What bothers me a bit about this whole thing is that I get deactivating inactive Accounts, say maybe a couple years inactive, but it would have been nice for the deactivation email to spell out that it's being done to force 2FA for dormant accounts, as for all apparently this is why that's being done. I don't recall seeing any email indicating that accounts on Gitlab would be requiring 2FA, although I could've missed that.
On Mon, Oct 24, 2022, 12:45 PM Nekobit <me@xxxxxxxxxxxxxx> wrote:
On Mon, 2022-10-24 at 15:37 +0100, Paul Dann wrote:
> On Mon, 24 Oct 2022 at 11:16, Norbert Zawodsky <norbert@xxxxxxxxxxx>
> wrote:
> > Am 24.10.22 11:02 schrieb René J.V. Bertin:
> >
> > > I hate 2FA as it incites too much to remain logged in (and to be
> > > married to a mobile if not recent enough smartphone).
> > >
>
> The same thing just happened to me. I use KeePassXC already, which
> has OTP support. It's pretty much 3 clicks to add a 2FA token, and
> it's a desktop app. I happen to sync it with the mobile app via
> NextCloud, but it's certainly not required.
>
> 2FA really is not hard to set up, and significantly reduces identity
> theft. I get that it's not convenient for everyone, but it's a 10min
> up-front investment to get something like KeePassXC set up to handle
> all this simply.
>
> Paul
It's not just about setting it up, I only got 2 days warning about
this, and I'm in a bit of a crunch to setup a proper client on my
mobile device right now. I also can't find a thing for OTP in
KeepassXC, and I keep 2 copies of my clients in an ugly manner between
my desktop and laptop so I'd rather do mobile, but there may be times
where my mobile device _breaks_ or something, so I don't always like
storing such things on mobile...
I don't really think the execution of this was done well. I am
confident enough with a pretty secure password generated with
KeepassXC, to not think I need 2FA this instant.
