4 ms·

I generally support not resetting MFA credentials, and understand where Gitlab is coming from, but wish there were an easier way for the average user. I think t

I generally support not resetting MFA credentials, and understand where Gitlab is coming from, but wish there were an easier way for the average user. I think that easier way is getting two FIDO2 keys (they're pretty cheap and will get cheaper), and have one on your keychain and one at home, as a backup.

nicoburns 6y ago
For a casual user (unlikely to be specifically targetted for attack) I think SMS is a good option. If you lose your phone then you can just order a replacement sim card and you have your second facto back.
- StavrosK 6y ago
  I really hate SMS for security, given how easy it is to hijack a number for a few minutes. It has been the basis of so many hacks, that we'd do well to just abolish it everywhere.
  - virtue3 6y ago
    but convenient :) I'd feel really uncomfortable if it wasn't a backup option. But if it's a backup option it's a security hole. That's a tough circle.
    - StavrosK 6y ago
      Not as convenient as having no second factor, and less secure!
      - zucker42 6y ago
        How is it less secure than no second factor?
        StavrosK 6y ago
        There have been many instances of attacks of people hijacking the connection, calling the service and saying "I forgot my password, can you reset it by verifying my SMS?", which wouldn't have been possible without a second factor.
        joveian 6y ago
        I wish someone would convince Paypal. They require SMS for verification, no other options at all.
        draebek 6y ago
        I think they offer TOTP now, right? Started sometime last year? Do you have to activate SMS alongside it? I have been using TOTP with PayPal for (I think) a few years now. You used to have to run some weird local Python script that somehow imitated the one RSA (I think) dongle they supported in a way I don't understand, but the net result was that you just get a TOTP key that works fine.
        joveian 6y ago
        Multiple Paypal reps told me that SMS is the only way. It is possible they are all incorrect :/. I'll look into it, thanks.
        tialaramex 6y ago
        I wasn't able to see any way to do even TOTP for PayPal when they insisted I enable SMS a few hours ago. I don't have any money in there, it just mediates broken payment interfaces (e.g. Patreon rejected all my payment cards, from multiple banks apparently they're all fraud or something? No idea, the cards remain working no problem everywhere else, but I wanted to give people money for what they do, so I used Paypal to manage that) It's pretty sad that in 2020 PayPal thinks SMS is a reasonable choice for protecting accounts that might actually have money in them...
        6y ago
- fiblye 6y ago
  As someone who travels frequently and has moved to different countries, SMS is the absolute worst. If a service asks me to verify my number after crossing a border, the chances of me ever being able to log into that account ever again are basically zero. Then there's Google. Google doesn't have a phone number on file for me, but they sometimes demand that I input a phone number and enter a verification code to access my accounts. This has led to me needing to ask a total stranger to help me login to my accounts, potentially allowing them full access to all of my data in the name of "security." But hey, nobody ever said Google hires smart people.
  - epanchin 6y ago
    This is a very niche case. Why can't you recieve sms abroad? Do you leave your phone behind when you travel? Why can't you give Google your current phone number?
    - lbotos 6y ago
      Not OP but I face this problem: - Why can't you recieve sms abroad? Because I use e-sims and pay $10 for 30 days of data only vs. the $30 my provider would add to my bill for "global data". > Do you leave your phone behind when you travel? No, but I do leave my US number "dormant" in that i can't use it. > Why can't you give Google your current phone number? Because they already have a clear enough data picture of who i am, and I don't want them to have any more data that I'm willingly giving them.
      - StavrosK 6y ago
        Can you give some more info on eSIMs, where you get them from, how much data they have, etc?
    - fiblye 6y ago
      > Why can't you recieve sms abroad? Because my SIM card is useless the minute I'm outside of its recognized area. > Why can't you give Google your current phone number? Because my phone number is useless the minute I'm outside of its recognized area. My old bank accounts have my old phone number on record. It hasn't been my phone number in 6 years and they don't accept phone numbers from my current country. I'm not going to give Google my current phone number, because if it changes again, I'll be locked out of those accounts forever should I move or change numbers again. As it is, I can still login while having someone lend me a phone and making my account completely insecure.
danielheath 6y ago
Two tokens is just what it costs to use secure MFA. Ideally three - store one at EG your parents house so you aren’t losing access if your home is inaccessible.

nicoburns 6y ago

For a casual user (unlikely to be specifically targetted for attack) I think SMS is a good option. If you lose your phone then you can just order a replacement sim card and you have your second facto back.

StavrosK 6y ago
I really hate SMS for security, given how easy it is to hijack a number for a few minutes. It has been the basis of so many hacks, that we'd do well to just abolish it everywhere.
- virtue3 6y ago
  but convenient :) I'd feel really uncomfortable if it wasn't a backup option. But if it's a backup option it's a security hole. That's a tough circle.
  - StavrosK 6y ago
    Not as convenient as having no second factor, and less secure!
    - zucker42 6y ago
      How is it less secure than no second factor?
      - StavrosK 6y ago
        There have been many instances of attacks of people hijacking the connection, calling the service and saying "I forgot my password, can you reset it by verifying my SMS?", which wouldn't have been possible without a second factor.
        joveian 6y ago
        I wish someone would convince Paypal. They require SMS for verification, no other options at all.
        draebek 6y ago
        I think they offer TOTP now, right? Started sometime last year? Do you have to activate SMS alongside it? I have been using TOTP with PayPal for (I think) a few years now. You used to have to run some weird local Python script that somehow imitated the one RSA (I think) dongle they supported in a way I don't understand, but the net result was that you just get a TOTP key that works fine.
        joveian 6y ago
        Multiple Paypal reps told me that SMS is the only way. It is possible they are all incorrect :/. I'll look into it, thanks.
        tialaramex 6y ago
        I wasn't able to see any way to do even TOTP for PayPal when they insisted I enable SMS a few hours ago. I don't have any money in there, it just mediates broken payment interfaces (e.g. Patreon rejected all my payment cards, from multiple banks apparently they're all fraud or something? No idea, the cards remain working no problem everywhere else, but I wanted to give people money for what they do, so I used Paypal to manage that) It's pretty sad that in 2020 PayPal thinks SMS is a reasonable choice for protecting accounts that might actually have money in them...
        6y ago
fiblye 6y ago
As someone who travels frequently and has moved to different countries, SMS is the absolute worst. If a service asks me to verify my number after crossing a border, the chances of me ever being able to log into that account ever again are basically zero. Then there's Google. Google doesn't have a phone number on file for me, but they sometimes demand that I input a phone number and enter a verification code to access my accounts. This has led to me needing to ask a total stranger to help me login to my accounts, potentially allowing them full access to all of my data in the name of "security." But hey, nobody ever said Google hires smart people.
- epanchin 6y ago
  This is a very niche case. Why can't you recieve sms abroad? Do you leave your phone behind when you travel? Why can't you give Google your current phone number?
  - lbotos 6y ago
    Not OP but I face this problem: - Why can't you recieve sms abroad? Because I use e-sims and pay $10 for 30 days of data only vs. the $30 my provider would add to my bill for "global data". > Do you leave your phone behind when you travel? No, but I do leave my US number "dormant" in that i can't use it. > Why can't you give Google your current phone number? Because they already have a clear enough data picture of who i am, and I don't want them to have any more data that I'm willingly giving them.
    - StavrosK 6y ago
      Can you give some more info on eSIMs, where you get them from, how much data they have, etc?
  - fiblye 6y ago
    > Why can't you recieve sms abroad? Because my SIM card is useless the minute I'm outside of its recognized area. > Why can't you give Google your current phone number? Because my phone number is useless the minute I'm outside of its recognized area. My old bank accounts have my old phone number on record. It hasn't been my phone number in 6 years and they don't accept phone numbers from my current country. I'm not going to give Google my current phone number, because if it changes again, I'll be locked out of those accounts forever should I move or change numbers again. As it is, I can still login while having someone lend me a phone and making my account completely insecure.

danielheath 6y ago

Two tokens is just what it costs to use secure MFA. Ideally three - store one at EG your parents house so you aren’t losing access if your home is inaccessible.