Dear and beloved Fedi friends,
I would love your input on something:
Problem:
Right now, the account recovery flow on Mastodon has some issues. Imagine this scenario: an account has 2FA setup and the owner contacts the admins/mods through e-mail, that they have lost access to the 2FA app and requesting disabling it.
We do not keep logs, nor do we retain IP addresses. So, the problem here is that if the mailbox was breached, we can either help with the recovery (not knowing the request is not legit) or we can refuse to help with the recovery.
Possible solution:
It wouldn't be that much trouble to add some custom fields to the account page, where the account holder can fill in their wish as to how to verify such a request (think something like alternative means of contact, some signing key, etc).
Question:
Should I implement this (and trying to upstream it with a PR) or just put a policy in place like "your account security is your responsibility, can't help you if you lose access to your MFA"?