Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab Support is no longer processing MFA resets for free users

about.gitlab.com

Post reply on HN
Print view View original

121–130 of 228 posts

Re: Gitlab Support is no longer processing MFA resets for free users

#121

Post by tgsovlerkhgsel »

lkozloff wrote: post #53
whatl3y wrote: post #3

> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…

Support Manager at GitLab here. We did use to do identity card verification. The issue that we had was that we often didn't have a lot of information about the folks who opened free accounts. Often names would be pseudonyms or match only partially with their ID. Not to mention, of course, the difficulty of verifying the authenticity of IDs from all over the world. We wrote about this back in 2018: https://about.gitla…

I suspect that support cost also played into the decision.

Consider requiring payment: It covers your support costs, and provides some ties to a real-world identity as well as rate limiting/imposing a real cost on attackers.

For credit cards, AFAIK you can set which security level to apply (i.e. whether you'd rather have a higher fraud risk or more shopping cart abandonement because the customer didn't have/want to deal with whatever auth the bank requires at the highest security level). I imagine cranking this to the max would reduce the risk of stolen cards significantly.

I'd imagine requiring

- identity verification (even if you can't link it to the account, it will deter attackers) through a third party provider - payment (both to cover the cost and as a second form of verification/audit trail generation) - inactivity of the account - contacting and warning the user for a week - requiring the user to confirm a confirmation link at the beginning and end (i.e. an attacker would need control of the user's e-mail)

would strike a good balance. If you don't want human judgement in the loop on your side, it can also be completely automated if the ID check is done by a third party.

If there is no way to recover, it creates a perverse incentive to not use 2FA in the first place.

Re: Gitlab Support is no longer processing MFA resets for free users

#122

Post by tgsovlerkhgsel »

whatl3y wrote: post #3

> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…

Offtopic:

> Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pieces of info proving you are who you are.

With the high values at stake and the number of passport copies leaked from various breaches, I'm surprised this works as well as it apparently does.

Re: Gitlab Support is no longer processing MFA resets for free users

#123

Post by cuu508 »

gknoy wrote: post #100
tybulewicz wrote: post #88

Earlier quoted context omitted.

Google Authenticator now allows you to export your keys to another phone. I keep my keys in analog form - I print QR code for every service. We know how to handle valuables stored on paper.

Would you be willing to describe the process you use to do this?

Not op, but my usual process is:

* when setting up 2FA, a website shows a QR code

* I screenshot the QR code, and print it out on an A4 sheet, with an annotation of what service it is for

* I scan the QR code from the A4 sheet on two different phones.

* Back on the website, I continue 2FA setup process only after the A4 sheet is printed, and both phones show the same codes

* The A4 sheet goes in a folder for safe keeping

* One phone goes in my desk drawer for daily use

* The other phone goes in my "go" bag that I take with me on short trips etc.

Both phones are used exclusively for Google Authenticator:

* they have no extra apps

* they have a screen lock

* they are always in flight mode

Started doing this when I got burned by having to extract GA's sqlite file from mostly-dead Nexus One over adb.

Re: Gitlab Support is no longer processing MFA resets for free users

#124

Post by tgsovlerkhgsel »

fiblye wrote: post #84
nicoburns wrote: post #13

Earlier quoted context omitted.

For a casual user (unlikely to be specifically targetted for attack) I think SMS is a good option. If you lose your phone then you can just order a replacement sim card and you have your second facto back.

As someone who travels frequently and has moved to different countries, SMS is the absolute worst. If a service asks me to verify my number after crossing a border, the chances of me ever being able to log into that account ever again are basically zero. Then there's Google. Google doesn't have a phone number on file for me, but they sometimes demand that I input a phone number and enter a verification code to access…

I would recommend getting a cheap prepaid SIM card that doesn't expire quickly, and recharging it from time to time, just so you have a stable number for 2FA.

While I understand your desire not to, reality is what it is, and at some point, e.g. your bank may force you to give them a phone number.

Re: Gitlab Support is no longer processing MFA resets for free users

#125

Post by waldfee »

cuu508 wrote: post #123
gknoy wrote: post #100

Earlier quoted context omitted.

Would you be willing to describe the process you use to do this?

Not op, but my usual process is: * when setting up 2FA, a website shows a QR code * I screenshot the QR code, and print it out on an A4 sheet, with an annotation of what service it is for * I scan the QR code from the A4 sheet on two different phones. * Back on the website, I continue 2FA setup process only after the A4 sheet is printed, and both phones show the same codes * The A4 sheet goes in a folder for safe kee…

since the qr code is just the totp seed, i simply print the seed in huge font on a sheet of paper. chance of enough degredation to inlegibility is pretty slim if stored correctly

Re: Gitlab Support is no longer processing MFA resets for free users

#128

Post by dan_pixelflow »

callesgg wrote: post #126

Exactly just use a password no one is trying to hack your stuff, and the biggest risk is you. So sick of services that constantly tell me to use MFA. No I don’t want to and if I thought the service was that important I would use it.

no... and im not even going to explain why

Re: Gitlab Support is no longer processing MFA resets for free users

#129

Post by Jedd »

tgsovlerkhgsel wrote: post #119
cmeacham98 wrote: post #30

Is it just me, or does this make my MFA-protected account safer? I wish conpanies offered this as a feature, in the sense I'm much more worried about someone SEing their way into my account rather than me losing access to all my MFA methods and backup codes or whatever.

It makes your MFA-protected account safer from takeover, but also creates a new risk of completely losing access to your account and username forever. Github has the same policy, and it deterred me from using MFA for a long time, and when I finally did, I added a large number of alternatives, including the not-so-secure SMS. I think the fear of being temporarily unable to access your account is already a major reason…

> ... but also creates a new risk of completely losing access to your account and username forever.

I may have misread the announcement, but it sounds like upgrading to a paid account recovers (npi) the ability to recover your account.

Re: Gitlab Support is no longer processing MFA resets for free users

#130

Post by koolba »

ffpip wrote: post #117
klohto wrote: post #105

Earlier quoted context omitted.

Screenshot the QR Code and print it? Put it in a vault or store somewhere safe. It’s a standard practice for securing enterprise accounts (AWS root acc. for example)

You can't screenshot it. The app puts a no screenshot request, so you have to scan the qr code from another phone.

The screenshot would be done on the desktop, not the phone.
Post reply on HN