Gitlab Support is no longer processing MFA resets for free users

Post by codezero » Wed, Aug 05, 2020, 1:17 AM UTC

jkaplowitz wrote: post #19

codezero wrote: post #15

I agree, but having worked in SaaS, and done a lot of partnerships, Microsoft has infinite leverage to turn something like MFA services into a co-branding exercise that pays for itself.

> I agree, but having worked in SaaS, and done a lot of partnerships, Microsoft has infinite leverage to turn something like MFA services into a co-branding exercise that pays for itself. Microsoft owns GitHub, not GitLab. This article is about GitLab.

Post by app4soft » Wed, Aug 05, 2020, 1:18 AM UTC

toomuchtodo wrote: post #17

codezero wrote: post #15

I agree, but having worked in SaaS, and done a lot of partnerships, Microsoft has infinite leverage to turn something like MFA services into a co-branding exercise that pays for itself.

Github is owned by Microsoft, not Gitlab (which is whom this link refers to).

Post by Androider » Wed, Aug 05, 2020, 1:19 AM UTC

quadrangle wrote: post #16

Instead of just saying they won't do it for free accounts, they could charge a fee for the service.

Post by virtue3 » Wed, Aug 05, 2020, 1:30 AM UTC

StavrosK wrote: post #18

nicoburns wrote: post #13

Earlier quoted context omitted.

For a casual user (unlikely to be specifically targetted for attack) I think SMS is a good option. If you lose your phone then you can just order a replacement sim card and you have your second facto back.

I really hate SMS for security, given how easy it is to hijack a number for a few minutes. It has been the basis of so many hacks, that we'd do well to just abolish it everywhere.

Post by StavrosK » Wed, Aug 05, 2020, 1:32 AM UTC

virtue3 wrote: post #27

StavrosK wrote: post #18

Earlier quoted context omitted.

I really hate SMS for security, given how easy it is to hijack a number for a few minutes. It has been the basis of so many hacks, that we'd do well to just abolish it everywhere.

but convenient :) I'd feel really uncomfortable if it wasn't a backup option. But if it's a backup option it's a security hole. That's a tough circle.