1500739 - Lost the access to Firefox Account+2FA and hence unable to login

Status: RESOLVED WONTFIX

(Cloud Services :: Server: Firefox Accounts, defect)

Description

[Roshan Gautam]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:62.0) Gecko/20100101 Firefox/62.0

Steps to reproduce:

I tried logging in with my Firefox Account.


Actual results:

I am not able to log in because I lost access to 2FA. I don't have recovery codes either.


Expected results:

I should have been able to login with my Firefox Account. I want to request you to reset ma 2FA settings for my account - [e-mail]

Comment 1

[Henrik Mitsch [:hmitsch]]

Dear Firefox Accounts Folks,

this is an interesting case. Bug 1498543 was a Mozilla IAM support case: We had to remove FxA from Roshan's profile in order to allow him to get back into our systems using his Github+2FA identity provider.

This means we verified that [e-mail] actually belongs to Roshan. He has a FxA+2FA and a Github+2FA identity on this email.

Is this proof enough to remove 2FA from his FxA account to allow him to recover his account?

Best regards,
   Henrik

Comment 2

[Ryan Kelly [:rfkelly]]

> This means we verified that [e-mail] actually belongs to Roshan.

Out of curiosity, how was this verification achieved?

> Is this proof enough to remove 2FA from his FxA account to allow him to recover his account?

Our current position is that there is no level of verification that would suffice to remove 2FA from a user's account, but this is clearly going to keep coming up.  I would consider allowing him to delete and re-create the account after some amount of manual verification; +:adavis and :ulfr for further comment.

Comment 3

[Henrik Mitsch [:hmitsch]]

Hi Ryan,

> Out of curiosity, how was this verification achieved?

Sorry for not providing enough context.

In Mozilla IAM, we can see authentication providers somebody used in the Auth0 records. Simplified, this would look like this:

[e-mail]    LDAP
[e-mail]    Github

In Roshan's case we had [e-mail] with FxA and Github providers. In Bug 1498543 :kang removed the FxA identity, in order to allow Roshan to use Github for login to Mozilla IAM site (e.g Reps Portal, Mozillians, etc).

As we know that [e-mail] uses 2FA via Github, we have strong indications that his gmail account was not compromised and that it is actually Roshan on the other end of the keyboard (I am sure kang could say this in more IT security appropriate language).

Maybe this is enough "manual verification" in order for you to enter that "delete & re-create account" scenario?

I am aware that I project a lot of details from the IAM Stack into this message. I am also happy to jump on a call and show how things work via some screenshares?

Best regards,
   Henrik

Comment 4

[Julien Vehent]

> Our current position is that there is no level of verification that would suffice to remove 2FA from a user's account, but this is clearly going to keep coming up. 

I still believe this is the right approach. FxA is a security service and we need to be extra careful about being socially engineered. Regardless of the number of factors, it is the user's responsibility to keep their mean of authentication securely.

Comment 5

[Henrik Mitsch [:hmitsch]]

Hi Julien,

thanks for the comment. I see your point and agree with it.

I guess this means the user has to create a new Firefox Account (and store the recovery key for future use, https://accounts.firefox.com/settings/account_recovery?showAccountRecovery).

Sorry Roshan we couldn't help more in recovering your account. Closing bug.

Best regards,
   Henrik

Comment 6

[Roshan Gautam]

Okay.
Thanks all of you for your time.

Comment 7

[narenadusumilli]

Have a similar situation,lost 2fa and recovery key.Have my password intact.Trying to get code to my recovery email using the above link,but not getting any codes.Please help