4 ms·

Is it just me, or does this make my MFA-protected account safer? I wish conpanies offered this as a feature, in the sense I'm much more worried about someone S

Is it just me, or does this make my MFA-protected account safer? I wish conpanies offered this as a feature, in the sense I'm much more worried about someone SEing their way into my account rather than me losing access to all my MFA methods and backup codes or whatever.

zndr 6y ago
Yes 100% it does make it safer.
tialaramex 6y ago
Yes. I would cheerfully enable this for almost everything. If your product or service isn't worth several hours of my time to try to recover, then I shouldn't have to risk it being worth several hours of somebody else's time to steal it.
GoblinSlayer 6y ago
Does it make free accounts safer than paid accounts?
tgsovlerkhgsel 6y ago
It makes your MFA-protected account safer from takeover, but also creates a new risk of completely losing access to your account and username forever. Github has the same policy, and it deterred me from using MFA for a long time, and when I finally did, I added a large number of alternatives, including the not-so-secure SMS. I think the fear of being temporarily unable to access your account is already a major reason why people don't use MFA. Turning the threat into a permanent loss will make people even more reluctant to do it. Dealing with some of the backup methods (e.g. off-site copies of backup codes) is tedious, and I wouldn't be willing to do it for less important sites. If I had 2FA on Gitlab, I'd probably turn it off now. (Actually, just saw they don't have an option to add a phone number - I'd definitely turn it off.)
- Jedd 6y ago
  > ... but also creates a new risk of completely losing access to your account and username forever. I may have misread the announcement, but it sounds like upgrading to a paid account recovers (npi) the ability to recover your account.
  - noisem4ker 6y ago
    How does one upgrade their account if they cannot access it at all?
    - Jedd 6y ago
      I suspect if one can a) exhibit genuine interest in becoming a customer waving their credit card around, and b) demonstrate ownership of 1FA for the account, then this would be relatively straightforward. Or rather, at least as straightforward as the process is meant to be for existing paid-up customers, as per TFA.

zndr 6y ago

Yes 100% it does make it safer.

tialaramex 6y ago

Yes. I would cheerfully enable this for almost everything. If your product or service isn't worth several hours of my time to try to recover, then I shouldn't have to risk it being worth several hours of somebody else's time to steal it.

GoblinSlayer 6y ago

Does it make free accounts safer than paid accounts?

tgsovlerkhgsel 6y ago

It makes your MFA-protected account safer from takeover, but also creates a new risk of completely losing access to your account and username forever. Github has the same policy, and it deterred me from using MFA for a long time, and when I finally did, I added a large number of alternatives, including the not-so-secure SMS. I think the fear of being temporarily unable to access your account is already a major reason why people don't use MFA. Turning the threat into a permanent loss will make people even more reluctant to do it. Dealing with some of the backup methods (e.g. off-site copies of backup codes) is tedious, and I wouldn't be willing to do it for less important sites. If I had 2FA on Gitlab, I'd probably turn it off now. (Actually, just saw they don't have an option to add a phone number - I'd definitely turn it off.)

Jedd 6y ago
> ... but also creates a new risk of completely losing access to your account and username forever. I may have misread the announcement, but it sounds like upgrading to a paid account recovers (npi) the ability to recover your account.
- noisem4ker 6y ago
  How does one upgrade their account if they cannot access it at all?
  - Jedd 6y ago
    I suspect if one can a) exhibit genuine interest in becoming a customer waving their credit card around, and b) demonstrate ownership of 1FA for the account, then this would be relatively straightforward. Or rather, at least as straightforward as the process is meant to be for existing paid-up customers, as per TFA.