Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab Support is no longer processing MFA resets for free users

about.gitlab.com

Post reply on HN
Print view View original

11–20 of 228 posts

Re: Gitlab Support is no longer processing MFA resets for free users

#11

Post by nawgz »

frio wrote: post #5

> I don’t like this and I want to tell someone. I'm sure this is meant to come across as maybe slightly tongue-in-cheek, and is also meant to provide users an outlet they feel they can vent in productively, but... it reads as dismissive, and leaves me with the impression that they don't actually care to hear any feedback.

>it reads as dismissive

Really? It's followed with a link to their community forum, which they are telling you they will read and consider feedback from.

I don't know how else you can signal "we will consider your feedback" other than saying "we get you might not like this so we will have an open discussion at this hyperlinked resource".

Re: Gitlab Support is no longer processing MFA resets for free users

#13

Post by nicoburns »

StavrosK wrote: post #8

I generally support not resetting MFA credentials, and understand where Gitlab is coming from, but wish there were an easier way for the average user. I think that easier way is getting two FIDO2 keys (they're pretty cheap and will get cheaper), and have one on your keychain and one at home, as a backup.

For a casual user (unlikely to be specifically targetted for attack) I think SMS is a good option. If you lose your phone then you can just order a replacement sim card and you have your second facto back.

Re: Gitlab Support is no longer processing MFA resets for free users

#14

Post by akerl_ »

whatl3y wrote: post #3

> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…

For somebody who signed up to your SaaS service as an individual, enabled MFA, and then lost their MFA device / recovery codes / etc, how do you validate they’re the account owner to reset MFA?

I’m not aware of any way to validate this that doesn’t open the door to various trivial degrees of attack.

Re: Gitlab Support is no longer processing MFA resets for free users

#17

Post by toomuchtodo »

codezero wrote: post #15

I agree, but having worked in SaaS, and done a lot of partnerships, Microsoft has infinite leverage to turn something like MFA services into a co-branding exercise that pays for itself.

Github is owned by Microsoft, not Gitlab (which is whom this link refers to).

Re: Gitlab Support is no longer processing MFA resets for free users

#18

Post by StavrosK »

nicoburns wrote: post #13
StavrosK wrote: post #8

I generally support not resetting MFA credentials, and understand where Gitlab is coming from, but wish there were an easier way for the average user. I think that easier way is getting two FIDO2 keys (they're pretty cheap and will get cheaper), and have one on your keychain and one at home, as a backup.

For a casual user (unlikely to be specifically targetted for attack) I think SMS is a good option. If you lose your phone then you can just order a replacement sim card and you have your second facto back.

I really hate SMS for security, given how easy it is to hijack a number for a few minutes. It has been the basis of so many hacks, that we'd do well to just abolish it everywhere.

Re: Gitlab Support is no longer processing MFA resets for free users

#19

Post by jkaplowitz »

codezero wrote: post #15

I agree, but having worked in SaaS, and done a lot of partnerships, Microsoft has infinite leverage to turn something like MFA services into a co-branding exercise that pays for itself.

> I agree, but having worked in SaaS, and done a lot of partnerships, Microsoft has infinite leverage to turn something like MFA services into a co-branding exercise that pays for itself.

Microsoft owns GitHub, not GitLab. This article is about GitLab.

Re: Gitlab Support is no longer processing MFA resets for free users

#20

Post by toomuchtodo »

EdJiang wrote: post #9

For comparison, here's GH Policy: https://docs.github.com/en/github/authenticating-to-github/r... > Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods. I think it's hard to securely restore an account that is using MFA without being vuln…

> What are some good strategies you've seen other providers take?

Fallback to SMS auth if you've lost your MFA and recovery codes. It's not good per se, but the users who need it will love you and the users who get SIM jacked/swap attacked will hate you. You're not going to please everyone. I've been trying to figure out a good way to handle this, but at least in the US, there isn't a good government provided identity provider you could rely on to true up identity issues when auth factors are lost (login.gov just ain't there yet, but it might get there as it's what US DHS uses to auth you for Global Entry, and what you're looking for is essentially a programatic/digital notary to attest to you that the person is whom they say they are).

IAM is hard.

Post reply on HN