Phabricator/Help/Two-factor Authentication Resets

Phabricator allows multi-factor authentication to protect your account in the event that your password is compromised. Wikimedia's Phabricator instance uses Time-based One-Time Passwords using an open standard which integrates with several mobile applications such as Google Authenticator or Authy.

If you use multi-factor authentication and ever lose your access, you must have put your user committed identity hash on your wiki user page at least one month before requesting a multi-factor authentication reset following the instructions below, otherwise you may never be able to recover your account.

Phabricator does not offers backup codes for multi-factor authentication. If you lose access to your second-factor device, you will permanently lose access to your Phabricator account unless you can complete the reset instructions below. You cannot complete the instructions below unless you have had a committed identity hash on your Wikimedia wiki user page for more than one month.

Steps to request a multi-factor authentication reset

 * Make sure that your user committed identity hash has been on your wiki user page for more than a month
 * Go to https://phabricator.wikimedia.org/paste/create/
 * Click on "Visible To: Public (No Login Required)"
 * Click "Custom Policy" in the dropdown
 * Under "Allow users", enter the following user names: Aklapper, chasemp, demon
 * Click "Save Policy"
 * Click on "Editable By: All Users"
 * Click "Custom Policy" in the dropdown
 * Under "Allow users", enter the following user names: Aklapper, chasemp, demon
 * Click "Save Policy"
 * Paste your text phrase
 * Click "Create Paste"
 * Check the number of the paste that you created (it starts with P)
 * create a task in Phabricator against the 'Phabricator' project
 * Include the P number in the task
 * Include a link to the change of your user page when you added the user committed identity on your wiki user page
 * Let a Phabricator admin compare your text phrase in your Paste with the user committed identity hash on your wiki user page (via sha512sum), and the date of your wiki user page edit
 * Let a Phabricator admin with shell access reset your access