Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab Support is no longer processing MFA resets for free users

about.gitlab.com

Post reply on HN
Print view View original

31–40 of 228 posts

Re: Gitlab Support is no longer processing MFA resets for free users

#31

Post by EdJiang »

toomuchtodo wrote: post #20
EdJiang wrote: post #9

For comparison, here's GH Policy: https://docs.github.com/en/github/authenticating-to-github/r... > Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods. I think it's hard to securely restore an account that is using MFA without being vuln…

> What are some good strategies you've seen other providers take? Fallback to SMS auth if you've lost your MFA and recovery codes. It's not good per se, but the users who need it will love you and the users who get SIM jacked/swap attacked will hate you. You're not going to please everyone. I've been trying to figure out a good way to handle this, but at least in the US, there isn't a good government provided identit…

If I'm going to allow my account to be recovered via SIM, why not just use "poor man's MFA" by just authing via SIM? Security is as weak as its weakest link.

I looked at GitLab's recovery options, and you have the option of recovering your MFA if you have access to any SSH key used to publish to GitLab. That seems like a reasonable backup for now.

Re: Gitlab Support is no longer processing MFA resets for free users

#33

Post by cjbprime »

EdJiang wrote: post #9

For comparison, here's GH Policy: https://docs.github.com/en/github/authenticating-to-github/r... > Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods. I think it's hard to securely restore an account that is using MFA without being vuln…

Make the reset take three days, during which time emails and SMS are sent to the addresses on file alerting them that they may be being attacked and should cancel the recovery if so.

Re: Gitlab Support is no longer processing MFA resets for free users

#34

Post by toomuchtodo »

EdJiang wrote: post #31
toomuchtodo wrote: post #20

Earlier quoted context omitted.

> What are some good strategies you've seen other providers take? Fallback to SMS auth if you've lost your MFA and recovery codes. It's not good per se, but the users who need it will love you and the users who get SIM jacked/swap attacked will hate you. You're not going to please everyone. I've been trying to figure out a good way to handle this, but at least in the US, there isn't a good government provided identit…

If I'm going to allow my account to be recovered via SIM, why not just use "poor man's MFA" by just authing via SIM? Security is as weak as its weakest link. I looked at GitLab's recovery options, and you have the option of recovering your MFA if you have access to any SSH key used to publish to GitLab. That seems like a reasonable backup for now.

I agree with your points. Really depends on the service, what auth factors you have available to you, what your risk appetite is, etc.

Re: Gitlab Support is no longer processing MFA resets for free users

#35

Post by Rapzid »

quadrangle wrote: post #16

Instead of just saying they won't do it for free accounts, they could charge a fee for the service.

This is the answer. Charge 2-4 years worth of basic subscription to recover. Or a 1 year up-front payment and recurring after that.

Otherwise, with no path forward, this is just user hostile.

Re: Gitlab Support is no longer processing MFA resets for free users

#37

Post by [deleted] »

leonidasv wrote: post #4
whatl3y wrote: post #3

> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…

Certifying authenticity is a manual process and costs money. Even though I think GitLab could have handled it better, I understand their reasons.

[deleted]

Re: Gitlab Support is no longer processing MFA resets for free users

#38

Post by zucker42 »

StavrosK wrote: post #29
virtue3 wrote: post #27

Earlier quoted context omitted.

but convenient :) I'd feel really uncomfortable if it wasn't a backup option. But if it's a backup option it's a security hole. That's a tough circle.

Not as convenient as having no second factor, and less secure!

How is it less secure than no second factor?

Re: Gitlab Support is no longer processing MFA resets for free users

#39

Post by StavrosK »

zucker42 wrote: post #38
StavrosK wrote: post #29

Earlier quoted context omitted.

Not as convenient as having no second factor, and less secure!

How is it less secure than no second factor?

There have been many instances of attacks of people hijacking the connection, calling the service and saying "I forgot my password, can you reset it by verifying my SMS?", which wouldn't have been possible without a second factor.

Re: Gitlab Support is no longer processing MFA resets for free users

#40

Post by danielheath »

StavrosK wrote: post #8

I generally support not resetting MFA credentials, and understand where Gitlab is coming from, but wish there were an easier way for the average user. I think that easier way is getting two FIDO2 keys (they're pretty cheap and will get cheaper), and have one on your keychain and one at home, as a backup.

Two tokens is just what it costs to use secure MFA. Ideally three - store one at EG your parents house so you aren’t losing access if your home is inaccessible.
Post reply on HN