Page MenuHomePhabricator
Create Task
Maniphest T278720

2FA reset for User:Techyan
Closed, ResolvedPublic
Actions

Description

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello. This is a PGP signed message with the public key I previously stated on my user page[1] to confirm that I have lost my TOTP 2FA credentials for my Wikimedia account and I need a reset.

An email was sent to ca@wikimedia.org with the same content as this one. 

[1]: https://meta.wikimedia.org/wiki/User:Techyan/PGP
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE9zZREtjcwgSu7SMKjq6EH+bqbS8FAmBiUskACgkQjq6EH+bq
bS/PRRAAnqu7CuIroykktTQYjnPSfeBua1VQXdXvI4ML9B274LklfZKXAIFa94AT
UbtGmmKg/DGKRWfc1jWCfyvvQAt4l+RUMV7l3mckVH2U88vsgfAFsog+2UHuBFd5
67lhEJ31VW1nR7I3e/93nMMFog6YQL2CAUL6h7myb5gvaYgCdXxiOJGP2GK1B13S
suJorKAQSddD8LW34NREJHz3Kcc2NtqeCB+cSrjJtZhvRS7n9XlO75XmrksdOn85
1jD8VfxrJTp7O/SgzFwRDwIn9a7KdFK8eC5/8KgCYdIERs/j5hJ6TBZKZ0TVxd8g
j+TiRUTmcToQ3jiN+IfYUdH0abi6k2ITp89Ka2PYgXXgO40VdXiu98wwJA1KpMeK
APmb/dYqZc7NajfPyTL01w4+MK3HqglUt7wnTxEkWG4E3ASjOgyavl0u7qDoiX1E
jZW1YuiJ19SXvcnARSfL0InG5l9Ca0Q7lyydgUwAMU8964XBTLt/bQx3wTAnK/oC
NqDyjpJirw4hTMND3zHGb7D264GsdbBOaNbidhkCBf72cWTfqO7m/O2EWukDhM/y
Zwv6qI/P1MGRIQUidFNSfp8GuPhxSvsMZQq1AgkdvihI2125UXqm2sLhC187L4pO
vGBpTGH6nBO82B4Ca+DEyjKEzTzKHu+3H1jPKyaJNoWGiUIEgj0=
=1yz5
-----END PGP SIGNATURE-----

Related Objects

Event Timeline

• Techyan created this task.Mar 29 2021, 10:34 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 29 2021, 10:34 PM
• Techyan updated the task description. (Show Details)Mar 29 2021, 10:34 PM
Aklapper added a comment.Mar 30 2021, 6:24 AM

Hi, 2FA reset where? Which website is this about?

Zabe subscribed.Mar 30 2021, 6:41 AM

I‘m not him, but he’s stating in his email above, that he lost 2FA for his wikimedia account.

Urbanecm closed this task as Resolved.Mar 30 2021, 8:51 AM
Urbanecm claimed this task.
Urbanecm subscribed.

Plus one from my side about using a PGP signature for identity validation - it's not common for those requests, sadly.

Message has a valid signature with a key that was pasted by your account 3 months ago (=unlikely an attacker posted it), plus you're logged to a Phabricator account with Techyan Wikimedia SUL account connected => identity validated.

P15090 (An Untitled Masterwork)
1urbanecm@notebook ~/tmp
2$ head key.txt
3-----BEGIN PGP PUBLIC KEY BLOCK-----
4
5xsFNBF4RLGQBEADFXnQFlGDNyR5avRE4GDOj0oEDU7wDPuFFeFAIyj66Zuio2SpZ
6T9akjGRYF3p+ZcyXNwdiKEwsHyJOJwUELC3g+BqIGsrmjiDDL4GM34bnDuguk+1g
7NzZgAwhm3DtLZAeogr6rHsFMzNMFUV4HadEn3dZZcntm48pBwPCw1NkjwEGt4+TO
8ghdNcGPUuR8XtfkT2soONqcKejBOITYF6RCUOX7p/ENEi1jvK10aXsyELWMgKhcY
9VECAAR29BiXFzDZqOsM57C1ucrFC9Z3CGNNpIo/rbYJRi6EW3z1iJ8+QXoMLhCnW
10/aoVYkv1cpSC0DeYTZEAgDpr9ggtsByCwu/NmtR+qAjl877JJYU3/ep0fXJYRVRg
11i4Qabvlcs60y+RrWUdA+R0GwvFcHIu890e11n81Ke5AwNHoxMUih3mBVQH1spOVI
12EfUX6NuDDt67TOoMiP5Zcz1La6ZPvPVn7gAdSjVWcYfBSztkQnXiZ6uy07EJDMix
13urbanecm@notebook ~/tmp
14$ gpg --import key.txt
15gpg: key 8EAE841FE6EA6D2F: public key "Enming Yan <techyan@wmcug.org.cn>" imported
16gpg: Total number processed: 1
17gpg: imported: 1
18urbanecm@notebook ~/tmp
19$ cat > message.txt
20-----BEGIN PGP SIGNED MESSAGE-----
21Hash: SHA256
22
23Hello. This is a PGP signed message with the public key I previously stated on my user page[1] to confirm that I have lost my TOTP 2FA credentials for my Wikimedia account and I need a reset.
24
25An email was sent to ca@wikimedia.org with the same content as this one.
26
27[1]: https://meta.wikimedia.org/wiki/User:Techyan/PGP
28-----BEGIN PGP SIGNATURE-----
29
30iQIzBAEBCAAdFiEE9zZREtjcwgSu7SMKjq6EH+bqbS8FAmBiUskACgkQjq6EH+bq
31bS/PRRAAnqu7CuIroykktTQYjnPSfeBua1VQXdXvI4ML9B274LklfZKXAIFa94AT
32UbtGmmKg/DGKRWfc1jWCfyvvQAt4l+RUMV7l3mckVH2U88vsgfAFsog+2UHuBFd5
3367lhEJ31VW1nR7I3e/93nMMFog6YQL2CAUL6h7myb5gvaYgCdXxiOJGP2GK1B13S
34suJorKAQSddD8LW34NREJHz3Kcc2NtqeCB+cSrjJtZhvRS7n9XlO75XmrksdOn85
351jD8VfxrJTp7O/SgzFwRDwIn9a7KdFK8eC5/8KgCYdIERs/j5hJ6TBZKZ0TVxd8g
36j+TiRUTmcToQ3jiN+IfYUdH0abi6k2ITp89Ka2PYgXXgO40VdXiu98wwJA1KpMeK
37APmb/dYqZc7NajfPyTL01w4+MK3HqglUt7wnTxEkWG4E3ASjOgyavl0u7qDoiX1E
38jZW1YuiJ19SXvcnARSfL0InG5l9Ca0Q7lyydgUwAMU8964XBTLt/bQx3wTAnK/oC
39NqDyjpJirw4hTMND3zHGb7D264GsdbBOaNbidhkCBf72cWTfqO7m/O2EWukDhM/y
40Zwv6qI/P1MGRIQUidFNSfp8GuPhxSvsMZQq1AgkdvihI2125UXqm2sLhC187L4pO
41vGBpTGH6nBO82B4Ca+DEyjKEzTzKHu+3H1jPKyaJNoWGiUIEgj0=
42=1yz5
43-----END PGP SIGNATURE-----
44urbanecm@notebook ~/tmp
45$ gpg --verify message.txt
46gpg: Signature made Tue 30 Mar 2021 12:20:57 AM CEST
47gpg: using RSA key F7365112D8DCC204AEED230A8EAE841FE6EA6D2F
48gpg: checking the trustdb
49gpg: marginals needed: 3 completes needed: 1 trust model: pgp
50gpg: depth: 0 valid: 2 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 2u
51gpg: depth: 1 valid: 1 signed: 0 trust: 1-, 0q, 0n, 0m, 0f, 0u
52gpg: next trustdb check due at 2021-07-17
53gpg: Good signature from "Enming Yan <techyan@wmcug.org.cn>" [unknown]
54gpg: aka "Enming Yan <me@yanenming.com>" [unknown]
55gpg: aka "Techyan <techyan.unblock-zh@wmcug.org.cn>" [unknown]
56gpg: WARNING: This key is not certified with a trusted signature!
57gpg: There is no indication that the signature belongs to the owner.
58Primary key fingerprint: F736 5112 D8DC C204 AEED 230A 8EAE 841F E6EA 6D2F
59urbanecm@notebook ~/tmp
60$

2FA was disabled on your account:

10:50, 30 March 2021 Martin Urbanec disabled the two-factor authentication of User:Techyan (per phab:T278720)

Please feel free to reopen if there's anything else to do.

Restricted Application added a project: User-Urbanecm. · View Herald TranscriptMar 30 2021, 8:51 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL