9 ms·

Github has blocked access to my account with 10s of popular projects because one day they randomly sent me an email to click on a link to enable 2fa auth. I was

• twobat 7y ago
  They probably have enough tracking info they could spot you just by you blinking. But they don't care.
  • soheil 7y ago
    They clearly have options to unlock my account by doing additional verifications but as you said they clearly don't care.
• Latty 7y ago
  If you can talk your way past two factor auth, it is useless. I can see the argument for being forceful about prompting you to write down backup codes or whatever, but fixing that after-the-fact is something they should absolutely not been doing. I do think that sites should offer better options for recovery. NearlyFreeSpeech do a really good job of this, offering seven methods of recovery and letting you decide how many you need to fulfil to be given access and which you want to configure. However, things like checking photo ID and more "offline" options are expensive to support, so I get why that is rare.
  • soheil 7y ago
    > If you can talk your way past two factor auth, it is useless. > However, things like checking photo ID and more "offline" options are expensive to support, so I get why that is rare. For you to characterize my efforts with Github support as "talking my way past it" is absurd. I was never once asked to provide a photo ID, etc. something I would have gladly complied with.
    • zaarn 7y ago
      Unless Github obtained your photo ID or something similar before you enabled 2FA, that's kind of pointless to ask for.
      • soheil 7y ago
        They can re-activate the keys they automatically purged from my account, I still have their associated private keys. My github profile also has detailed information in its bio section including my past employer and links to my various social media/website. They could simply validate my ownership of one of those accounts etc.
        • calvinmorrison 7y ago
          Yeah seems simple to ask you to sign message with your key to prove its you!
        • zaarn 7y ago
          The social media websites could have been hacked by some attacker, the private keys could have been obtained as well. Or put there by an attacker that is now locked out by 2FA. The entire point of 2FA is that it's a second factor and no way around it without a second factor that is verifiable without doubt.
          • kortilla 7y ago
            Nope. Many 2FA setups have a way to workaround the second factor if it’s missing. Recovery codes, emails to secondary addresses, faxing an ID, etc etc.
  • exolymph 7y ago
    Nearly Free Speech is awesome <3 Anyone reading this, if you want a web host with hacker values — not in the blackhat sense, in the old school sense — check 'em out!
    • Latty 7y ago
      They are pretty unique and are good, although they are slow to update the service and it's starting to hit some real issues for me. The most relevant issue for me being the lack of U2F (now WebAuthn, I guess) support. It is also really annoying you can't have restricted SSH keys to allow for automation that is locked down to single sites. They have had those issues on their feature voting for years.
  • closeparen 7y ago
    You can talk your way past it at AWS. Need a medallion signature guarantee (more intense form of notary) from a bank. It’s not easy but you can do that. After that experience I switched to Authy, which does an encrypted cloud backup of your TOTP secrets.
  • godelski 7y ago
    > If you can talk your way past two factor auth, it is useless. No, it just means you use a different 2FA. Here's some examples. - Gov ID - Pushing to a private repo - Checking if IP matches historical records (hell, since they're fingerprinting everyone, why not use that?) There's problems with 2FA. Mainly that it is on your phone. Phones are pretty valuable devices and it isn't unlikely that they get stolen. Even if Google backed up Authenticator to Drive, how do you get Authenticator back on your new phone? It isn't hard to come up with a hundred scenarios where things fall apart. This is why there are different levels of security. But my GitHub isn't so sensitive that if I lose access I don't want anyone to ever get access. Yet at the same time it is sensitive enough (and GitHub is attacked enough) that I don't think just a user name and password is sufficient. Where's the middle ground? Even with YubiKeys I have to have multiples (as a backup in case I lose one). There's such a thing as "acceptable security levels." We're trying to make things easier and safer for humans. But that doesn't mean they aren't still going to be human.
    • dvcrn 7y ago
      Not if you didn't previously acknowledge using these kinds of documents as 2FA. I set 2FA fully aware that if I lose my recovery codes I'm done. I don't want anyone ever to be able to restore my accounts without the codes. There are so many attack vectors with government documents. Just one service hacked that I had to upload them for verification and that kind of information can become 'public'. Humans and social engineering are one of the biggest attack vectors nowadays because of things like "humans make mistake, let's reset his account because he knew the last digits of the creditcard used and uploaded an ID". Gandi handles this nicely with a checkbox in the settings that explicitly tells support to never ever restore the account if 2FA is lost
    • ProZsolt 7y ago
      Gov ID would only work if you show it in person. A lot of people have a photocopy of ID. IP address is easy to fake. The main problem is with targeted attacks. That's why SMS not secure
      • godelski 7y ago
• usmannk 7y ago
  I have restored access to a lost 2FA github account by presenting support with an artifact signed by my SSH keys I had linked to the account. If you still have the keys, try: ssh -i ~/.ssh/your_linked_privkey -T git@github.com verify Edit: I previously wrote to pass your public key to the ssh client rather than your private key. Of course, that was incorrect.
  • soheil 7y ago
    The keys were removed according to support, I do not recall removing my public key from github.
    • JensenDied 7y ago
      I found this out the hard way as well, at some point since I last logged in they quietly enacted a policy of deleting keys that aren't used for roughly a year.[1] This meant I couldn't use the not so public method of verifying I still had access to various associated keys. [1] https://help.github.com/en/github/authenticating-to-github/deleted-or-missing-ssh-keys https://help.github.com/en/github/authenticating-to-github/d...
      • soheil 7y ago
        Now that you mention this I vaguely recall receiving an email from them a long time ago that they were going to purge my keys. Wow so much of this is beginning to make sense. Why would they remove keys that people unknowingly may be relying on as the only way to gain access to their account?
        • lilyball 7y ago
          Why should they support holding onto SSH keys forever in case you forgot to write down your backup 2FA codes, especially when they've never advertised that they'll accept SSH key-signed artifacts as proof of identity?
          • 7y ago
• buildbot 7y ago
  If github did their 2FA correctly/very securely, it may literally be impossible for them to give you access again. The entire point of 2FA is to avoid someone taking over your email and then being able to access _anything_ tied to that email.
  • soheil 7y ago
    > If github did their 2FA correctly/very securely, it may literally be impossible for them to give you access again. This is probably the most popular current dogma in security circles. This is a policy issue not an intractable mathematical problem. In theory maybe it could be as rigorous as math but in practice security is always relative.
  • jeremyjh 7y ago
    Can you describe the architecture that would make this possible?
  • userbinator 7y ago
    The entire point of 2FA is to avoid someone taking over your email and then being able to access _anything_ tied to that email. The same can be said for strong encryption, where losing the keys means you have no chance of recovery. I'm not an advocate of defaulting to things like full-disk-encryption for that reason (and know people who lost a lot due to that.) I guess the underlying problem is "humans are fallible, strong security is not", and that risks "in the other direction" aren't often mentioned; would you rather have the risk of being hacked, or of losing access to your data forever?
• jeffwilcox 7y ago
  There's a reason that it's so important to save those recovery codes... that's your opportunity of last resort to recover access.
• beart 7y ago
  I'm sorry you lost your account (really, that sucks) but I don't understand framing this like Github is doing something wrong. It isn't like they banned you for spamming emojis. You enabled 2fa, you lost your 2fa, and you did not have any recovery codes. Now you are asking for them to bypass the 2fa, and they are refusing. Again, that sucks, but when I compare this to what the cell phone companies are doing with sim swapping, it increases my respect for Github.
  • cloverich 7y ago
    Humans are humans though, and mistakes are inevitable. In this case, you get an email from the same address used to setup the accounts, and a corresponding complete stop in activity on the repo. Further, I bet OP could even demonstrate ownership of some of the code (whichever private repo's they happen to have checked out). All in all, it adds up, and as a paying customer its reasonable to expect Github to have some measures in place for scenarios like this.
    • UncleEntity 7y ago
      > you get an email from the same address used to setup the accounts... Isn't one of the biggest selling points of 2fa that if one account gets hacked you don't lose all accounts?
      • derefr 7y ago
        The selling point of 2FA is that if a hacker gets your password (from a DB dump from a compromise of site A that has bad security and no PW hashing) and tries to use it on site B, then site B still won't let them in because they don't have the second factor for site B. In this case, an email account is the second factor. Your Github password is the first factor.
        • rmrfrmrf 7y ago
          No, multifactor authentication uses different forms of evidence (i.e., something you have, something you are, something you know), not just multiple accounts. Given password reuse, cookies, etc., e-mail is a terrible second factor.
• alkonaut 7y ago
  This is why I’d rather have the phone number/email 2fa than a device 2fa even with the risk of sim swap. If a human can’t give me my account back through tech support I’m not very keen on trusting my account a gadget that can break or get lost. The risk of losing a phone and the backup codes is probably several orders of magnitude larger than the risk of being the target of a sim swap attack for the vast majority of users.
  • yabadabadoes 7y ago
    I would prefer to have u2f devices but be able to trust some tokens from friends and family without having to have them present at every registration, kind of like having a spare key with someone for every lock. I guess I'm not really worried about my relatives socially engineering my GitHub password out of me.
    • fnky 7y ago
      But what if your relative suddenly pass away? Then you'd be pretty screwed, wouldn't you?
      • yabadabadoes 7y ago
        I don't understand, if a neighbor moves or a key gets lost, you give a spare key to another neighbor based on your own key. What difference does it make unless everyone you trust is gone or has lost everything? At that point you have larger problems than logging into online accounts.
    • ProZsolt 7y ago
      But you already can do that. You can register multiple U2F keys and give it to a family member or put it in a safe. You can do the same with recovery keys.
      • yabadabadoes 7y ago
        The key problem is this: >≥ without having to have them present at every registration For example, I have given a token to a family member in another country, for proper utility I need that token back each time I register on another site..
• tssva 7y ago
  An email suggesting enabling 2FA isn't coercion. You voluntarily enabled 2FA and then choose not to protect the backup codes as they repeatedly warn to do because loss of them along with loss of your 2FA device will result in exactly this situation. Now instead of accepting the result is the consequence of your own poor choices you are trying to shift the blame to GitHub.
• urda 7y ago
  E-mail newsletters announcing new features or options are not "coercing" you to do anything. You clicked it, failed to know the ramifications of 2FA (which GitHub does spell out), and didn't secure your backup codes. Take some responsibility instead of blame shifting.
• mythz 7y ago
  It's unfortunate, but I'd consider it a feature that you're not able to sign in without access to the physical devices linked to your 2FA account, i.e. it shouldn't be possible for someone with access to your Email account to be able to "phish" their way passed 2FA access. Nevertheless the anxiety of losing the physical device with all my 2FA logins is what prevented me from enabling 2FA on most of my accounts until I was referred to Authy (authy.com) where you can sync your 2FA across multiple devices including your PC, which other than being very convenient, the effortless syncing + redundancy gave me confidence to enable 2FA on all my accounts as the redundancy ensures I'll still be able to access my accounts if one of my devices is broken/lost.
• morpheuskafka 7y ago
  If you were "coerced" to enable 2FA, that was a decision made by one of the organizations/teams (company accounts) you were a member of, not GitHub. You had every option to leave it disabled, but, per that team's policies, you would have lost access to their repos.
• rmrfrmrf 7y ago
  Luckily it's git and you can just change the remote config of your local copies.
• est31 7y ago
  So that's what happens if you enable 2fA. I have disabled it after I left a Github org where 2fA was required, and haven't enabled it since. However, Github now regularly sends me e-mails with auth codes, basically forcing mail-based 2fA on me. It's annoying as hell and I can't disable it, nor does Support want to do anything about this. Very sad as I'm using a password manager and my password should be safe.
  • fnky 7y ago
    > I'm using a password manager and my password should be safe. You may have forgotten that it doesn't matter how you store your password, but the problem is that it is a single factor. Once compromised, one can gain access to anything within that account. You may be compromised by phishing, keylogging or other means. 2FA can help with making these types of attacks more difficult, although not impossible.
• itsrajju 7y ago
  This happened to me a couple of years ago. Lost my phone, no recovery codes, so no access to github. Contacted support, they told me that they wouldn't be able to restore access even when I was communicating with the email associated with my account. Luckily I only had public repos, so I created a new account and forked them all. Support had told me that if there isn't any login activity in the blocked account for a period of six months, they would delete the account and release the username. And yes, I had to follow up after six months were up to make that happen.