Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


DigitalOcean quietly enabled 2FA behind your back: lose a domain? lose your DO account - Page 6
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

DigitalOcean quietly enabled 2FA behind your back: lose a domain? lose your DO account

12346

Comments

  • @Ole_Juul said:

    rm_ said: I'm not sure how this question came up to you from this thread. My E-Mail was not and is not hosted at DO. But if this is just something unrelated you wanted to ask, then I doubt many people would actually do that.

    Didn't you say, or imply that, somewhere at the beginning here? Perhaps I'm confused.

    No. He said he stopped hosting mail for the domain, and then bitched that it wanted him to answer a security answer that was sent over SMTP.

    /thread

    Thanked by 3Lee Ole_Juul Aidan
  • williewillie Member
    edited February 2018

    doghouch said: it’s not DigitalOcean’s fault that rm_ messed up his email.

    I don't see any relevance to how the email got messed up or whose fault it was. Email gets messed up sometimes. rm_'s got messed up and then fixed, which is all anyone can really ask for. The question is whether rm_ and/or DO are acting unreasonably after the fix. As far I can tell, rm_'s view is that DO is busted since its web UI won't automatically send a new token to the now-fixed email. My view is that the UI has an imperfection because of this, but it falls short of DO being busted because there's a natural workaround which is submit a ticket. So unless I'm missing something rm_ is being unreasonable in not being willing to use the workaround.

    doghouch said: The biggest question is: who with the right mind sets the billing email to the same company that hosts the email? It just doesn’t make any sense.

    I missed that part, but it doesn't seem bad to me. My email is with Fastmail and I use it as my billing address including for Fastmail, so I get stuff like Fastmail renewal notifications at my Fastmail inbox which is where I want them. If something happened to my access I'd have to contact their support, but unlike rm_ I don't object to doing that. (Added: I remember now I have a backup address on file with them, but that's not the billing address. Otherwise they have other points of contact like my phone number).

  • rm_rm_ IPv6 Advocate, Veteran
    edited February 2018

    Ole_Juul said: Didn't you say, or imply that, somewhere at the beginning here?

    You could re-read everything I said and then quote the part which gave that impression, I can clarify it.

    Perhaps the bit about DO's DNS caches? It was about my guess that their sending mailserver doesn't retry sending verification because it has remembered the bogus MX record which was on my domain (basically pointing to nowhere) far beyond the 10 minute TTL that it had, and didn't refresh its cache from the actual records on the domain, which had proper MXes reinstated long since then.

    But as it turned out later that was not the reason, the problem is that it just doesn't retry at all, no matter what.

  • deankdeank Member, Troll

    Not sure whether this was asked. Have you contacted them?

  • rm_ said:

    I know I can probably do that, but I'm not sure what sort of hoops they will want me to go through, to have the access restored. Sending scans of my documents showing real name? Proof of address? Phone number for SMS verification? Who knows.

    Those are reasonable concerns, but I don't think it's valid to present them as objections unless they actually happen. Why don't you open a ticket saying you didn't get the 6 digit code because your email address was temporarily not working, but it's now fixed and you'd like to request another one. If they ask you for stuff like passport scans at that point, then post a complaint here.

  • rm_rm_ IPv6 Advocate, Veteran
    edited February 2018

    WSS said: and then bitched that it wanted him to answer a security answer that was sent over SMTP.

    Well, at first that was it, and it was only a mild annoyance -- "Oh, I have to reconfigure my mail again" -- at that point I didn't imagine their system is so borked that it won't even help.

    willie said: Why don't you open a ticket

    I see your point and I will do so if I will have a really urgent need to have that account back. For now I can live with the fact that they locked me out on a whim, know about brokenness of the system which did that, and proceed to do nothing to fix it. After all there are many other and better providers around, I think I'll somehow manage.

  • LeeLee Veteran

    So after 4 pages.

    @Jarland has offered to help, you seem unwilling to accept. He appeared to suggest he could override whatever it is stopping the code being sent again.

    You don't know what the requirements are to get this sorted without @Jarland help as you seem unwilling to email DO because they may ask for things you don't want to provide, but you don't know that.

    I am certain this could easily have been resolved by now, but you don't want that do you? This is not really about you wanting to have access again, is it?

    You just wanted this thread. Nothing more.

    Thanked by 1file
  • rm_ said: my guess that their sending mailserver doesn't retry sending verification because it has remembered the bogus MX record which was on my domain (basically pointing to nowhere) far beyond the 10 minute TTL

    It might have tried, retried, and given up, all within the 10 minute TTL.

  • rm_ said: You could re-read everything I said and then quote the part which gave that impression, I can clarify it.

    Re-read the whole thing?!!

    No problem though - It's OK because @WSS was kind enough to answer my question up above.

  • rm_rm_ IPv6 Advocate, Veteran

    Lee said: I am certain this could easily have been resolved by now, but you don't want that do you? This is not really about you wanting to have access again, is it?

    Repeating from previous page:

    rm_ said: what's more important than my particular account, is to point out a bad practice being conducted by a provider, and hopefully try to influence them to have this fixed. BTW I'm glad that there are people in this thread who understood what the problem is, and agree that it is a bug to be fixed.

    And if you re-read the first post, it is a reminder to people to recheck what E-Mail address they have at DO, and that if it stops working at some point, they can lose the ability to login to even change it -- a very uncommon practice across VPS/dedi providers in general.

  • deankdeank Member, Troll

    So..., what's this thread about? Not contacting DO and just literally "bitching"?

  • @deank said:
    So..., what's this thread about? Not contacting DO and just literally "bitching"?

    "I stopped accepting email for this domain and they wanted me to prove my login, since I haven't used it in awhile!!!1!"11o1

  • @rm_ My apologies for the mistake. Still, you should accept @jarland’s help so you can get access back to your account.

  • @WSS said:

    @deank said:
    So..., what's this thread about? Not contacting DO and just literally "bitching"?

    "I stopped accepting email for this domain and they wanted me to prove my login, since I haven't used it in awhile!!!1!"11o1

    This is a good point. Many companies deactivate accounts which are dorment for security. More important for stuff that could contain billing info.

  • @joepie91 said:
    (Also, it's not really 2FA; for something to be true 2FA, it has to require compromising a different system from the one you're logging into, and that's not the case for verification e-mails. Not that it's not useful, but it's not 2FA.)

    Many sites include "email" in their definition of the 2nd factor.

    Thanked by 1rm_
  • While looking into this thread an reading the many reactions above. My judgement about 2FA at DigitalOcean the should use a 4 / 6 digit pin that the user can enable from their client settings. instead of forcing this policy to enable it on all accounts.
    However you should contact them regarding your failing to login due to their policy on the 2FA side.

    Also about the cache of their nameservers this can vary from an hour to a couple of days.
    All depends on their configuration.

  • For the third time - if you contacted support, you'd (usually) have this resolved within a couple of hours.

    Thanked by 2Clouvider Rhys
  • rm_rm_ IPv6 Advocate, Veteran

    Aidan said: For the third time - if you contacted support, you'd (usually) have this resolved within a couple of hours.

    Repeating "for the third time" something that's been already answered twice just feels like a rude thing to do in a conversation. Should I answer to you personally "for the third time", or how about you scroll up and read this or that instead.

    It's not about me or my account, it's about DO, I prefer to leave the account as is for now, as a bonus I am able to re-check at any time if they have fixed the problem via implementing unconditional retries for verification, or if the system is still broken.

  • @rm_ said:

    Aidan said: For the third time - if you contacted support, you'd (usually) have this resolved within a couple of hours.

    Repeating "for the third time" something that's been already answered twice just feels like a rude thing to do in a conversation. Should I answer to you personally "for the third time", or how about you scroll up and read this or that instead.

    It's not about me or my account, it's about DO, I prefer to leave the account as is for now, as a bonus I am able to re-check at any time if they have fixed the problem via implementing unconditional retries for verification, or if the system is still broken.

    You're really hopeless.

  • rm_rm_ IPv6 Advocate, Veteran

    Aidan said: You're really hopeless.

    ^ let's all thank the above post now. Mr. Aidan is thanking my posts all the time, it's finally time to give back.

  • ClouviderClouvider Member, Patron Provider

    @rm_ said:

    Aidan said: You're really hopeless.

    ^ let's all thank the above post now. Mr. Aidan is thanking my posts all the time, it's finally time to give back.

    ^ Someone has quite a bit of growing up to do.

    Thanked by 2rm_ Aidan
  • @Clouvider said:

    @rm_ said:

    Aidan said: You're really hopeless.

    ^ let's all thank the above post now. Mr. Aidan is thanking my posts all the time, it's finally time to give back.

    ^ Someone has quite a bit of growing up to do.

    ^ Someone has yet to find a way into my wallet.

    Thanked by 1Clouvider
  • ClouviderClouvider Member, Patron Provider

    @WSS said:

    @Clouvider said:

    @rm_ said:

    Aidan said: You're really hopeless.

    ^ let's all thank the above post now. Mr. Aidan is thanking my posts all the time, it's finally time to give back.

    ^ Someone has quite a bit of growing up to do.

    ^ Someone has yet to find a way into my wallet.

    ^ Someone already works on it :)

    Thanked by 1WSS
  • DewlanceVPSDewlanceVPS Member, Patron Provider

    If You can't login to DO and using fake name then you can take a backup of VPS from SSH and move data or do not revoke paypal subscription else you will lose your VPS.

  • @DewlanceVPS said:
    If You can't login to DO and using fake name then you can take a backup of VPS from SSH and move data or do not revoke paypal subscription else you will lose your VPS.

    Sound advice.

    Thanked by 1doghouch
  • @Nekki said:

    @DewlanceVPS said:
    If You can't login to DO and using fake name then you can take a backup of VPS from SSH and move data or do not revoke paypal subscription else you will lose your VPS.

    Sound advice.

    Bozo 2.0.

  • @doghouch said:

    @Nekki said:

    @DewlanceVPS said:
    If You can't login to DO and using fake name then you can take a backup of VPS from SSH and move data or do not revoke paypal subscription else you will lose your VPS.

    Sound advice.

    Bozo 2.0.

    Careful, that’ll be trademarked along with AutoBoot.

    Thanked by 1lbft
  • @Nekki Unfortunately, AutoBoot has been discontinued as of... err, sometime in 2015.

  • @doghouch said:
    @Nekki Unfortunately, AutoBoot has been discontinued as of... err, sometime in 2015.

    Heart-breaking news. True innovation that never received the attention it deserved.

  • Sad, but I had to Google "autoboot" to see if you guys were serious. :( I've never encountered a system that didn't boot by itself when turned on, so I thought you were joking. But it seems that there are actually people out there who use the word to refer to starting a program automatically at boot time. (eg autoexec.bat) It seems we have a newfangled definition of "boot".

Sign In or Register to comment.