好像是在 Hacker News 的首頁上看到的，GitLab 宣佈他們的服務將不提供免費使用者 2FA reset：「GitLab Support is no longer processing MFA resets for free users」，對應的討論串在「Gitlab Support is no longer processing MFA resets for free users (gitlab.com)」這邊可以看到。
官方的公告，從今年的 8/15 開始就不再提供 reset：
As of Aug. 15th, 2020, GitLab Support will no longer process MFA resets for free accounts.
這反而是鼓勵使用者不要開啟 2FA，在討論裡面有人就講到這件事情，這個方法讓設定 2FA 的人受到處罰：
Think about the psychology of what you are telling people: "You have two choices - one is normal security, which you use on 80%+ of the rest of the internet, and one is 2fa which you only use on the annoying services that badger you into it. On the first one, if you lose your password you can do a password reset. On the second one, if your laptop and phone get fried in a rainstorm / car crash / act of children, you lose access to everything forever, no recourse and no recovery. And by the way, we totally encourage you to choose the second one... "
主因是，不是每個用 2FA 的人都知道要怎麼保護自己的帳號：像是同時有多把硬體的 U2F 放在不同地方，並且還有手機的 TOTP，另外還會把 backup code 放到安全的地方。
這次可以看出來 GitLab 的安全概念其實又出包了...