Gitlab Support is no longer processing MFA resets for free users

Post by koolba » Wed, Aug 05, 2020, 10:11 AM UTC

tybulewicz wrote: post #88

nooyurrsdey wrote: post #69

Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…

Google Authenticator now allows you to export your keys to another phone. I keep my keys in analog form - I print QR code for every service. We know how to handle valuables stored on paper.

Post by snorremd » Wed, Aug 05, 2020, 10:31 AM UTC

pilif wrote: post #108

nooyurrsdey wrote: post #69

Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…

The problem with storing the 2FA keys in 1Password is that you're practically downgrading your account to 1FA because once 1Password is compromised, the second factor lost all of its value, though that compromise is much harder to achieve than a compromised shared machine I'm typing my password in on (which you probably also should never do). I'm saying this as I'm looking at my 1Password database which also contains…

Post by whatl3y » Wed, Aug 05, 2020, 10:47 AM UTC

tgsovlerkhgsel wrote: post #121

lkozloff wrote: post #53

Earlier quoted context omitted.

Support Manager at GitLab here. We did use to do identity card verification. The issue that we had was that we often didn't have a lot of information about the folks who opened free accounts. Often names would be pseudonyms or match only partially with their ID. Not to mention, of course, the difficulty of verifying the authenticity of IDs from all over the world. We wrote about this back in 2018: https://about.gitla…

I suspect that support cost also played into the decision. Consider requiring payment: It covers your support costs, and provides some ties to a real-world identity as well as rate limiting/imposing a real cost on attackers. For credit cards, AFAIK you can set which security level to apply (i.e. whether you'd rather have a higher fraud risk or more shopping cart abandonement because the customer didn't have/want to d…

Post by dependenttypes » Wed, Aug 05, 2020, 10:48 AM UTC

undecisive wrote: post #114

nooyurrsdey wrote: post #69

Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…

> Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. Actually, no. This is a terrible idea. Think about the psychology of what you are telling people: "You have two choices - one is normal security, which you use on 80%+ of the rest of the internet, and one is 2fa which you only use on the annoying services that badger you into it. On the first one, if you l…

Post by soco » Wed, Aug 05, 2020, 10:55 AM UTC

ffpip wrote: post #117

klohto wrote: post #105

Earlier quoted context omitted.

Screenshot the QR Code and print it? Put it in a vault or store somewhere safe. It’s a standard practice for securing enterprise accounts (AWS root acc. for example)

You can't screenshot it. The app puts a no screenshot request, so you have to scan the qr code from another phone.