Gitlab Support is no longer processing MFA resets for free users • Hacker News Board

Re: Gitlab Support is no longer processing MFA resets for free users

#181

Post by sixhobbits » Wed, Aug 05, 2020, 2:25 PM UTC

graton wrote: post #177

sixhobbits wrote: post #149

I don't care how high up you are on your infosec high horse, but the likelihood and potential damage caused by a developer losing access to their 2F device is far higher in nearly every scenario than someone being hacked. The only correct response to this is for companies to make it against internal policy for developers to enable 2FA. Which is sad.

Gitlab allows you to have multiple U2F tokens. From what I can tell it is is at least 10. I myself probably own eight U2F tokens. Anyone of the U2F tokens I have registered can be used to log me into Gitlab, assuming I remember my username/password ;) Besides the somewhat minimal cost of $20 for a U2F token I don't see any reason people should not have multiple U2F tokens and register them to their accounts.

this is pretty much the high horse I was talking about. If you think a majority of people do this, or are likely to do this given the right process, you're living in a very small bubble.

Re: Gitlab Support is no longer processing MFA resets for free users

#182

Post by andrewaylett » Wed, Aug 05, 2020, 2:26 PM UTC

belltaco wrote: post #59

mcherm wrote: post #55

Earlier quoted context omitted.

Does no one else take real vacations these days?

Even on vacations people do connect atleast once a day. Even if to just check on possible family emergencies.

Many financial institutions are required by regulation to enforce a minimum contiguous two week period without accessing internal systems. Even if the regulations don't require it, it's not necessarily a bad idea.

If your systems are so fragile that they can't cope with a two week absence, that's a problem. And the point of the regs is to flush out people who are trying to cover up problems -- two weeks may well be long enough for someone else to notice something they wouldn't normally notice because the person who is away would normally "deal with it".

Re: Gitlab Support is no longer processing MFA resets for free users

#183

Post by schwag09 » Wed, Aug 05, 2020, 2:29 PM UTC

K0nserv wrote: post #171

There was a discussion about the topic of MFA resets on the Risky Business podcast[0] in which the host, Patrick Gray, suggested companies require a one time fee for MFA resets. I think the suggested amount in the show was $50 which seems reasonable enough for western markets. It creates a deterrent for attackers and in the case of free products like GitLab allows the support costs to be covered. Additionally the act…

That's an interesting approach. It incentivizes users to have a backup plan while also providing an escape hatch if things go wrong. The only issue is, like you alluded to, this could price out a large portion of the world's developer population. Perhaps the price could be determined by where you are in the world, although this may not cover US support costs. That and users could attempt to game the system by faking their location. Regardless, it's an interesting approach I hadn't considered before - I like it.

Re: Gitlab Support is no longer processing MFA resets for free users

#184

Post by dalyons » Wed, Aug 05, 2020, 2:35 PM UTC

graton wrote: post #180

undecisive wrote: post #114

Earlier quoted context omitted.

> Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. Actually, no. This is a terrible idea. Think about the psychology of what you are telling people: "You have two choices - one is normal security, which you use on 80%+ of the rest of the internet, and one is 2fa which you only use on the annoying services that badger you into it. On the first one, if you l…

> . On the second one, if your laptop and phone get fried in a rainstorm / car crash / act of children, you lose access to everything forever, no recourse and no recovery. No. I just use my U2F token that I have on my keychain. Or the one I have in my office. Or the one I have in my safe. I also backup my TOTP codes using GPG and my Yubikey can store up to 32 TOTP codes on it.

And you think that’s a reasonable solution for all of the billion+ people that login to some kind of cloud services?

Re: Gitlab Support is no longer processing MFA resets for free users

#185

Post by graton » Wed, Aug 05, 2020, 2:40 PM UTC

dalyons wrote: post #184

graton wrote: post #180

Earlier quoted context omitted.

> . On the second one, if your laptop and phone get fried in a rainstorm / car crash / act of children, you lose access to everything forever, no recourse and no recovery. No. I just use my U2F token that I have on my keychain. Or the one I have in my office. Or the one I have in my safe. I also backup my TOTP codes using GPG and my Yubikey can store up to 32 TOTP codes on it.

And you think that’s a reasonable solution for all of the billion+ people that login to some kind of cloud services?

Perfect is the enemy of good.

Can you explain any solution for any problem that is reasonable for ALL of the billion+ people that login to some kind of cloud service? ;)

Re: Gitlab Support is no longer processing MFA resets for free users

#186

Post by graton » Wed, Aug 05, 2020, 2:43 PM UTC

sixhobbits wrote: post #181

graton wrote: post #177

Earlier quoted context omitted.

Gitlab allows you to have multiple U2F tokens. From what I can tell it is is at least 10. I myself probably own eight U2F tokens. Anyone of the U2F tokens I have registered can be used to log me into Gitlab, assuming I remember my username/password ;) Besides the somewhat minimal cost of $20 for a U2F token I don't see any reason people should not have multiple U2F tokens and register them to their accounts.

this is pretty much the high horse I was talking about. If you think a majority of people do this, or are likely to do this given the right process, you're living in a very small bubble.

> you're living in a very small bubble.

Why did you try to make this personal by attempting to insult me?

Re: Gitlab Support is no longer processing MFA resets for free users

#187

Post by [deleted] » Wed, Aug 05, 2020, 2:47 PM UTC

marcinzm wrote: post #175

tialaramex wrote: post #148

Earlier quoted context omitted.

The correct fix is to make the better option less annoying. You can do this today with WebAuthn. Here's the steps to sign in to a WebAuthn-enabled site with say a Pixel 2: 1. Go to the site 2. Touch the "Sign in" button 3. When prompted touch the fingerprint sensor That's it. Did a bunch of complicated stuff happen? Yes, but the user didn't do any of that, so they needn't care.

What happens if your phone gets crushed by a runaway elephant?

[deleted]

Re: Gitlab Support is no longer processing MFA resets for free users

#188

Post by graton » Wed, Aug 05, 2020, 2:49 PM UTC

jeppesen-io wrote: post #68

As someone who had two phones break and loose my 2FA for github, this makes me sad They were willing to help me - took a week but I got my account back

Maybe invest in a couple of U2F tokens that you can keep on a keychain or at home.

Re: Gitlab Support is no longer processing MFA resets for free users

#189

Post by graton » Wed, Aug 05, 2020, 2:53 PM UTC

totetsu wrote: post #28

What are the current best options for hardware tokens then?

Well the best in my opinion is Yubikey from Yubico. Though not the $20-$25 version which is only U2F, it is still good but not the best.

The Yubikeys do more than just U2F, they also support storing 32 TOTP codes, PGP keys, and other things.

I like the Nano versions as I can leave them connected to my PC at all times.

Recommend an NFC one that you can have on your keyring as it can then be used with your phone.

In reality though almost any U2F token is all you need, and they can be purchased for about $20.

Re: Gitlab Support is no longer processing MFA resets for free users

#190

Post by graton » Wed, Aug 05, 2020, 2:57 PM UTC

marcinzm wrote: post #175

tialaramex wrote: post #148

Earlier quoted context omitted.

The correct fix is to make the better option less annoying. You can do this today with WebAuthn. Here's the steps to sign in to a WebAuthn-enabled site with say a Pixel 2: 1. Go to the site 2. Touch the "Sign in" button 3. When prompted touch the fingerprint sensor That's it. Did a bunch of complicated stuff happen? Yes, but the user didn't do any of that, so they needn't care.

What happens if your phone gets crushed by a runaway elephant?

Hopefully they will have already activated a couple U2F hardware tokens as backup.

Having only one copy of the MFA device is of course a bad idea.