8 ms·

How to lose access of our your servers on DigitalOcean

54 points by migueltarga 4y ago

I have an account on DigitalOcean for long time and I was using Github Login as the method of authentication. For the past 7 years I had my company email as my primary email, and my personal email as secondary. August 18, 2022 1:56:22 PM PDT I removed my primary email account because we had a merge in our company, and now we use different emails. Now I can't get access to my DigitalOcean account, because for some reason they don't use the GitHub identifier but the email address. ( Also I lost access of my company email ) Im trying to get access to my account for the last 20 hours, they requested a picture of my ID, and of me holding my ID. They have everything to change the primary email to the one I requested, but the support team don't understand the problem... So Be careful using GitHub as your DigitalOcean authentication method! Someone had a similar issue in 2020: https://twitter.com/salzian_dev/status/1293975538990813187 https://twitter.com/salzian_dev/status/1293975538990813187

stop50 4y ago
Why did you have an account of your workplace as the first address in the first place. i never trust my employer with more personal data than nesserary. He is in control of the address and can do what he wants with it.
- migueltarga 4y ago
  Not possible to gain access with 2 factor authentication. I used as my primary email to receive email notifications
  - spicybright 4y ago
    That's extremely weird you can't use the same address for notifications and 2FA But if that's the case, you shouldn't tie personal accounts to work stuff like this in the first place. Just make a second email address. Sure it's convenient but then you dig yourself holes like this.
reidjs 4y ago
Losing your email isn't DigitalOcean's fault and the fact that they are actively working on getting you access back should prevent you from naming and shaming them.
- alexklarjr 4y ago
  If he is using github account, all he need is to authenticate with it. He is not obliged to keep his email, phone, home address and authenticator ready because system deciding he is sus every 30 days.
- synthmeat 4y ago
  Yeah. I'm not 100% even sure what is this "GitHub" part of, but I'd be thankful anyone is helping me in any way to recover my account.
- migueltarga 4y ago
  I love Digital Ocean, don't get me wrong. Im just sharing the Bad experience with the "Social Authentication" flow and how long it is taking to solve a simple problem. This also a heads up for anyone using GitHub as the authentication method.
  - spicybright 4y ago
    It's definitely not a simple problem though. Anyone can claim they own your account. And it would be bone-headed to make the re-verification process easy.
    - migueltarga 4y ago
      Sure, but I did not change my Authentication Method. Im still using GitHub login. With the same Github ID...
    - jbverschoor 4y ago
      And now the company admin, or if the domain for sale again, can take over his account
spicybright 4y ago
At least you've learned a good lesson here. If you want ownership of an account, you need ownership of the email you use. And do a hard separation between personal and work services. Also, it sucks the hoops you're going through, but it's good they resist common social engineering tactics like they are. Good on them. Maybe suck up to a sys admin to re-instate the email for a day if support goes nowhere.
- migueltarga 4y ago
  They did everything to confirm my Identity and prevent social engineering tactics which is exactly what I expected from the company. But I feel like they don't have an internal process to solve this issue, I haven't anything back for the last 8 hours..
  - edf13 4y ago
    To be fair - for a standard account, not hearing back for 8 hours wouldn’t concern me too much
    - migueltarga 4y ago
      For sure the SLO for standard account is 24hrs.
- synthmeat 4y ago
  Also, if they're not keeping old domain (thus being able to create any (new or old) email account), they're doing a really bad job at sysadmining.
  - soneil 4y ago
    This doesn't really solve the root cause. It could just as easily be caused selling off a business unit where this isn't an option.
alexklarjr 4y ago
That is why I cancelled my do account snd switched to normal vps hosting. They give you login and password and never enforce broken 2fa and sso schemes that lead you to lose access and to give phone, photo of id, enter email pins when your ip changed and other “very secure” crap.
gabe_monroy 4y ago
Gabe with DO here. That's a bummer. I hope our support team is able to get your access restored. If you get stuck feel free email me: gabe@
- migueltarga 4y ago
  Thank you Gabe, I sent you an email.
  - gabe_monroy 4y ago
    Received. I confirmed the team is working the issue. Stay tuned.
    - migueltarga 4y ago
      Thank you very much for helping on this, Much Appreciated! I would love to see improvements on the "Social Authentication" process, making the third party ID as primary identifier, instead of the email.
      - gabe_monroy 4y ago
        I hear you. I’ll talk to the team about how we can do better.
        earleybird 4y ago
        I work in the public service sector. When we're architecting OAuth2/OIDC integrations we specify using a unique identifier like a guid or some otherwise immutable id as the federation id. This way other attributes that may be ephemeral can change at will. It's not always easy determining this but it's worth it.
codegeek 4y ago
I don't understand the issue. Can someone ELI5 ? OP signed up with DO using Github login but used a different primary email account on DO which they have no longer access to and now DO will not let them login with Github ?
- migueltarga 4y ago
  Just had a different primary email on my Github account, when I signed up for DO. By changing my primary email account on Github, I lost access to DO.
pablohack 4y ago
If you are using Github authentication, why does you email even matter? Thats bad...
RadixDLT 4y ago
you need to authenticate your new email address first before you delete the old one. https://docs.digitalocean.com/products/accounts/settings/ https://docs.digitalocean.com/products/accounts/settings/
kodah 4y ago
This happened to me with Tailscale, but because my GitHub name changed. It was quite confusing at first.
jbverschoor 4y ago
simply don't use sso.. it's full of these kinds of edge cases. Thankfully we don't "login with facebook" anymore either
gchamonlive 4y ago
Isn't it safest to use a single password manager to rule them all, and a separate MFA application? I mean, sure it would prevent this specific scenario. But I mean, in general, when is it safer to use github or another social login?

54 points by migueltarga 4y ago

stop50 4y ago

Why did you have an account of your workplace as the first address in the first place. i never trust my employer with more personal data than nesserary. He is in control of the address and can do what he wants with it.

migueltarga 4y ago
Not possible to gain access with 2 factor authentication. I used as my primary email to receive email notifications
- spicybright 4y ago
  That's extremely weird you can't use the same address for notifications and 2FA But if that's the case, you shouldn't tie personal accounts to work stuff like this in the first place. Just make a second email address. Sure it's convenient but then you dig yourself holes like this.

reidjs 4y ago

Losing your email isn't DigitalOcean's fault and the fact that they are actively working on getting you access back should prevent you from naming and shaming them.

alexklarjr 4y ago
If he is using github account, all he need is to authenticate with it. He is not obliged to keep his email, phone, home address and authenticator ready because system deciding he is sus every 30 days.
synthmeat 4y ago
Yeah. I'm not 100% even sure what is this "GitHub" part of, but I'd be thankful anyone is helping me in any way to recover my account.
migueltarga 4y ago
I love Digital Ocean, don't get me wrong. Im just sharing the Bad experience with the "Social Authentication" flow and how long it is taking to solve a simple problem. This also a heads up for anyone using GitHub as the authentication method.
- spicybright 4y ago
  It's definitely not a simple problem though. Anyone can claim they own your account. And it would be bone-headed to make the re-verification process easy.
  - migueltarga 4y ago
    Sure, but I did not change my Authentication Method. Im still using GitHub login. With the same Github ID...
  - jbverschoor 4y ago
    And now the company admin, or if the domain for sale again, can take over his account

spicybright 4y ago

At least you've learned a good lesson here. If you want ownership of an account, you need ownership of the email you use. And do a hard separation between personal and work services. Also, it sucks the hoops you're going through, but it's good they resist common social engineering tactics like they are. Good on them. Maybe suck up to a sys admin to re-instate the email for a day if support goes nowhere.

migueltarga 4y ago
They did everything to confirm my Identity and prevent social engineering tactics which is exactly what I expected from the company. But I feel like they don't have an internal process to solve this issue, I haven't anything back for the last 8 hours..
- edf13 4y ago
  To be fair - for a standard account, not hearing back for 8 hours wouldn’t concern me too much
  - migueltarga 4y ago
    For sure the SLO for standard account is 24hrs.
synthmeat 4y ago
Also, if they're not keeping old domain (thus being able to create any (new or old) email account), they're doing a really bad job at sysadmining.
- soneil 4y ago
  This doesn't really solve the root cause. It could just as easily be caused selling off a business unit where this isn't an option.

alexklarjr 4y ago

That is why I cancelled my do account snd switched to normal vps hosting. They give you login and password and never enforce broken 2fa and sso schemes that lead you to lose access and to give phone, photo of id, enter email pins when your ip changed and other “very secure” crap.

gabe_monroy 4y ago

Gabe with DO here. That's a bummer. I hope our support team is able to get your access restored. If you get stuck feel free email me: gabe@

migueltarga 4y ago
Thank you Gabe, I sent you an email.
- gabe_monroy 4y ago
  Received. I confirmed the team is working the issue. Stay tuned.
  - migueltarga 4y ago
    Thank you very much for helping on this, Much Appreciated! I would love to see improvements on the "Social Authentication" process, making the third party ID as primary identifier, instead of the email.
    - gabe_monroy 4y ago
      I hear you. I’ll talk to the team about how we can do better.
      - earleybird 4y ago
        I work in the public service sector. When we're architecting OAuth2/OIDC integrations we specify using a unique identifier like a guid or some otherwise immutable id as the federation id. This way other attributes that may be ephemeral can change at will. It's not always easy determining this but it's worth it.

codegeek 4y ago

I don't understand the issue. Can someone ELI5 ? OP signed up with DO using Github login but used a different primary email account on DO which they have no longer access to and now DO will not let them login with Github ?

migueltarga 4y ago
Just had a different primary email on my Github account, when I signed up for DO. By changing my primary email account on Github, I lost access to DO.

pablohack 4y ago

If you are using Github authentication, why does you email even matter? Thats bad...

RadixDLT 4y ago

you need to authenticate your new email address first before you delete the old one. https://docs.digitalocean.com/products/accounts/settings/ https://docs.digitalocean.com/products/accounts/settings/

kodah 4y ago

This happened to me with Tailscale, but because my GitHub name changed. It was quite confusing at first.

jbverschoor 4y ago

simply don't use sso.. it's full of these kinds of edge cases. Thankfully we don't "login with facebook" anymore either

gchamonlive 4y ago

Isn't it safest to use a single password manager to rule them all, and a separate MFA application? I mean, sure it would prevent this specific scenario. But I mean, in general, when is it safer to use github or another social login?