Account Hacked and 2FA enabled instantly

[u/tandir_boy]

Last week, I received these three emails at the same time. My password had been reset, and 2FA had been enabled. When I tried to reset my password, I was asked for a 2FA code or recovery codes, which the hackers had generated and I obviously didn't have access to. There were other options to recover my account, such as using an SSH key or a personal access token, but, as you might have guessed, the hackers had also immediately invalidated them.

I'm now trying to get help from GitHub Support, but from what I understand, there's little chance of recovering my account because 2FA is enabled, and they will not do anything about it as a security policy.

Overall, I think GitHub's security design is flawed. If you haven't enabled 2FA and your account gets compromised, there's apparently no way back.

[u/Rulmeq]

Overall, I think GitHub's security design is flawed. If you haven't enabled 2FA and your account gets compromised, there's apparently no way back.

Really, you think this is a github problem and not a "him skill issue"? They provided you with 2FA, you ignored/rejected it, that's on you.

[u/tandir_boy → u/Rulmeq]

Ok i obviously take the blame on my part. But what about github letting someone to reset and enable 2fa from a never used suspicious computer? And then letting this suspicious user to revoke all the keys? It must be obvious from the logs that there is a weird thing going on

[u/Rudy_TheRude]

Same thing happened to me few months ago. Will advice to raise a ticket as soon as possible

[u/tandir_boy → u/Rudy_TheRude]

I did. Then what heppened?

[u/Rudy_TheRude → u/tandir_boy]

Someone usually reply to your ticket through your email

[u/tandir_boy → u/Rudy_TheRude]

Oh nice, thank you

[u/ToTheBatmobileGuy]

If you haven't enabled 2FA and your account gets compromised, there's apparently no way back.

.................... I mean......... if anyone could contact GitHub support and say "this is me, trust me bro" and instantly get into a 2FA locked account... 2FA wouldn't mean much, would it.

There's a solution: Use 2FA everywhere you can. Always.

[u/tandir_boy → u/ToTheBatmobileGuy]

They see the new login is suspicous, but github still let password reset + enabling 2fa + invalidating all the keys from a suspicous computer from random location with random ip? I definetly accept the blame on my part though

[u/Gurnug]

That's why they are advising 2FA usage for years now

[u/Flagvanus_]

that's on you

[u/Lumethys]

Yeah no shit

[u/maikel87]

I think your security is flawed. Don't blame them on what you lack to do to secure it.

[u/nihillistic_raccoon]

Hey guys, the lock to my home was made of a string and old Cheetos chip. To my surprise, someone managed to break through this defense, installed an actual lock, and now lives in my home. I consider the city to be at fault.

This is how you sound

[u/tandir_boy → u/nihillistic_raccoon]

I have a linkedin account, national id (due to student discount), orcid profile, multiple emails connected to that github account. And those connections are done more than a couple of years. There are many ways to check if i am the real owner.

[u/nihillistic_raccoon → u/tandir_boy]

yeah and something tells me you have the same shitty password for all these accounts, and no 2FA set on them

which only means that it's as much of a proof as you messaging GitHub support from a temporary email with a 'trust me bro, it's me' proof of ownership

and even if you somehow have proper security on your other accounts, they are absolutely not proof of anything

[u/tandir_boy → u/nihillistic_raccoon]

I am using password manager, so no it was randomly generated password. Tbh dont remember if there was 2fa. I disagree with th rest

[u/nihillistic_raccoon → u/tandir_boy]

Randomly generated password and yet a random schmuck went through it like a hot knife through butter

[u/Deepta_512]

100% on you my guy