheap and will get cheaper), and have one on your keychain and one at home, as a backup.
Re: Gitlab Support is no longer processing MFA resets for free users
#9For comparison, here's GH Policy:
https://docs.github.com/en/github/authenticating-to-github/r...
> Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods.
I think it's hard to securely restore an account that is using MFA without being vulnerable to social engineering, SMS takeover, etc. If it's on a corporate account it's easy -- just talk to IT. But for semi-anonymous free accounts? I'm not sure what the expectation here is. What are some good strategies you've seen other providers take?
Re: Gitlab Support is no longer processing MFA resets for free users
#10Although framed as a security improvement, I'm sure it's also a massive support burden. When you have hundreds of thousands or millions of users, at some point you probably have support staff who do nothing but helping users reset their MFAs all day every day. It seems fair not to do this for free users. Some services gate MFA to paid accounts which seems like a worse trade-off.
With free users you also have less information available to you as a provider in determining if the reset request is legit or not.