@Barek Thanks for reporting this. Yes, it's possible to reset the second factor as long as there is a proof the request is legitimate.

We need to assert your request is from the same user Barek who contribute to Wikipedia and not from someone stealing the account. That's the goal of the two factor authentication.

For that, we have several possibilities. Let's try one of the simplest and more straightforward:

Do you have a static IP address (or a dynamic address with very long life duration)? If so, do you agree we request to a steward a checkuser to authenticate the message on the village pump is from the same IP used for contributions? That would be an acceptable proof of identity.

@Dereckson My IP is dynamic; but frequently remains stable for months at a time. I fully support the use of a steward request for a checkuser to authenticate my identity. If needed, the email linked to my user account can also be contacted to request agreement of a checkuser.

Thank you for assisting me in this issue.

Thanks for the suggestion and the approval of the CU request.

The global account has a mail address, confirmed before this request. Confirmation mail sent.

Althrough this seems to be legitimate request, I'm pretty sure SuSa should be at least aware if not explicitelly approve. But up to you @Dereckson ;).

Per https://wikitech.wikimedia.org/wiki/Password_reset, they indeed need to be made aware of a security-related account change: "someone from Trust & Safety (for example James Alexander) should be notified of the password reset". By analogy, it's certainly applies to 2FA reset requests.

They can also help for more complicated cases: "It might also be a good idea to pass things to them if there is no sufficient elements to confirm the identity."

So my intent was and is to handle this request as long as there are sufficient elements to confirm the identity,

Mentioned in SAL (#wikimedia-operations) [2018-04-07T23:44:27Z] <Dereckson> OATHAuth disabled for Wikimedia SUL global account Barek (T191708)

@Barek It should now be disabled, could you confirm it works?

@Dereckson Thank you, I can confirm it was disabled. I can now log in again from my phone. I will re-enable 2FA later tonight (and this time lock the hard-copy code into a file cabinet or lock box to be sure it isn't lost).