Post #3923632
2026-07-19 00:42 UTC
TIL: if you lost your 2fa (e.g. new phone) for gitlab and don't have recovery codes but your ssh keys still work you can generate new ones via SSH: `ssh git@gitlab.com 2fa_recovery_codes`
Replies (5)
-
@womble@infosec.exchange 2026-07-19 02:58
@wirepair@mastodon.social I have no words...
-
@bradlarsen@infosec.exchange 2026-07-19 03:40
@wirepair@mastodon.social is any additional auth needed? Or does this mean an ssh private key can be used to effectively bypass 2fa (by generating new recovery codes)??
-
@scottley@infosec.exchange 2026-07-19 03:45
@wirepair@mastodon.social so 1fa codes...
-
@thepwnicorn@infosec.exchange 2026-07-19 05:11
@wirepair@mastodon.social Uh, that does not seem in the spirit of 2FA. Then again you can also add additional 2FA devices to admin accounts without additional authentication even when admin mode enforcement is active.
-
@simonzerafa@infosec.exchange 2026-07-19 05:43
@wirepair@mastodon.social That really doesn't seem like it's a good idea 🤔🤷♂️ Secure offline backup of 2FA codes and recovery keys might be a better solution 🙂