This makes sense. If it bugs you, just upgrade to a paid account. Being able to manually verify your identity in case of emergency is a real service and worth paying money for.
Gitlab Support is no longer processing MFA resets for free users
101–110 of 228 posts
Re: Gitlab Support is no longer processing MFA resets for free users
#102Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
And what is with DSGVO/GDPR to delete my data even without access?
Re: Gitlab Support is no longer processing MFA resets for free users
#103Earlier quoted context omitted.
I wish someone would convince Paypal. They require SMS for verification, no other options at all.
I think they offer TOTP now, right? Started sometime last year? Do you have to activate SMS alongside it? I have been using TOTP with PayPal for (I think) a few years now. You used to have to run some weird local Python script that somehow imitated the one RSA (I think) dongle they supported in a way I don't understand, but the net result was that you just get a TOTP key that works fine.
Multiple Paypal reps told me that SMS is the only way. It is possible they are all incorrect :/. I'll look into it, thanks.
Re: Gitlab Support is no longer processing MFA resets for free users
#104Is it just me, or does this make my MFA-protected account safer? I wish conpanies offered this as a feature, in the sense I'm much more worried about someone SEing their way into my account rather than me losing access to all my MFA methods and backup codes or whatever.
Does it make free accounts safer than paid accounts?
Re: Gitlab Support is no longer processing MFA resets for free users
#105Earlier quoted context omitted.
Google Authenticator now allows you to export your keys to another phone. I keep my keys in analog form - I print QR code for every service. We know how to handle valuables stored on paper.
Would you be willing to describe the process you use to do this?
Screenshot the QR Code and print it? Put it in a vault or store somewhere safe. It’s a standard practice for securing enterprise accounts (AWS root acc. for example)
Re: Gitlab Support is no longer processing MFA resets for free users
#106Why not introduce a model where one who has lost their MFA keys pays something like, say, 50 $ to make up for the time the support team spends on the ticket?
Such a decision is something that would make me either leave the service, not trust it with anything important or not enable MFA.
(Side note, this is also valid for Google, Twitter, Facebook, AWS and other services that take pride in letting AI manage everything with no avenue of contacting a human with authority to override the AI)
Re: Gitlab Support is no longer processing MFA resets for free users
#107Earlier quoted context omitted.
For a casual user (unlikely to be specifically targetted for attack) I think SMS is a good option. If you lose your phone then you can just order a replacement sim card and you have your second facto back.
As someone who travels frequently and has moved to different countries, SMS is the absolute worst. If a service asks me to verify my number after crossing a border, the chances of me ever being able to log into that account ever again are basically zero. Then there's Google. Google doesn't have a phone number on file for me, but they sometimes demand that I input a phone number and enter a verification code to access…
This is a very niche case. Why can't you recieve sms abroad? Do you leave your phone behind when you travel? Why can't you give Google your current phone number?
Re: Gitlab Support is no longer processing MFA resets for free users
#108Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…
The problem with storing the 2FA keys in 1Password is that you're practically downgrading your account to 1FA because once 1Password is compromised, the second factor lost all of its value, though that compromise is much harder to achieve than a compromised shared machine I'm typing my password in on (which you probably also should never do).
I'm saying this as I'm looking at my 1Password database which also contains all my 2FA keys because, yes, all 2FA apps I tried so far treat these keys as way too valuable and the risk of losing them as I move from device to device is just too high.
Do as I say, not as I do I guess :p
I feel confident to rely on the security of my machine and 1Password specifically, though I am aware that I can't really claim my accounts to be secured by 2FA.
Re: Gitlab Support is no longer processing MFA resets for free users
#109Earlier quoted context omitted.
As someone who travels frequently and has moved to different countries, SMS is the absolute worst. If a service asks me to verify my number after crossing a border, the chances of me ever being able to log into that account ever again are basically zero. Then there's Google. Google doesn't have a phone number on file for me, but they sometimes demand that I input a phone number and enter a verification code to access…
This is a very niche case. Why can't you recieve sms abroad? Do you leave your phone behind when you travel? Why can't you give Google your current phone number?
Not OP but I face this problem:
- Why can't you recieve sms abroad?
Because I use e-sims and pay $10 for 30 days of data only vs. the $30 my provider would add to my bill for "global data".
> Do you leave your phone behind when you travel?
No, but I do leave my US number "dormant" in that i can't use it.
> Why can't you give Google your current phone number?
Because they already have a clear enough data picture of who i am, and I don't want them to have any more data that I'm willingly giving them.
Re: Gitlab Support is no longer processing MFA resets for free users
#110Earlier quoted context omitted.
I use FreeOTP+ for Android because it allows me to backup its data.
I'm currently using andOTP. Just to throw some more news of good OSS MFA apps out there.
Also, Aegis: https://github.com/beemdevelopment/Aegis