Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do? • Hacker News Board

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#11

Post by joshmn » Thu, Oct 02, 2025, 5:26 PM UTC

xwowsersx wrote: post #10

Thoughts of the top of my head: - If the most important thing is control of the Ruby gems, reach out to RubyGems.org support - for your projects, if you have are past collaborators on those repos, they can sometimes open GH tickets referencing the project and vouch for you. Doesn't guarantee success, but adds weight - GH (being part of MSFT) does have some channels for escalated identity verification. Lawyers or nota…

I was able to recover my Rubygems account :); unfortunately my projects were all private and solo :(; I am currently looking into lawyers—if anyone has any recommendations here my inbox is open.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#12

Post by hluska » Thu, Oct 02, 2025, 5:29 PM UTC

joshmn wrote: post #8

abxyz wrote: post #6

> I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed. The situation you are in is very unfortunate and I am sympathetic but in GitHub's defence, this is exactly what I hope would happen when I enable 2FA. I would be very perturbed to find out that GitHub would grant access to my account given identity documents. There are some creative solution…

That's the same stance I have and why I'm torn. The little quirk here—where it makes slightly more sense—is that they received a legal notice at one point (from the US Government) about my account, there are plenty of online articles to corroborate me as me, and I have a fancy prison release ID that can help me identify me. Unfortunately this context is probably lost on the individuals who work their Zendesk. The pol…

I’m not sure that blaming tech support for not understanding context is the best approach here. The other sides of that context, which are understandable from their point of view, is that you were charged with some serious crimes. There’s a large delta between the charges and the conviction, but you’ve got some scary words written about you online. Secondarily, GitHub has policy so whereas you’re coming at it from a position of being correct, they’re in a position where they have to break policy. That’s a big risk.

Your best bet would likely be legal. US Federal law imposes some strict rules on lawyers for identity verification to combat money laundering so attorneys have a legally recognized toolkit to verify identity. Having a third party who works for you in the mix could help. Though again, it would involve breaking their policy so this would be a decision made several layers above Zendesk access.

Otherwise, I think this is doing precisely what 2FA is meant to do. It’s not okay for you and you’ve clearly lost a lot because of this, but with the current threat environment, GitHub has to be very careful especially with 2FA. From their point of view, there likely isn’t that big of a gap between your interactions and interactions with people who are trying to take over accounts. A lawyer may not work, but it sure changes that equation.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#13

Post by CPLX » Thu, Oct 02, 2025, 5:31 PM UTC

You could initiate some kind of legal action to access your data. You'd need a lawyer.

I think it's likely that you wouldn't have legal grounds to force them to give you your data but it's an approach that would most certainly get their attention at a higher level than anything you're able to do from a customer service perspective.

You'd have to have some legal argument as to why they could be obligated to produce the records under subpoena but the standards for that could be quite low.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#14

Post by MrGilbert » Thu, Oct 02, 2025, 5:33 PM UTC

abxyz wrote: post #9

joshmn wrote: post #8

Earlier quoted context omitted.

That's the same stance I have and why I'm torn. The little quirk here—where it makes slightly more sense—is that they received a legal notice at one point (from the US Government) about my account, there are plenty of online articles to corroborate me as me, and I have a fancy prison release ID that can help me identify me. Unfortunately this context is probably lost on the individuals who work their Zendesk. The pol…

I think the disconnect between you and GitHub support is that you're positioning this as a problem of proving your identity whereas for GitHub support it is a policy. The GitHub policy is: you lose your 2FA, you lose your account. Verifying your identity is not relevant. GitHub provides extensive tooling to protect your account (multiple methods of 2FA, recovery codes etc.) and so from their perspective, while this i…

I'd assume that there is simply no "ok, this individual got released from prison and can proof everything" policy in place, and that might be the real issue here. Big organizations begin to tumble once you request something where there are no policies in place.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#15

Post by Retr0id » Thu, Oct 02, 2025, 5:36 PM UTC

abxyz wrote: post #6

> I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed. The situation you are in is very unfortunate and I am sympathetic but in GitHub's defence, this is exactly what I hope would happen when I enable 2FA. I would be very perturbed to find out that GitHub would grant access to my account given identity documents. There are some creative solution…

As a matter of policy, sure. But at the same time, I bet there are some GitHub employees reading this that would be in a position to pull some strings and make an exception. For OP's sake, I hope I'm right!

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#16

Post by the__alchemist » Thu, Oct 02, 2025, 5:37 PM UTC

I'm perpetually worried (and partially prepared) for this sort of scenario, as more of my accounts require 2FA. I dread the day I lose or break my phone, have my items stolen, there's a weather disaster etc. I try to make my hobby repos public and/or backed up in multiple places as a hedge.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#17

Post by ryandrake » Thu, Oct 02, 2025, 5:37 PM UTC

abxyz wrote: post #9

joshmn wrote: post #8

Earlier quoted context omitted.

That's the same stance I have and why I'm torn. The little quirk here—where it makes slightly more sense—is that they received a legal notice at one point (from the US Government) about my account, there are plenty of online articles to corroborate me as me, and I have a fancy prison release ID that can help me identify me. Unfortunately this context is probably lost on the individuals who work their Zendesk. The pol…

I think the disconnect between you and GitHub support is that you're positioning this as a problem of proving your identity whereas for GitHub support it is a policy. The GitHub policy is: you lose your 2FA, you lose your account. Verifying your identity is not relevant. GitHub provides extensive tooling to protect your account (multiple methods of 2FA, recovery codes etc.) and so from their perspective, while this i…

These (for good reason) draconian policies are the reason I am still hesitant to embrace 2FA. I understand the significant improvement in your security posture, and I would not want someone not-me to be able to reset my credentials. But the failure mode is just too catastrophic. You lose one thing and you are shit out of luck.

We need something better. I don't know what it would be.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#18

Post by jackconsidine » Thu, Oct 02, 2025, 5:37 PM UTC

FWIW I had a similar conundrum with Slack. I had set-up my business Slack workspace in college; 4 years after graduation my university changed policies (they used to forward name@edu => name@alumni.edu).

I tried the normal means (support tickets etc) to no avail. The third or fourth time I got someone in account recovery. There was a very formal process for verifying my identity (I'm sure based on the process this happens all the time). Eventually I they helped me recover my account. It probably took a few months on the whole, but once I got the right support rep it was only a week or so.

So my advice would be to submit more tickets. Because they might have a process that not all support agents know about, and some are more helpful than others.

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#19

Post by randunel » Thu, Oct 02, 2025, 5:39 PM UTC

Retr0id wrote: post #15

abxyz wrote: post #6

> I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed. The situation you are in is very unfortunate and I am sympathetic but in GitHub's defence, this is exactly what I hope would happen when I enable 2FA. I would be very perturbed to find out that GitHub would grant access to my account given identity documents. There are some creative solution…

As a matter of policy, sure. But at the same time, I bet there are some GitHub employees reading this that would be in a position to pull some strings and make an exception. For OP's sake, I hope I'm right!

Social engineering attacks are a thing, you know...

Re: Ask HN: Went to prison for 18 months, lost access to my GitHub. What can I do?

#20

Post by amatecha » Thu, Oct 02, 2025, 5:46 PM UTC

abxyz wrote: post #9

joshmn wrote: post #8

Earlier quoted context omitted.

That's the same stance I have and why I'm torn. The little quirk here—where it makes slightly more sense—is that they received a legal notice at one point (from the US Government) about my account, there are plenty of online articles to corroborate me as me, and I have a fancy prison release ID that can help me identify me. Unfortunately this context is probably lost on the individuals who work their Zendesk. The pol…

I think the disconnect between you and GitHub support is that you're positioning this as a problem of proving your identity whereas for GitHub support it is a policy. The GitHub policy is: you lose your 2FA, you lose your account. Verifying your identity is not relevant. GitHub provides extensive tooling to protect your account (multiple methods of 2FA, recovery codes etc.) and so from their perspective, while this i…

Someone high enough in the food chain at GitHub can override that policy at their whim. I have personally had my day saved by that very "loophole" in another "lost access to an online service" situation in the past.