CircleCI trusts 8 analytics companies with your source code and API tokens

Re:CircleCI trusts 8 analytics companies with your source co... by koolba on Tuesday October 10, 2017 @01:32PM (#15443667)

Perhaps I could have phrased it better. I meant don't let me disable 2FA without first authenticating using 2FA. So ignore any emails to support, 2FA reset links, secret questions, pleas for help, and anything else that would have you think that I no longer have access to my 2FA device and backup codes.

Changing devices is allowed but to do so I would authenticate using my password + 2FA prior to doing so.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by mioelnir on Tuesday October 10, 2017 @11:46PM (#15447137)

Another option would be to make it an easily abortable multi-step process with a long delay timer, ie. you disable 2FA and an abortable 3-4 day timer starts ticking with frequent reminder mails inbetween. Once the timer is done, you can confirm the deactivation.

Video games have been doing similar things for character deletion for years, yet it is rarely if ever found for account credentials in general.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by aoeusnth1 on Wednesday October 11, 2017 @06:21AM (#15448567)

Good point, this is a nice usability compromise between completely insecure, and very strict.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by AgentME on Tuesday October 10, 2017 @02:56PM (#15444373)

What happens if you lose your phone one day?

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by makapuf on Tuesday October 10, 2017 @03:07PM (#15444468)

See the comment about backup codes. You can often have some tokens just in case.

[ Parent | on HN ]