4 ms·
This seems to create an interesting security loophole. If someone figures out our GitLab password (i.e. by looking over our shoulder), they can just log in, ena
by miki123211 6y ago
This seems to create an interesting security loophole. If someone figures out our GitLab password (i.e. by looking over our shoulder), they can just log in, enable MFA and we are locked out, forever.
Think about this. Any criminal who gets access to your Gitlab account can make it impossible for you to access it ever again.
If I used GitLab, I would seriously consider moving somewhere else.
- sixhobbits 6y agoThey mention this as an exception that they will still handle manually in the community thread https://forum.gitlab.com/t/gitlab-support-is-no-longer-processing-mfa-resets-for-free-users/40905/2 https://forum.gitlab.com/t/gitlab-support-is-no-longer-proce...
- SifJar 6y agoOr you can just enable MFA yourself, and prevent that from happening? Am I missing something?
- marcrosoft 6y agoSeconding this: enforce MFA on all gitlab accounts and make sure they at least click the print recovery codes button.
- littldevl 6y agoIn your world no one ever makes mistakes or errors, it must be nice.
- SifJar 6y agoNot sure how you get that conclusion from my comment, of course people make mistakes - my suggestion is one way to prevent such a mistake? i.e. if you have MFA enabled, it "doesn't matter" as much if you do make a mistake and accidentally reveal your password to someone
- drawkbox 6y agoIt would be a good idea to make this decision a user setting, choosing complete lockout or ability to get support to reset your account. For most accounts people probably don't want full lockout, but for things like source code maybe they do. It really should be a user decision, the liability is all on them then and they are at least aware of the stakes.
- TallGuyShort 6y agoIf it's really critical that you not be locked out of it, I would consider paying for a higher level of service.