There was a discussion about the topic of MFA resets on the Risky Business podcast[0] in which the host, Patrick Gray, suggested companies require a one time fee for MFA resets. I think the suggested amount in the show was $50 which seems reasonable enough for western markets. It creates a deterrent for attackers and in the case of free products like GitLab allows the support costs to be covered. Additionally the act of payment itself can help prove identity.
Gitlab Support is no longer processing MFA resets for free users
171–180 of 228 posts
Re: Gitlab Support is no longer processing MFA resets for free users
#172This seems to create an interesting security loophole. If someone figures out our GitLab password (i.e. by looking over our shoulder), they can just log in, enable MFA and we are locked out, forever. Think about this. Any criminal who gets access to your Gitlab account can make it impossible for you to access it ever again. If I used GitLab, I would seriously consider moving somewhere else.
Or you can just enable MFA yourself, and prevent that from happening? Am I missing something?
Seconding this: enforce MFA on all gitlab accounts and make sure they at least click the print recovery codes button.
Re: Gitlab Support is no longer processing MFA resets for free users
#173Although framed as a security improvement, I'm sure it's also a massive support burden. When you have hundreds of thousands or millions of users, at some point you probably have support staff who do nothing but helping users reset their MFAs all day every day. It seems fair not to do this for free users. Some services gate MFA to paid accounts which seems like a worse trade-off. With free users you also have less inf…
The problem is that it's helping attackers and it doesn't send a great message to say “if someone roots you, we'll ensure that you can't recover” and “FOSS developers aren't important enough to be secure”.
Support cost is a valid consideration but it's something they could address using payment infrastructure they already have: require someone to pay $20 to get a reset, with a delay period where the account is frozen but before the MFA reset goes into place.
Re: Gitlab Support is no longer processing MFA resets for free users
#174Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
Google Authenticator now allows you to export your keys to another phone. I keep my keys in analog form - I print QR code for every service. We know how to handle valuables stored on paper.
hot tip: zbarimg
You can store the TOTP seeds in more compact form by converting QR code screenshots to alphanumeric using zbar barcode tools.
In my experience it has difficulty parsing some QR codes created using CSS due to tiny borders between blocks. Those can be fixed by applying a small gaussian blur followed by sharpening (use imagemagick for maximum automation) to fill out the borders.
Edit: packages available in Ubuntu (zbar-tools) & Fedora (zbar), source code at https://github.com/mchehab/zbar
Re: Gitlab Support is no longer processing MFA resets for free users
#175Earlier quoted context omitted.
> Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. Actually, no. This is a terrible idea. Think about the psychology of what you are telling people: "You have two choices - one is normal security, which you use on 80%+ of the rest of the internet, and one is 2fa which you only use on the annoying services that badger you into it. On the first one, if you l…
The correct fix is to make the better option less annoying. You can do this today with WebAuthn. Here's the steps to sign in to a WebAuthn-enabled site with say a Pixel 2: 1. Go to the site 2. Touch the "Sign in" button 3. When prompted touch the fingerprint sensor That's it. Did a bunch of complicated stuff happen? Yes, but the user didn't do any of that, so they needn't care.
What happens if your phone gets crushed by a runaway elephant?
Re: Gitlab Support is no longer processing MFA resets for free users
#176Earlier quoted context omitted.
Make the reset take three days, during which time emails and SMS are sent to the addresses on file alerting them that they may be being attacked and should cancel the recovery if so.
Though note this will still work for a targeted attack. You wait until your target will be out of the loop and then begin your attack run. But it would definitely help.
The other measure I'd add are trusted intermediaries: that helps both with continuity (e.g. “any 2 of these 5 people are allowed to confirm that I am legally dead”) and notifications like this as long as they aren't all people you go on long vacations in remote areas with.
Re: Gitlab Support is no longer processing MFA resets for free users
#177I don't care how high up you are on your infosec high horse, but the likelihood and potential damage caused by a developer losing access to their 2F device is far higher in nearly every scenario than someone being hacked. The only correct response to this is for companies to make it against internal policy for developers to enable 2FA. Which is sad.
Gitlab allows you to have multiple U2F tokens. From what I can tell it is is at least 10. I myself probably own eight U2F tokens. Anyone of the U2F tokens I have registered can be used to log me into Gitlab, assuming I remember my username/password ;)
Besides the somewhat minimal cost of $20 for a U2F token I don't see any reason people should not have multiple U2F tokens and register them to their accounts.
Re: Gitlab Support is no longer processing MFA resets for free users
#178Isn't this why almost every site with 2FA support asks you to print out backup codes and keep them somewhere safe, and warns you that you won't be able to recover your account if you lose them? I thought this was standard practice. I'm surprised it seems to be so controversial.
That does somewhat presuppose access to a printer.
Re: Gitlab Support is no longer processing MFA resets for free users
#179> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…
I started working on a replacement TOTP app on iOS that I intend to use instead of Google Authenticator. (Currently I am not planning on supporting HOTP, since all of the accounts that I secure with Google Authenticator are using TOTP.) Google Authenticator prevents the MFA shared secrets from syncing to iCloud and it also prevents said shared secrets from being restorable from local backup to any device aside from t…
Microsofts Authenticator App allows backups of the MFA secrets on iOS at least. As far as I understood, it does the backup of the secrets to iCloud and requires a separate microsoft account (o365 won't do) to store an encryption key. So an attacker would need to breach both accounts.
Re: Gitlab Support is no longer processing MFA resets for free users
#180Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
> Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. Actually, no. This is a terrible idea. Think about the psychology of what you are telling people: "You have two choices - one is normal security, which you use on 80%+ of the rest of the internet, and one is 2fa which you only use on the annoying services that badger you into it. On the first one, if you l…
> . On the second one, if your laptop and phone get fried in a rainstorm / car crash / act of children, you lose access to everything forever, no recourse and no recovery.
No. I just use my U2F token that I have on my keychain. Or the one I have in my office. Or the one I have in my safe.
I also backup my TOTP codes using GPG and my Yubikey can store up to 32 TOTP codes on it.