Hacker News Reader

Comment by K0nserv | Hacker News Reader

There was a discussion about the topic of MFA resets on the Risky Business podcast[0] in which the host, Patrick Gray, suggested companies require a one time fee for MFA resets. I think the suggested amount in the show was $50 which seems reasonable enough for western markets. It creates a deterrent for attackers and in the case of free products like GitLab allows the support costs to be covered. Additionally the act of payment itself can help prove identity.

0: https://risky.biz/soapbox43/

View on HN

That's an interesting approach. It incentivizes users to have a backup plan while also providing an escape hatch if things go wrong. The only issue is, like you alluded to, this could price out a large portion of the world's developer population. Perhaps the price could be determined by where you are in the world, although this may not cover US support costs. That and users could attempt to game the system by faking their location. Regardless, it's an interesting approach I hadn't considered before - I like it.

This doesn't really solve the problem causing GitLab to enforce this change; I highly doubt the cost of providing support to users for MFA had any bearing on this discussion.

Meanwhile, Gray's suggestion would provide any attacker within enough capital to a backdoor, while legitimate users need to pay to unlock their account without any benefit to them from a security perspective.

I strongly disagree with such a concept -- unless, as you mentioned, payment could be used to verify the identity. That said, I think that's the same reason GitLab is now only offering MFA for paying customers, because they have a bit more PII to confirm your identity if you're a current customer -- in which case, why require payment at all?

So, not only are developers working on open source projects in their free time expected to maintain and provide support for free, they're now also expected to pay in order to provide baseline security for their users?

If NPM or any other package repository introduced this, do you think maintainers of commonly used open source projects wouldn't feel obliged to pay up? Generally immediately after a traumatic event such as having their phone stolen.

Even if you never plan to update your package, you can't fix a security vulnerability without spending money.

Don’t lose your recovery codes and you should be fine, right?

Yeah, sure, set up a recovery process I don't need anywhere else in life and hope I never mess that up. Then have several thousand people (or far more if I'm lucky) rely on it, I'm sure that'll go well!

I don't need recovery codes for anything in my professional nor personal life outside open source programming.

I don't think that's true though. I have recovery codes for my MFA for Azure, Google, Fastmail, and many others. I'm wouldn't count on being able to convince support to let me into any of these accounts if I lost my MFA and my backups. They might, but as the article mentioned it'd be hard to do in a way that doesn't defeat the purpose of MFA in the first place.

You don’t have any other MFAs you need to manage in your digital life? That seems ... odd. It seems like you’re deciding to make an issue of, well, how MFA is _supposed_ to work.

I have other MFAs, but they all have real-world recovery routes.

I wonder if it might bias the reset request.

Sort of like "If this person is paying for this, he's probably legit."

Reply on news.ycombinator.com