41–50 of 228 posts
Is it just me, or does this make my MFA-protected account safer? I wish conpanies offered this as a feature, in the sense I'm much more worried about someone SEing their way into my account rather than me losing access to all my MFA methods and backup codes or whatever.
> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…
For somebody who signed up to your SaaS service as an individual, enabled MFA, and then lost their MFA device / recovery codes / etc, how do you validate they’re the account owner to reset MFA? I’m not aware of any way to validate this that doesn’t open the door to various trivial degrees of attack.
If a user is more paranoid, they can select the list of recovery criteria at MFA creation time. This can include the common method of charging the card, submitting two small amounts (less than a dollar each) in the user's bank account and having the user report those amounts back, followed up by a physical letter with a reset code. All of this gets paid for by the initial credit card charge ($10 would be reasonable for many people).
Also, have the option of registering more than one MFA.
Earlier quoted context omitted.
> I agree, but having worked in SaaS, and done a lot of partnerships, Microsoft has infinite leverage to turn something like MFA services into a co-branding exercise that pays for itself. Microsoft owns GitHub, not GitLab. This article is about GitLab.
Ugh, thanks for the courtesy comment and not downvoting me to oblivion for not being able to read quite well enough.
Is it just me, or does this make my MFA-protected account safer? I wish conpanies offered this as a feature, in the sense I'm much more worried about someone SEing their way into my account rather than me losing access to all my MFA methods and backup codes or whatever.
Instead of just saying they won't do it for free accounts, they could charge a fee for the service.
Earlier quoted context omitted.
How is it less secure than no second factor?
There have been many instances of attacks of people hijacking the connection, calling the service and saying "I forgot my password, can you reset it by verifying my SMS?", which wouldn't have been possible without a second factor.
For comparison, here's GH Policy: https://docs.github.com/en/github/authenticating-to-github/r... > Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods. I think it's hard to securely restore an account that is using MFA without being vuln…
Make the reset take three days, during which time emails and SMS are sent to the addresses on file alerting them that they may be being attacked and should cancel the recovery if so.
> If you are caught where you are not able to provide your MFA token and without these backup methods, your account will be irrecoverable. This seems absurd. I vaguely remember another SaaS tool I used that had this policy, but I don’t understand it. Even crypto exchanges allow recovery if you lose all traditional recovery methods by submitting documentation like your scanned driver’s license among a couple other pie…
> Even crypto exchanges allow recovery if you lose all traditional recovery Yes, and Crypto exchanges are a paid product so they would be able to provide this additional support.
It's probably not even legal.. I would bet it's not for a bank and if it's not for crypto exchanges it's only because of some legislative gap that hasn't been filled yet.
Crypto exchanges aren't known for their well staffed support departments, either, and they'll reset your MFA even if you haven't provided them with income (you don't pay simply to have an account, only when you buy & sell).
Earlier quoted context omitted.
For somebody who signed up to your SaaS service as an individual, enabled MFA, and then lost their MFA device / recovery codes / etc, how do you validate they’re the account owner to reset MFA? I’m not aware of any way to validate this that doesn’t open the door to various trivial degrees of attack.
If it is an anonymous account (identified only by a made up user ID and password), then that limits options. If a user supplies credentials when creating the account, including a valid credit card that ties back to the individual, then later on when a reset is required the user can open a paid support ticket with a credit card (either same one, or another one in their name). If a user is more paranoid, they can selec…
They also do support multiple FIDO2 tokens as well as recovery codes.
What are the current best options for hardware tokens then?
If purchasing a new laptop (or having one purchased for you) and you run Windows or Mac OS consider fingerprint devices that can turn it into a "Platform Authenticator" able to prove that the person with the authorised fingerprint and the machine authorised are together and wish to sign in.
If you mostly use a phone, look for a newer iPhone or for select Androids (e.g. Google's "Pixel" series) with fingerprint readers, again these function as a platform authenticator.
Unfortunately for the latter case U2F isn't an option. Sites should be migrating to WebAuthn (and please people do not implement U2F instead of WebAuthn in 2020, for the same reason you wouldn't build a new Flash video site, nothing new supports that technology any more, stop it)
Today GitLab is U2F only, there is a logical upgrade path to WebAuthn, and they seem to be working through a bunch of patches to land it, but for now it's less compatible with a site with WebAuthn (e.g. GitHub). So that means if you use the site largely or exclusively from a phone hardware tokens do not buy you much yet.