4 ms·
A warning about Cloudflare: You cannot access their support in any way without logging in. Trying to contact them via their contact/sales page won't work. They
by markdown 9y ago
A warning about Cloudflare:
You cannot access their support in any way without logging in. Trying to contact them via their contact/sales page won't work. They won't respond.
This means that if you lose your phone (2FA) and can't log in, you're royally screwed and will have to go to your registrar to recover access to your domains/DNS.
- always_good 9y agoAll of that is a good thing in my book. I've been the victim of the "customer service backdoor" on Amazon multiple times. It's ridiculous that someone can just about credentialize as you without even having to log in. They made off with whatever sensitive data the customer service rep had in front of them just from chatting to someone on that anonymous support chat widget. Meanwhile, all you have to do is backup your 2FA secrets. Why not make it a part of your regular computer backup routine?
- mulmen 9y agoIf support can bypass 2FA why even have it?
- markdown 9y agoWhat a silly question. One can prove who they are with documents, but nobody can prove who they are with 2FA. It goes like this: If you can prove who you are, you get access to your account. That's what this is all about. The more offline, human touch we go, the greater the security.
- aianus 9y agoIt's way more likely that a hacker can convince a customer support rep that he's me than that hacker can steal my 2FA codes. This isn't a hypothetical, this happens all the time including to people I know personally: https://www.forbes.com/sites/laurashin/2016/12/20/hackers-have-stolen-millions-of-dollars-in-bitcoin-using-only-phone-numbers/ https://www.forbes.com/sites/laurashin/2016/12/20/hackers-ha...
- markdown 9y agoThat's not an inherent problem, that's poor implementation. Procedures like this could work: Person contacts support requesting a bypass of the 2FA due to whatever reason. 1. Cloudflare sends email to persons account notifying of the request. 2. Person is required to upload photographic proof of two govt-issued id's. 3. Cloudflare calls person (phone number on file from 2FA or account setup). 4. 30 day delay initiated. 5. 30 days layer, Cloudflare emails and calls person to confirm they requested 2FA bypass. 6. Access is granted. With procedures like this, it's no longer about convincing a support rep.
- lopmotr 9y agoYou should never use only 2FA for something you don't want to be locked out of. You need a 3rd authentication method to replace the 2nd when you lose it, such as backup codes, that as well as a 4th one to recover a lost password.
- markdown 9y ago> You should never use only 2FA for something you don't want to be locked out of. Tell that to... everyone. > You need a 3rd authentication method to replace the 2nd when you lose it, such as backup codes, that as well as a 4th one to recover a lost password. That's on Cloudflare. If they don't offer backup codes, what can an end user do about that?
- C14L 9y agoPretty sure backup codes are just a part of 2FA.
- davchana 9y agoCan you just not change nameservers in registrar control panel for domain from CFs to somebody elses?