5 ms·

I'm sorry you lost your account (really, that sucks) but I don't understand framing this like Github is doing something wrong. It isn't like they banned you for

by beart 7y ago

I'm sorry you lost your account (really, that sucks) but I don't understand framing this like Github is doing something wrong. It isn't like they banned you for spamming emojis. You enabled 2fa, you lost your 2fa, and you did not have any recovery codes. Now you are asking for them to bypass the 2fa, and they are refusing. Again, that sucks, but when I compare this to what the cell phone companies are doing with sim swapping, it increases my respect for Github.

cloverich 7y ago
Humans are humans though, and mistakes are inevitable. In this case, you get an email from the same address used to setup the accounts, and a corresponding complete stop in activity on the repo. Further, I bet OP could even demonstrate ownership of some of the code (whichever private repo's they happen to have checked out). All in all, it adds up, and as a paying customer its reasonable to expect Github to have some measures in place for scenarios like this.
- UncleEntity 7y ago
  > you get an email from the same address used to setup the accounts... Isn't one of the biggest selling points of 2fa that if one account gets hacked you don't lose all accounts?
  - derefr 7y ago
    The selling point of 2FA is that if a hacker gets your password (from a DB dump from a compromise of site A that has bad security and no PW hashing) and tries to use it on site B, then site B still won't let them in because they don't have the second factor for site B. In this case, an email account is the second factor. Your Github password is the first factor.
    - rmrfrmrf 7y ago
      No, multifactor authentication uses different forms of evidence (i.e., something you have, something you are, something you know), not just multiple accounts. Given password reuse, cookies, etc., e-mail is a terrible second factor.
sdegutis 7y ago
Same thing happened to me and my wife. The permanence of 2fa failing was something that didn’t exist until just a few years ago. For decades before that you could always get back in as long as you had an email. With that safety net in mind, it’s easy to go on “auto pilot” with using the internet and devices, not worrying at all about anything. And when 2fa came it kind of changed that with very little warning - or at least the warning wasn’t clearly distinct enough from previous-generation auth techniques so we (understandably so) didn’t pay enough heed. Fortunately it was only regarding an iTunes account so all we lost was access to a dozen VeggieTales movies, but it got me wanting to disable 2fa on my own account, but Apple doesn’t allow that anymore. Sigh.
Thorrez 7y ago
I think most 2FA-supporting websites will let you regain access to your account if you lose your 2FA device but still have your password and email. Similarly to how most 1FA websites will let you regain access to your account if you lose your password but still have access to your email. If Github is doing something different than most websites, that needs to be very very clearly communicated at setup time, otherwise people will assume Github behaves like other websites.
- jobigoud 7y ago
  Wait, what would be the point of 2FA if you could reset access to the account with just 1FA, password and email?
  - Aeolun 7y ago
    I think it requires you to actually interface with support to prove beyond reasonable doubt that you are you.
  - Thorrez 7y ago
    Regardless of whether other websites' 2FA is useless, you need to make it clear when you do something different from them.
    - beart 7y ago
      I think the big red warning is pretty clear. > Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods. https://help.github.com/en/github/authenticating-to-github/recovering-your-account-if-you-lose-your-2fa-credentials https://help.github.com/en/github/authenticating-to-github/r...
      - Thorrez 7y ago
        I just put 2FA on my Github account. During that enrollment flow, there were no red warnings, and nothing said that if you lose your 2FA device and your recovery codes you will be unable to ever access your account. In fact it said >Treat your recovery codes with the same level of attention as you would your password! Most people forget passwords all the time and treat that as no big deal because they can just reset the password. If people use that "same level of attention" for the recovery codes, then they will be lost just as easily, except this time people won't be able to recover. Edit: After enabling I got an email with a much more cautionary tone: > Recovery codes are the only way to access your account again. > GitHub Support will not be able to restore access to your account. It's interesting they call this out in the email but not during the sign up process.
dredmorbius 7y ago
Let's see what happens when C-suite levels lose access.
sytelus 7y ago
GitHub 2fa is the worse implementation than the most I have encountered. They tell you that you can save recovery codes in facebook but guess what? It doesn't work! So you get lulled into having recovery codes safe in your FB account until you need it when they simply through error message that "oops, sorry. something went wrong, contact customer service.". So next, you try to find customer service and guess what? They have the worse setup for that as well! They have enterprise, pro and all kind of variations. You are expected to literally learn about their internal hierarchy of customer support organization and you scratch your head who the hell runs this thing? When you finally actually get through all that you find out pro is not pro and enterprise is not really enterprise and, BTW, whole team if off on some training this entire week so don't expect any response. You see, they don't think you actually have a job or any kind of urgengy. So you wait for response for days and likely you won't get any. There is no phone nuber to talk to human and emails are bounced around in their internal hierarchy. Losing your phone could be pretty bad thing if you have setup github 2fa. Given how we all have placed GitHub front and center of our lives, there is no excuse for any of this. Even if I'd no recovery codes, I would expect GitHub had some process to get back access back. GitHub account should be looked upon with same reverence as bank account. The idea that you need to forget about money you have in bank account because you lose your phone and recovery code is mind numbing. They could charge you $500, run professional background check on you, get your credit card/bank info and verify it's really you, wait for 30 days, remove private repos and then grant you access again at least for your public repos. That's what I would expect an efficient customer obsessed organization to do.
beshrkayali 7y ago
There has to be a mechanism where you can get your account back if you provide some form of identification. I know that you get into other issues that way, but 2fa without a mechanism to restore account in case of phone/code loss (or inability to access, which is somewhat likely if you don't keep multiple copies of your codes) is pretty stupid.
- fnky 7y ago
  I'd love to hear of any solutions on this. The solution should, however, be insusceptible to remote attacks, that could put a user's account at risk. 2FA with SMS has the problem that companies offer support by human and don't have a tight system for changing numbers to another phone, as proven again and again, resulting in accounts being compromised. While the current solution of MFA aren't perfect, it's hard to come up with other solution that would be as safe or safer and prevent most to all mechanisms used to compromise accounts, like phishing, social engineering and other possible remote attacks. Giving you the possibility to save the codes somewhere physical has its downsides, but an important upside is that it allows _you_ to keep in charge your own security in most cases.
- xondono 7y ago
  The one I've had to use (and find reasonable) is to have "trusted devices". That's how it works, at least with 1Password: - You log with your 2FA into a device. - You set this device as trusted. - In case you lose your phone or 2FA device, log onto the trusted device and disable 2FA. - Then set up 2FA again with new phone or device. It's not perfect, but it's workable. For instance, while I won't enable trusted device on my laptop, having my desktop stolen is a way rarer occasion, so I enable the "trust this device" options. It's just a matter of thinking on the threat model and where you can place spots for recovery while loosing as little security as possible.
  - ProZsolt 7y ago
    But that fine because the trusted device is the second factor (what you have). You can have multiple second factors with Github. I currently have two Yubikeys and one authenticator app enabled. If I lose one I can still log in with another.

by beart 7y ago

cloverich 7y ago

Humans are humans though, and mistakes are inevitable. In this case, you get an email from the same address used to setup the accounts, and a corresponding complete stop in activity on the repo. Further, I bet OP could even demonstrate ownership of some of the code (whichever private repo's they happen to have checked out). All in all, it adds up, and as a paying customer its reasonable to expect Github to have some measures in place for scenarios like this.

UncleEntity 7y ago
> you get an email from the same address used to setup the accounts... Isn't one of the biggest selling points of 2fa that if one account gets hacked you don't lose all accounts?
- derefr 7y ago
  The selling point of 2FA is that if a hacker gets your password (from a DB dump from a compromise of site A that has bad security and no PW hashing) and tries to use it on site B, then site B still won't let them in because they don't have the second factor for site B. In this case, an email account is the second factor. Your Github password is the first factor.
  - rmrfrmrf 7y ago
    No, multifactor authentication uses different forms of evidence (i.e., something you have, something you are, something you know), not just multiple accounts. Given password reuse, cookies, etc., e-mail is a terrible second factor.

sdegutis 7y ago

Same thing happened to me and my wife. The permanence of 2fa failing was something that didn’t exist until just a few years ago. For decades before that you could always get back in as long as you had an email. With that safety net in mind, it’s easy to go on “auto pilot” with using the internet and devices, not worrying at all about anything. And when 2fa came it kind of changed that with very little warning - or at least the warning wasn’t clearly distinct enough from previous-generation auth techniques so we (understandably so) didn’t pay enough heed. Fortunately it was only regarding an iTunes account so all we lost was access to a dozen VeggieTales movies, but it got me wanting to disable 2fa on my own account, but Apple doesn’t allow that anymore. Sigh.

Thorrez 7y ago

I think most 2FA-supporting websites will let you regain access to your account if you lose your 2FA device but still have your password and email. Similarly to how most 1FA websites will let you regain access to your account if you lose your password but still have access to your email. If Github is doing something different than most websites, that needs to be very very clearly communicated at setup time, otherwise people will assume Github behaves like other websites.

jobigoud 7y ago
Wait, what would be the point of 2FA if you could reset access to the account with just 1FA, password and email?
- Aeolun 7y ago
  I think it requires you to actually interface with support to prove beyond reasonable doubt that you are you.
- Thorrez 7y ago
  Regardless of whether other websites' 2FA is useless, you need to make it clear when you do something different from them.
  - beart 7y ago
    I think the big red warning is pretty clear. > Warning: For security reasons, GitHub Support may not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods. https://help.github.com/en/github/authenticating-to-github/recovering-your-account-if-you-lose-your-2fa-credentials https://help.github.com/en/github/authenticating-to-github/r...
    - Thorrez 7y ago
      I just put 2FA on my Github account. During that enrollment flow, there were no red warnings, and nothing said that if you lose your 2FA device and your recovery codes you will be unable to ever access your account. In fact it said >Treat your recovery codes with the same level of attention as you would your password! Most people forget passwords all the time and treat that as no big deal because they can just reset the password. If people use that "same level of attention" for the recovery codes, then they will be lost just as easily, except this time people won't be able to recover. Edit: After enabling I got an email with a much more cautionary tone: > Recovery codes are the only way to access your account again. > GitHub Support will not be able to restore access to your account. It's interesting they call this out in the email but not during the sign up process.

dredmorbius 7y ago

Let's see what happens when C-suite levels lose access.

sytelus 7y ago

GitHub 2fa is the worse implementation than the most I have encountered. They tell you that you can save recovery codes in facebook but guess what? It doesn't work! So you get lulled into having recovery codes safe in your FB account until you need it when they simply through error message that "oops, sorry. something went wrong, contact customer service.". So next, you try to find customer service and guess what? They have the worse setup for that as well! They have enterprise, pro and all kind of variations. You are expected to literally learn about their internal hierarchy of customer support organization and you scratch your head who the hell runs this thing? When you finally actually get through all that you find out pro is not pro and enterprise is not really enterprise and, BTW, whole team if off on some training this entire week so don't expect any response. You see, they don't think you actually have a job or any kind of urgengy. So you wait for response for days and likely you won't get any. There is no phone nuber to talk to human and emails are bounced around in their internal hierarchy. Losing your phone could be pretty bad thing if you have setup github 2fa. Given how we all have placed GitHub front and center of our lives, there is no excuse for any of this. Even if I'd no recovery codes, I would expect GitHub had some process to get back access back. GitHub account should be looked upon with same reverence as bank account. The idea that you need to forget about money you have in bank account because you lose your phone and recovery code is mind numbing. They could charge you $500, run professional background check on you, get your credit card/bank info and verify it's really you, wait for 30 days, remove private repos and then grant you access again at least for your public repos. That's what I would expect an efficient customer obsessed organization to do.

beshrkayali 7y ago

There has to be a mechanism where you can get your account back if you provide some form of identification. I know that you get into other issues that way, but 2fa without a mechanism to restore account in case of phone/code loss (or inability to access, which is somewhat likely if you don't keep multiple copies of your codes) is pretty stupid.

fnky 7y ago
I'd love to hear of any solutions on this. The solution should, however, be insusceptible to remote attacks, that could put a user's account at risk. 2FA with SMS has the problem that companies offer support by human and don't have a tight system for changing numbers to another phone, as proven again and again, resulting in accounts being compromised. While the current solution of MFA aren't perfect, it's hard to come up with other solution that would be as safe or safer and prevent most to all mechanisms used to compromise accounts, like phishing, social engineering and other possible remote attacks. Giving you the possibility to save the codes somewhere physical has its downsides, but an important upside is that it allows _you_ to keep in charge your own security in most cases.
xondono 7y ago
The one I've had to use (and find reasonable) is to have "trusted devices". That's how it works, at least with 1Password: - You log with your 2FA into a device. - You set this device as trusted. - In case you lose your phone or 2FA device, log onto the trusted device and disable 2FA. - Then set up 2FA again with new phone or device. It's not perfect, but it's workable. For instance, while I won't enable trusted device on my laptop, having my desktop stolen is a way rarer occasion, so I enable the "trust this device" options. It's just a matter of thinking on the threat model and where you can place spots for recovery while loosing as little security as possible.
- ProZsolt 7y ago
  But that fine because the trusted device is the second factor (what you have). You can have multiple second factors with Github. I currently have two Yubikeys and one authenticator app enabled. If I lose one I can still log in with another.