Update: I freshly reinstalled Phabricator on Ubuntu 14.04, and couldn't reproduce this... but between the three instances there's very little in common. I'd never enabled Almanac stuff before on my other instance, and never on Haskell.org, but those exhibit this bug. A fresh install does not seem to, and there doesn't seem to be a stack trace.

In T9716#143297, @epriestley wrote:

Someone else ran into issues with Rocket Loader too, although everything broke completely for them in Chrome (although fine in Safari).

Hitting this means you have your primary install behind CloudFlare, right? Not just the file domain? Do you have any particular reasons for doing that? I don't normally expect installs to put both domains behind CloudFlare.

Just as a note: I was thinking about this, and in fact, I cooked up a small (untested) patch for it to require Administrators to have MFA (see end of post) through a new setting.

One more vote from Haskell.org: I appreciate all the help in the past, but even then I am also of the opinion you should end the real time support. I think moving to something like a daily queue with Nuance is probably the best bet. I know for a fact we've pinged @epriestley more than once with breaking issues since we kind of live on the edge but for the most part all of our components are now very stable and I doubt they will fundamentally change soon, so we can live with the slight breakages sometimes (with solid backups upon every update of Phabricator).

Yup, confirmed fixed. Thanks again y'all!

Looks like it's fixed, thanks!

The source code for my extension is available here: https://github.com/thoughtpolice/libphutil-yubikey

I'll also note that my perspective is probably somewhat skewed, because I sometimes often jump into high security mode because I use things like Passphrase a lot to manage credentials - so cutting down the time from "take out phone and fiddle with application" to "touch my USB port" is a nice win for me. (For mobile apps, I actually prefer Duo Security since it takes it from "fiddling" to "push notification I confirm from lock screen".)

You do need an API key to talk with their servers - but you can get an API key for free with your Yubikey that allows use of their service as you need. So, the administrator just needs to have a registered Yubikey on their service and request an API token, then configure Phabricator to use it (the extension also adds configuration options into /config to do this properly.) Users don't need to configure anything; they just need a registered key (which it comes with out of the box).

Yup, thanks!

Related, the actual summary the UI box gives me when the exception is thrown is:

That's fine with me. Ideally it would be nice to still fix this, and if we can get by with a hackish libphutil extension, I can live with that. However, I'm assigning this to myself since I may be able to hack something up eventually to support this better (it's been easier than I expected so far to work on Phab, anyway).