4 ms·

Never lose your 2FA backup codes or you're locked out of your account forever if you lose your 2FA device - despite support having a verification process to rem

by Nadya 4y ago

Never lose your 2FA backup codes or you're locked out of your account forever if you lose your 2FA device - despite support having a verification process to remove 2FA in the event you lost your codes - the support tickets are ignored or unmonitored. I was also a happy DO customer for the last 5 years or so. But now I'm locked out of my account. My fault for losing my codes (DO are the only backup codes I can't seem to find where I kept them... oddly they are not in my password manager) but they have a process in place for this and don't follow it. I'd be less annoyed if I was told it was my fault and there wasn't an avenue to receive support than being told I can go to support and then get ignored...

jackson1442 4y ago
> Never lose your 2FA backup codes or you're locked out of your account forever if you lose your 2FA device In the case of digital infrastructure, I'm actually kinda ok with this. Would be better if it was a policy or if you could prove ownership of the payment account, but at the very least it's much harder to social engineer someone out of an account. Of course, the lack of support isn't good.
- Nadya 4y ago
  I'm OK with it when it is official policy or you were warned beforehand that "No really. If you lose this and you're fucked - we will not provide support for account recovery." Precisely for the same security reason of preventing social engineering attacks for otherwise well-secured assets. But, and it is common with most places, you can jump through some hoops and get it removed my support. I still blame myself for losing my backup codes - but being told Support can help and then being ignored is well... annoying to say the least. I use cock.li [0] for my emails. This is the official password recovery process: > I forgot my password! > Passwords are not reset for any reason. Good luck. Many years ago - I forgot my password to my email! It was the kick in the ass I needed to begin using a password manager - and since the email was mostly for memes and not really used it was mostly a positive experience with a positive outcome. I occasionally try to login to the email but so far no luck in remembering my password. :) [0] https://cock.li/help https://cock.li/help
- hotpotamus 4y ago
  It seems like a good case for putting an exorbitant charge on it with huge warnings about that upfront. Charge a $1000 recovery fee or something like that and make people check a box agreeing to it. I would imagine thoroughly vetting the request is pretty onerous on DO support (and it should be), but they should make the customer pay for it since it is ultimately the customer's responsibility. This is my greatest fear with my 2FA stuff and why I try to make sure and always have an available backup.
activitypea 4y ago
I had this happen in 2018 and had no trouble getting my account back. The support agent requested pictures of me with documents -- front of credit card used as payment method + passport -- and then disabled 2FA on my account.
- Nadya 4y ago
  The support ticket email requested I reply back with that information: Details about the payment method on the account, the date and amount of the last transaction by DO, a photo of a government-issued ID, and a photo of you holding the ID next to your face. I provided the payment details, the date and amount of the last transaction as text, a screenshot of my bank statement of the transaction, 2 forms of ID (passport & driver's license), and a photo of my face next to both ID's on January 23rd. I replied again on February 7th with the most recent date of my transaction and the amount paid. No response.
  - ratg13 4y ago
    I’ve been burned by companies like this before, but there is no way for anyone to know if you are providing them with correct info, as this is also the easiest way to takeover someone else’s account. The tough lesson to learn is always to deploy from a source code repository. It sucks to lose your stuff, but if you follow best practices it will make you a better developer/architect and things like this will only become minor inconveniences. I had to lose months of hard work for similar reasons to learn this lesson.
    - Nadya 4y ago
      My CTF [0] that has been running for years will break and that's honestly my biggest concern. I have no clue how to even get it up and running again because I've mostly forgotten everything I learned to get it setup to begin with... I kept it out of my repo to prevent accidental spoilers if I ever made the repo public - though thinking back I really should have set up a CTF branch and just never published that branch. So lesson learned if I ever make another CTF: extensively document every single step for how to recreate and setup the game again. Redeploying the site and even saving all the files uploaded to the site are both relatively trivial. The deploy is almost entirely automated and I can still login to my root user panel, download any uploaded files, and transfer them over to the newly deployed site - so I'm only experiencing minor data loss. (eg. the DateUploaded for files will be lost and I don't care enough to try and back that up to restore it) Hopefully I do everything right and prevent link rot. Thankfully I'm the sole user of my file host so nobody else is losing any data. [0] If anyone wants to become the 4th and probably final person to ever solve my CTF - you have just shy of 2 weeks before it breaks: https://nadyanay.me/ctf https://nadyanay.me/ctf
deleted 4y ago
[deleted]
noirbot 4y ago
I'm literally in thee process of trying to do this right now and have gotteen responses from their support within an hour or two, including late at night. Maybe stuff got better, but 2FA Recovery seems to not be as bad as you're saying.
- Nadya 4y ago
  I'm glad to hear the process is working for you but I'm also in the process right now. This is my "Sent" folder: https://imgur.com/a/3D1FSYz https://imgur.com/a/3D1FSYz Initial ticket was sent to Support on Jan 23rd, I bumped and asked if there was any issue with the information I provided on Jan 29th or if they needed more information, I then provided February's payment on Feb 7th. I wanted the answer to "The date and amount (in USD) of the last billing transaction by DigitalOcean." to be up-to-date since January's was no longer a valid answer for the information that was being requested.
  - Nadya 4y ago
    Providing an update: I'm 99% sure my personal email address is being flagged as spam by DO's ticketing system and it isn't that I'm being ignored but that they're not receiving my correspondence. :) I reached out to @DigitalOcean on Twitter about my tickets and the older one was closed out as a dupe and we moved forward with the most recent one. They weren't able to verify my ID - no reason give but I think I know why - and they asked if we can move forward with an alternate means of verification: a random temp charge between $0.01 and $4.99 to the account and I provide the amount of the charge. I agreed to this - and 12 hours later I forgot if I had replied so I agreed to it again. This morning I received an automated response asking for me to respond. I responded. 2 hours later still no response - I hit up Twitter again. I'm thinking the reason they weren't able to verify my ID is because they never got my email providing it in the first place. Now - despite not verifying any charge amount - literally as I was typing this post I received an email stating 2FA was disabled. Either they lied about not being able to verify my ID or they decided to unlock my account anyway without verification which may be of concern to others. E: 2FA re-enabled and this time I made damn sure to backup my backup codes properly... also responded to the support ticket one final time requesting they verify if they've received it. If I don't hear back I'm going to assume I should change the email associated with my account. :)

by Nadya 4y ago

jackson1442 4y ago

> Never lose your 2FA backup codes or you're locked out of your account forever if you lose your 2FA device In the case of digital infrastructure, I'm actually kinda ok with this. Would be better if it was a policy or if you could prove ownership of the payment account, but at the very least it's much harder to social engineer someone out of an account. Of course, the lack of support isn't good.

Nadya 4y ago
I'm OK with it when it is official policy or you were warned beforehand that "No really. If you lose this and you're fucked - we will not provide support for account recovery." Precisely for the same security reason of preventing social engineering attacks for otherwise well-secured assets. But, and it is common with most places, you can jump through some hoops and get it removed my support. I still blame myself for losing my backup codes - but being told Support can help and then being ignored is well... annoying to say the least. I use cock.li [0] for my emails. This is the official password recovery process: > I forgot my password! > Passwords are not reset for any reason. Good luck. Many years ago - I forgot my password to my email! It was the kick in the ass I needed to begin using a password manager - and since the email was mostly for memes and not really used it was mostly a positive experience with a positive outcome. I occasionally try to login to the email but so far no luck in remembering my password. :) [0] https://cock.li/help https://cock.li/help
hotpotamus 4y ago
It seems like a good case for putting an exorbitant charge on it with huge warnings about that upfront. Charge a $1000 recovery fee or something like that and make people check a box agreeing to it. I would imagine thoroughly vetting the request is pretty onerous on DO support (and it should be), but they should make the customer pay for it since it is ultimately the customer's responsibility. This is my greatest fear with my 2FA stuff and why I try to make sure and always have an available backup.

activitypea 4y ago

I had this happen in 2018 and had no trouble getting my account back. The support agent requested pictures of me with documents -- front of credit card used as payment method + passport -- and then disabled 2FA on my account.

Nadya 4y ago
The support ticket email requested I reply back with that information: Details about the payment method on the account, the date and amount of the last transaction by DO, a photo of a government-issued ID, and a photo of you holding the ID next to your face. I provided the payment details, the date and amount of the last transaction as text, a screenshot of my bank statement of the transaction, 2 forms of ID (passport & driver's license), and a photo of my face next to both ID's on January 23rd. I replied again on February 7th with the most recent date of my transaction and the amount paid. No response.
- ratg13 4y ago
  I’ve been burned by companies like this before, but there is no way for anyone to know if you are providing them with correct info, as this is also the easiest way to takeover someone else’s account. The tough lesson to learn is always to deploy from a source code repository. It sucks to lose your stuff, but if you follow best practices it will make you a better developer/architect and things like this will only become minor inconveniences. I had to lose months of hard work for similar reasons to learn this lesson.
  - Nadya 4y ago
    My CTF [0] that has been running for years will break and that's honestly my biggest concern. I have no clue how to even get it up and running again because I've mostly forgotten everything I learned to get it setup to begin with... I kept it out of my repo to prevent accidental spoilers if I ever made the repo public - though thinking back I really should have set up a CTF branch and just never published that branch. So lesson learned if I ever make another CTF: extensively document every single step for how to recreate and setup the game again. Redeploying the site and even saving all the files uploaded to the site are both relatively trivial. The deploy is almost entirely automated and I can still login to my root user panel, download any uploaded files, and transfer them over to the newly deployed site - so I'm only experiencing minor data loss. (eg. the DateUploaded for files will be lost and I don't care enough to try and back that up to restore it) Hopefully I do everything right and prevent link rot. Thankfully I'm the sole user of my file host so nobody else is losing any data. [0] If anyone wants to become the 4th and probably final person to ever solve my CTF - you have just shy of 2 weeks before it breaks: https://nadyanay.me/ctf https://nadyanay.me/ctf

deleted 4y ago

[deleted]

noirbot 4y ago

I'm literally in thee process of trying to do this right now and have gotteen responses from their support within an hour or two, including late at night. Maybe stuff got better, but 2FA Recovery seems to not be as bad as you're saying.

Nadya 4y ago
I'm glad to hear the process is working for you but I'm also in the process right now. This is my "Sent" folder: https://imgur.com/a/3D1FSYz https://imgur.com/a/3D1FSYz Initial ticket was sent to Support on Jan 23rd, I bumped and asked if there was any issue with the information I provided on Jan 29th or if they needed more information, I then provided February's payment on Feb 7th. I wanted the answer to "The date and amount (in USD) of the last billing transaction by DigitalOcean." to be up-to-date since January's was no longer a valid answer for the information that was being requested.
- Nadya 4y ago
  Providing an update: I'm 99% sure my personal email address is being flagged as spam by DO's ticketing system and it isn't that I'm being ignored but that they're not receiving my correspondence. :) I reached out to @DigitalOcean on Twitter about my tickets and the older one was closed out as a dupe and we moved forward with the most recent one. They weren't able to verify my ID - no reason give but I think I know why - and they asked if we can move forward with an alternate means of verification: a random temp charge between $0.01 and $4.99 to the account and I provide the amount of the charge. I agreed to this - and 12 hours later I forgot if I had replied so I agreed to it again. This morning I received an automated response asking for me to respond. I responded. 2 hours later still no response - I hit up Twitter again. I'm thinking the reason they weren't able to verify my ID is because they never got my email providing it in the first place. Now - despite not verifying any charge amount - literally as I was typing this post I received an email stating 2FA was disabled. Either they lied about not being able to verify my ID or they decided to unlock my account anyway without verification which may be of concern to others. E: 2FA re-enabled and this time I made damn sure to backup my backup codes properly... also responded to the support ticket one final time requesting they verify if they've received it. If I don't hear back I'm going to assume I should change the email associated with my account. :)