6 ms·

Github refused to help me regain access to an 11 year old account when I changed jobs so lost access to 2FA and email account at the same time. We lost access

Github refused to help me regain access to an 11 year old account when I changed jobs so lost access to 2FA and email account at the same time. We lost access to tens of thousands of dollars worth of project code which we had to rewrite. The customer service support was Google style brick wall. I wish this guy luck in getting access.

a254613e 6y ago
To me that sounds perfectly reasonable, and in fact a good policy. It seems like you lost access to your company account, based on your comment, so who is "we" that lost thousands of dollars worth of project code? If it was your employer that you had the email with, why couldn't you just restore the email? What in your opinion should github do when an employee loses access to their company email, and 2FA, because they're fired? Should the employee gain access to all the code and the account by just contacting github via their personal email?
otagekki 6y ago
Rewrite? Wow. Hopefully for them it is just code so all they'd have to do is push their branches to a new self-hosted server.
- wccrawford 6y ago
  Right? Why wasn't there a backup somewhere other than Github? Even just a repo that was checked out somewhere.
  - richardwhiuk 6y ago
    Feels like this code was owned by the company was the author no longer worked for....
- elwell 6y ago
  Code is (almost) always better when it's re-written. So, maybe it was a blessing in disguise...
tester34 6y ago
how did you want to prove that it was your account instead of stolen "informations" that may be used in recovery process? couldn't you "just" contact your previous employer? anyway, why your private account was using job email :o
jeroenhd 6y ago
To be fair to GH, I wouldn't trust them if their customer service could be convinced to unlock an account with neither email nor 2FA access. Passwords leak all the time (because people are bad at using unique passwords) and social engineering efforts are quite effective at hijacking high-value accounts in a great deal of companies, so while I sympathise with the loss of your account, your experience actually improves my opinion of GH's support.
- londons_explore 6y ago
  2FA should be bypassable after some longish lockout period. For example, someone has lost their password, email access, phone number, and 2FA app. Make them wait a month to regain account access. If any time during that month, the account is used or logged into, cancel the takeover request. During the month, every day send an email to all points of contact on the account letting them know what will happen. It's a trade-off of the harm of unauthorized access to a dormant account Vs blocking someone from accessing their data (that is probably not backed up, and probably took considerable effort to create). Have an account-level setting to disable such a process, for the people who might be offline for extended periods.
  - qayxc 6y ago
    > 2FA should be bypassable after some longish lockout period. Nope. No backups, no sympathy, simple as that. 2FA is worthless if you start to put holes in it like that. So if you value your data, make backups - preferably locally the old-fashioned way, e.g. HDDs stored in at least two different locations or at least using several different cloud providers (which have their own infrastructure and aren't just relying on AWS/GCP/Azure/etc.). There's no such thing as a "trade-off" when it comes to cyber security - either commit to it fully or just don't use 2FA at all. Personally, I think 2FA that doesn't rely on physical devices (phones, keys, smart cards, etc.) is unreliable and sketchy anyways. If you can't spare a few hundred bucks on a NAS that you can just put in a storage unit or bank vault if need be, you data can't be that valuable anyway.
    - fsflover 6y ago
frombody 6y ago
Using a company email to sign up for services and expecting to have access after you leave the company is 100% entirely your fault. Even with the positive spin you're trying to put on it, it still sounds like you are trying to steal data from your former employer. The situation would probably also be easily resolvable with your former employer's help, and there is likely a reason they aren't helping you.
- prepend 6y ago
  Yeah, it seems odd that the former employer doesn’t just remove the account from their org and thus remove the MFA requirement. I’ve had really positive experiences with GitHub support, but you can’t ask them impossible things. There’s a GitHub user with my org name, they’ve had it for a long time and aren’t active. I asked GitHub support to see if they were active and if they’d be willing to transfer the account. GitHub confirmed they were active but just with no public activity and they passed along the request. I like that they were human and didn’t try to force the user to give up their account. I’ve had multiple colleagues say that we should try to force the user and I don’t support that line of reasoning. The user has a legitimate use of the name.I like that GitHub took the high road,

a254613e 6y ago

To me that sounds perfectly reasonable, and in fact a good policy. It seems like you lost access to your company account, based on your comment, so who is "we" that lost thousands of dollars worth of project code? If it was your employer that you had the email with, why couldn't you just restore the email? What in your opinion should github do when an employee loses access to their company email, and 2FA, because they're fired? Should the employee gain access to all the code and the account by just contacting github via their personal email?

otagekki 6y ago

Rewrite? Wow. Hopefully for them it is just code so all they'd have to do is push their branches to a new self-hosted server.

wccrawford 6y ago
Right? Why wasn't there a backup somewhere other than Github? Even just a repo that was checked out somewhere.
- richardwhiuk 6y ago
  Feels like this code was owned by the company was the author no longer worked for....
elwell 6y ago
Code is (almost) always better when it's re-written. So, maybe it was a blessing in disguise...

tester34 6y ago

how did you want to prove that it was your account instead of stolen "informations" that may be used in recovery process? couldn't you "just" contact your previous employer? anyway, why your private account was using job email :o

jeroenhd 6y ago

To be fair to GH, I wouldn't trust them if their customer service could be convinced to unlock an account with neither email nor 2FA access. Passwords leak all the time (because people are bad at using unique passwords) and social engineering efforts are quite effective at hijacking high-value accounts in a great deal of companies, so while I sympathise with the loss of your account, your experience actually improves my opinion of GH's support.

londons_explore 6y ago
2FA should be bypassable after some longish lockout period. For example, someone has lost their password, email access, phone number, and 2FA app. Make them wait a month to regain account access. If any time during that month, the account is used or logged into, cancel the takeover request. During the month, every day send an email to all points of contact on the account letting them know what will happen. It's a trade-off of the harm of unauthorized access to a dormant account Vs blocking someone from accessing their data (that is probably not backed up, and probably took considerable effort to create). Have an account-level setting to disable such a process, for the people who might be offline for extended periods.
- qayxc 6y ago
  > 2FA should be bypassable after some longish lockout period. Nope. No backups, no sympathy, simple as that. 2FA is worthless if you start to put holes in it like that. So if you value your data, make backups - preferably locally the old-fashioned way, e.g. HDDs stored in at least two different locations or at least using several different cloud providers (which have their own infrastructure and aren't just relying on AWS/GCP/Azure/etc.). There's no such thing as a "trade-off" when it comes to cyber security - either commit to it fully or just don't use 2FA at all. Personally, I think 2FA that doesn't rely on physical devices (phones, keys, smart cards, etc.) is unreliable and sketchy anyways. If you can't spare a few hundred bucks on a NAS that you can just put in a storage unit or bank vault if need be, you data can't be that valuable anyway.
  - fsflover 6y ago

frombody 6y ago

Using a company email to sign up for services and expecting to have access after you leave the company is 100% entirely your fault. Even with the positive spin you're trying to put on it, it still sounds like you are trying to steal data from your former employer. The situation would probably also be easily resolvable with your former employer's help, and there is likely a reason they aren't helping you.

prepend 6y ago
Yeah, it seems odd that the former employer doesn’t just remove the account from their org and thus remove the MFA requirement. I’ve had really positive experiences with GitHub support, but you can’t ask them impossible things. There’s a GitHub user with my org name, they’ve had it for a long time and aren’t active. I asked GitHub support to see if they were active and if they’d be willing to transfer the account. GitHub confirmed they were active but just with no public activity and they passed along the request. I like that they were human and didn’t try to force the user to give up their account. I’ve had multiple colleagues say that we should try to force the user and I don’t support that line of reasoning. The user has a legitimate use of the name.I like that GitHub took the high road,