4 ms·
It makes your MFA-protected account safer from takeover, but also creates a new risk of completely losing access to your account and username forever. Github h
by tgsovlerkhgsel 6y ago
It makes your MFA-protected account safer from takeover, but also creates a new risk of completely losing access to your account and username forever.
Github has the same policy, and it deterred me from using MFA for a long time, and when I finally did, I added a large number of alternatives, including the not-so-secure SMS.
I think the fear of being temporarily unable to access your account is already a major reason why people don't use MFA. Turning the threat into a permanent loss will make people even more reluctant to do it.
Dealing with some of the backup methods (e.g. off-site copies of backup codes) is tedious, and I wouldn't be willing to do it for less important sites. If I had 2FA on Gitlab, I'd probably turn it off now. (Actually, just saw they don't have an option to add a phone number - I'd definitely turn it off.)
- Jedd 6y ago> ... but also creates a new risk of completely losing access to your account and username forever. I may have misread the announcement, but it sounds like upgrading to a paid account recovers (npi) the ability to recover your account.
- noisem4ker 6y agoHow does one upgrade their account if they cannot access it at all?
- Jedd 6y agoI suspect if one can a) exhibit genuine interest in becoming a customer waving their credit card around, and b) demonstrate ownership of 1FA for the account, then this would be relatively straightforward. Or rather, at least as straightforward as the process is meant to be for existing paid-up customers, as per TFA.