5 ms·

> I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed. The situation you are in is ver

by abxyz 1y ago

> I can't, however, provide any 2FA codes or backup codes because they are printed on paper that has, I assume, been destroyed. The situation you are in is very unfortunate and I am sympathetic but in GitHub's defence, this is exactly what I hope would happen when I enable 2FA. I would be very perturbed to find out that GitHub would grant access to my account given identity documents. There are some creative solutions (e.g: a countdown to the reset with progressively more aggressive email notifications to ensure the account holder is aware) but even they are problematic. So, this sucks, but it's the price we pay for security.

joshmn 1y ago
That's the same stance I have and why I'm torn. The little quirk here—where it makes slightly more sense—is that they received a legal notice at one point (from the US Government) about my account, there are plenty of online articles to corroborate me as me, and I have a fancy prison release ID that can help me identify me. Unfortunately this context is probably lost on the individuals who work their Zendesk. The policies are rather draconian as others have mentioned. Anyone could be the victim of theft; mine just has an awkward paper trail attached to it.
- abxyz 1y ago
  I think the disconnect between you and GitHub support is that you're positioning this as a problem of proving your identity whereas for GitHub support it is a policy. The GitHub policy is: you lose your 2FA, you lose your account. Verifying your identity is not relevant. GitHub provides extensive tooling to protect your account (multiple methods of 2FA, recovery codes etc.) and so from their perspective, while this is deeply unfortunate, the policy is very clear and allowing you access to the account would be a major security issue (not for your account specifically, but for GitHub as an organization). edit: https://docs.github.com/en/site-policy/other-site-policies/github-account-recovery-policy https://docs.github.com/en/site-policy/other-site-policies/g...
  - MrGilbert 1y ago
    I'd assume that there is simply no "ok, this individual got released from prison and can proof everything" policy in place, and that might be the real issue here. Big organizations begin to tumble once you request something where there are no policies in place.
  - ryandrake 1y ago
    These (for good reason) draconian policies are the reason I am still hesitant to embrace 2FA. I understand the significant improvement in your security posture, and I would not want someone not-me to be able to reset my credentials. But the failure mode is just too catastrophic. You lose one thing and you are shit out of luck. We need something better. I don't know what it would be.
    - alwa 1y ago
      I for one would appreciate the option to put an ID on file ahead of time, at least for important stuff like this. I like digital-only accounts for play, but for work stuff with real-world consequence, I’d like to link it to a real-world identity system… Not unlike the signature cards banks used long ago, I guess. Sure, maybe somebody motivated could defraud the government into issuing them a replacement ID in my name. But that’s big boy crime, not a casual “bribe a retail employee to SIM swap” kind of undertaking. Sure, there are issues of access to government ID systems, and I know anything touching government names / “show me your papers” raises hackers’ hackles—I’m not saying require it, just that I’d choose it if it were a MFA option of last resort.
      - joshmn 1y ago
        > I for one would appreciate the option to put an ID on file ahead of time, at least for important stuff like this. I'm at that point of agreement. I don't want to say "national SSO ID" because that can get really Orwellian obviously. Being able to put an ID on file is a reasonable ask.
        em-bee 1y ago
- hluska 1y ago
  I’m not sure that blaming tech support for not understanding context is the best approach here. The other sides of that context, which are understandable from their point of view, is that you were charged with some serious crimes. There’s a large delta between the charges and the conviction, but you’ve got some scary words written about you online. Secondarily, GitHub has policy so whereas you’re coming at it from a position of being correct, they’re in a position where they have to break policy. That’s a big risk. Your best bet would likely be legal. US Federal law imposes some strict rules on lawyers for identity verification to combat money laundering so attorneys have a legally recognized toolkit to verify identity. Having a third party who works for you in the mix could help. Though again, it would involve breaking their policy so this would be a decision made several layers above Zendesk access. Otherwise, I think this is doing precisely what 2FA is meant to do. It’s not okay for you and you’ve clearly lost a lot because of this, but with the current threat environment, GitHub has to be very careful especially with 2FA. From their point of view, there likely isn’t that big of a gap between your interactions and interactions with people who are trying to take over accounts. A lawyer may not work, but it sure changes that equation.
- werkwolk 1y ago
  Why do I feel most of this is ai created text...whoever is posting will probably adjust their prompt, but who uses '-' mid text?
  - lkirkwood 1y ago
    I find this infuriating. I get absolutely no sense that this is AI, and this bizarre attitude towards em dashes is nonsense. Loads of people use them, especially in less formal writing. Get over it.
  - bruce511 1y ago
    I do.
Retr0id 1y ago
As a matter of policy, sure. But at the same time, I bet there are some GitHub employees reading this that would be in a position to pull some strings and make an exception. For OP's sake, I hope I'm right!
- randunel 1y ago
  Social engineering attacks are a thing, you know...
  - Retr0id 1y ago
    I'm aware.
  - DengistKhan 1y ago
    Also could be a honeypot.
zerr 1y ago
The person should be able to walk in the service provider's office and get an in-person help, restoration of access, by presenting ID docs.
- paulcole 1y ago
  If you are not European, I will be amazed. If you set up 2FA and then lose your 2FA, then that’s just life. Happens sometimes and you move on. GitHub absolutely doesn’t need to provide an in-person recovery service.
  - kulahan 1y ago
    Not to mention I’m pretty sure their only physical location you can walk into is in Seattle? Maybe SF?
kramer2718 1y ago
I agree that simply emailing in copies of identity documents after the fact shouldn't be sufficient. However, there should be a verification process that includes verification of identity documents through legal means, including perhaps a processing fee. The fee would preclude many attackers from even trying to break this process. Maybe this would only work for new accounts as you'd probably need to provide identity information on before losing access.

by abxyz 1y ago

joshmn 1y ago

That's the same stance I have and why I'm torn. The little quirk here—where it makes slightly more sense—is that they received a legal notice at one point (from the US Government) about my account, there are plenty of online articles to corroborate me as me, and I have a fancy prison release ID that can help me identify me. Unfortunately this context is probably lost on the individuals who work their Zendesk. The policies are rather draconian as others have mentioned. Anyone could be the victim of theft; mine just has an awkward paper trail attached to it.

abxyz 1y ago
I think the disconnect between you and GitHub support is that you're positioning this as a problem of proving your identity whereas for GitHub support it is a policy. The GitHub policy is: you lose your 2FA, you lose your account. Verifying your identity is not relevant. GitHub provides extensive tooling to protect your account (multiple methods of 2FA, recovery codes etc.) and so from their perspective, while this is deeply unfortunate, the policy is very clear and allowing you access to the account would be a major security issue (not for your account specifically, but for GitHub as an organization). edit: https://docs.github.com/en/site-policy/other-site-policies/github-account-recovery-policy https://docs.github.com/en/site-policy/other-site-policies/g...
- MrGilbert 1y ago
  I'd assume that there is simply no "ok, this individual got released from prison and can proof everything" policy in place, and that might be the real issue here. Big organizations begin to tumble once you request something where there are no policies in place.
- ryandrake 1y ago
  These (for good reason) draconian policies are the reason I am still hesitant to embrace 2FA. I understand the significant improvement in your security posture, and I would not want someone not-me to be able to reset my credentials. But the failure mode is just too catastrophic. You lose one thing and you are shit out of luck. We need something better. I don't know what it would be.
  - alwa 1y ago
    I for one would appreciate the option to put an ID on file ahead of time, at least for important stuff like this. I like digital-only accounts for play, but for work stuff with real-world consequence, I’d like to link it to a real-world identity system… Not unlike the signature cards banks used long ago, I guess. Sure, maybe somebody motivated could defraud the government into issuing them a replacement ID in my name. But that’s big boy crime, not a casual “bribe a retail employee to SIM swap” kind of undertaking. Sure, there are issues of access to government ID systems, and I know anything touching government names / “show me your papers” raises hackers’ hackles—I’m not saying require it, just that I’d choose it if it were a MFA option of last resort.
    - joshmn 1y ago
      > I for one would appreciate the option to put an ID on file ahead of time, at least for important stuff like this. I'm at that point of agreement. I don't want to say "national SSO ID" because that can get really Orwellian obviously. Being able to put an ID on file is a reasonable ask.
      - em-bee 1y ago
hluska 1y ago
I’m not sure that blaming tech support for not understanding context is the best approach here. The other sides of that context, which are understandable from their point of view, is that you were charged with some serious crimes. There’s a large delta between the charges and the conviction, but you’ve got some scary words written about you online. Secondarily, GitHub has policy so whereas you’re coming at it from a position of being correct, they’re in a position where they have to break policy. That’s a big risk. Your best bet would likely be legal. US Federal law imposes some strict rules on lawyers for identity verification to combat money laundering so attorneys have a legally recognized toolkit to verify identity. Having a third party who works for you in the mix could help. Though again, it would involve breaking their policy so this would be a decision made several layers above Zendesk access. Otherwise, I think this is doing precisely what 2FA is meant to do. It’s not okay for you and you’ve clearly lost a lot because of this, but with the current threat environment, GitHub has to be very careful especially with 2FA. From their point of view, there likely isn’t that big of a gap between your interactions and interactions with people who are trying to take over accounts. A lawyer may not work, but it sure changes that equation.
werkwolk 1y ago
Why do I feel most of this is ai created text...whoever is posting will probably adjust their prompt, but who uses '-' mid text?
- lkirkwood 1y ago
  I find this infuriating. I get absolutely no sense that this is AI, and this bizarre attitude towards em dashes is nonsense. Loads of people use them, especially in less formal writing. Get over it.
- bruce511 1y ago
  I do.

Retr0id 1y ago

As a matter of policy, sure. But at the same time, I bet there are some GitHub employees reading this that would be in a position to pull some strings and make an exception. For OP's sake, I hope I'm right!

randunel 1y ago
Social engineering attacks are a thing, you know...
- Retr0id 1y ago
  I'm aware.
- DengistKhan 1y ago
  Also could be a honeypot.

zerr 1y ago

The person should be able to walk in the service provider's office and get an in-person help, restoration of access, by presenting ID docs.

paulcole 1y ago
If you are not European, I will be amazed. If you set up 2FA and then lose your 2FA, then that’s just life. Happens sometimes and you move on. GitHub absolutely doesn’t need to provide an in-person recovery service.
- kulahan 1y ago
  Not to mention I’m pretty sure their only physical location you can walk into is in Seattle? Maybe SF?

kramer2718 1y ago

I agree that simply emailing in copies of identity documents after the fact shouldn't be sufficient. However, there should be a verification process that includes verification of identity documents through legal means, including perhaps a processing fee. The fee would preclude many attackers from even trying to break this process. Maybe this would only work for new accounts as you'd probably need to provide identity information on before losing access.