Gitlab Support is no longer processing MFA resets for free users

Post by cuu508 » Wed, Aug 05, 2020, 11:29 AM UTC

Chris2048 wrote: post #132

cuu508 wrote: post #123

Earlier quoted context omitted.

Not op, but my usual process is: * when setting up 2FA, a website shows a QR code * I screenshot the QR code, and print it out on an A4 sheet, with an annotation of what service it is for * I scan the QR code from the A4 sheet on two different phones. * Back on the website, I continue 2FA setup process only after the A4 sheet is printed, and both phones show the same codes * The A4 sheet goes in a folder for safe kee…

interesting idea. I wonder what the minimum you need for a 2FA-only device would be.

Post by tialaramex » Wed, Aug 05, 2020, 11:34 AM UTC

papaf wrote: post #136

tialaramex wrote: post #91

Earlier quoted context omitted.

Which "Linux browsers" are you thinking of? Firefox only implements WebAuthn, including on Linux, the U2F support in Firefox is essentially a "reverse polyfill" in which the browser pretends it can do U2F but actually is just wiring some commonly used parts of U2F to the WebAuthn implementation to tide you over until your site gets WebAuthn. Chrome on Linux certainly supports WebAuthn although it does have U2F suppor…

This site does not work for me with Firefox 79.0 on Linux with a Yubikey 5: https://demo.yubico.com/webauthn Is this a problem with the backend rather the browser? Edit: This site works https://webauthn.io/ My mistake!

Post by baq » Wed, Aug 05, 2020, 11:49 AM UTC

undecisive wrote: post #114

nooyurrsdey wrote: post #69

Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…

> Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. Actually, no. This is a terrible idea. Think about the psychology of what you are telling people: "You have two choices - one is normal security, which you use on 80%+ of the rest of the internet, and one is 2fa which you only use on the annoying services that badger you into it. On the first one, if you l…

Post by tialaramex » Wed, Aug 05, 2020, 12:02 PM UTC

undecisive wrote: post #114

nooyurrsdey wrote: post #69

Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason). I personally use 1password, but there's definitely room for a cloud…

> Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. Actually, no. This is a terrible idea. Think about the psychology of what you are telling people: "You have two choices - one is normal security, which you use on 80%+ of the rest of the internet, and one is 2fa which you only use on the annoying services that badger you into it. On the first one, if you l…

Post by sixhobbits » Wed, Aug 05, 2020, 12:07 PM UTC

miki123211 wrote: post #147

This seems to create an interesting security loophole. If someone figures out our GitLab password (i.e. by looking over our shoulder), they can just log in, enable MFA and we are locked out, forever. Think about this. Any criminal who gets access to your Gitlab account can make it impossible for you to access it ever again. If I used GitLab, I would seriously consider moving somewhere else.