This is via discussion on IRC, but the request captures it pretty well.

This effects me too, I'm on a freshly installed Ubuntu 15.10 server. On master:

We can't reproduce any of this and no other users have reported similar issues. Some of the issues described here are likely access/permissions issues, which should be communicated more clearly after D15079 / D15080.

See Planning.

Are there any plans already for implementing this feature some time soon?

I'd be fine with exposing this information from some bin/auth help me with computer since anyone with CLI access has other means available to read email addresses, but we don't currently have such a command and I don't think there are any adjacent requests to motivate building one.

This is straightforward, but I'm hesitant about it because users can use email addresses to log in, and we do not currently expose email addresses to administrators. Adding this information to the activity log could reveal lots of near-misses of email addresses. While providing this information would help administrators with users who are extremely creative in their use of computers, it seems slightly worse for the bulk of normal users from a privacy/security point of view.

Resolved by D14823.

@chad.Thank you so much for your response.Actually the problem that I am facing for "Install Pygments to Improve Syntax Highlighting"
I install Pygments using comand "sudo apt-get install python-pygments"
Now i have enable pygments.enabled configuration option.So,Please Let me know how can i enable it?
Unable to get configuraton file.

Here's a tentative plan for this:

@Suhasini_thakur The message tells you how to fix it. Did you attempt to follow the instructions it provided?

Phabricator is installed properly.But after installation it shows some error in mysql.

http://www.tecmint.com/install-phabricator-in-linux/ should not be followed. It is an out of date guide. We only support installing from our guide.

I created user from browser but it was not working then i created user from command line with another user.

I have installed phabricator from https://secure.phabricator.com/book/phabricator/article/installation_guide/ and www.tecmint.com/install-phabricator-in-linux/
I did not create any user from terminal before visiting it in the browser.I created user from browser but it was not working then i created user from command line with another user.
Please let me know about this.

How did you install Phabricator? Did you create a user from the command line before visiting it in the browser?

Hello,
I have installed Phabricator on ubuntu 14.04.But when I enter phabricator.domain.com,it shows an authentication error "Authentication Failure
This Phabricator install is not configured with any enabled authentication providers which can be used to log in. If you have accidentally locked yourself out by disabling all providers, you can use phabricator/bin/auth recover <username> to recover access to an administrative account."

(The first change attached here was the instance sync change.)

This was easier than I thought and now in HEAD. Should go out Saturday unless churn related to T9905 makes me uneasy about promoting to stable -- I'm currently feeling good about promoting, but still have three full days to mangle master.

Thanks for the workaround!

In T9967#148569, @epriestley wrote:

Do you have the public key (or the private key), or do you just know which user has a compromised key but not know which key is compromised?

That is, which of these commands would you be able to run if they were available?

./bin/auth revoke-public-key /path/to/compromised_public_key.pub
./bin/auth revoke-private-key /path/to/compromised_private_key.key
./bin/auth revoke-all-keys-for-user username

The @local part is because I have cluster.instance configured locally, it's normal for it to not be present on regular installs.

I haven't been able to trace the cause of the issue, but I do have something to add:

There shouldn't be any caches.

I don't see any way in the code that it can possibly render src="PHID-FILE-...", am I misunderstanding?

Ah, please ignore my comment about the src, it was misinformed.

I can't reproduce that. Here's what I did:

Minor issue still present. On the "confirm registration" page, the image shown is still a blank one. (Inspecting the element in browser shows its src = PHID-FILE...)

Thanks for the exceptionally clear report

☺

This should be fixed in HEAD. Thanks for the exceptionally clear report, and let us know if you run into anything else.

The onscreen instructions for this adapter in the UI are also a bit out of date because the Google console has been updated since we wrote them. This is probably the next change to touch the provider, and should also look at modernizing the instructions.

The UI instructions about navigating the dashboard are also a little out of date since that UI has changed, although I was still mostly able to figure out what they meant. I'll leave a note on T5591 to update them when that gets fixed.

See also T9515 and T7639 for "choose some other users to trust, if you lose your phone they can vote to strip your MFA".

Aaah! That makes sense.

@epriestley: The main motivation was that we had been maintaining these as cherry-picked patches on top of phabricator core, which required constant rebasing. It was ridiculous and not even necessary. Eventually I figured out that phabricator doesn't care if the auth providers live in an external library. I sure wish I'd figured that out in the beginning, it would have made things a lot easier ;)

This report doesn't appear to describe a specific problem.

As a general note, Azure appears to have both SAML and OAuth flavors. D10297 / D10289 implement the OAuth flavors, and don't invoke the messy SAML problem. I'm not sure if these providers are equivalent or not.

Current state of the world is:

That worked for now -- hacky, but thanks.

You can manually update phabricator_user.user_externalaccount to change the external account ID reference.

The workaround I provided in the task description ("If you click the "refresh" icon next to the Google provider, you can add a second account.") no longer works after D14319.

If you have long-term local access to a user's machine and can install a keylogger, you can just steal the session cookie. Being able to establish a second session instead of stealing the first session cookie is not a meaningful escalation.

I for-see what @revi stated above as a pretty plausible scenario, even the looking over someones shoulder is a plausible scenario.

Not sure if this is a possible/practical scenario... but

(HTTP over public wireless has those properties, but using MFA and not using HTTPS is silly and the lack of HTTPS is a far greater problem than the larger MFA vulnerability window.)

could MITM the connection between the verifier and prover

Now that I think about this for a bit more there is a security concern here: In given two-factor authentication context, an attacker could MITM the connection between the verifier and prover, obtain the authentication credentials & a single OTP value, and then log in with these credentials within the current time step. This would allow for a second authenticated login, in sudo mode. I initially didn't think of this concern since the attacker can race, but in this case the new connection is created silently.

There are some attacks that could be performed on such MFA schemes but that are not applicable in phabricator's security model.