From owen at delong.com Wed Jun 1 14:04:18 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 1 Jun 2022 11:04:18 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References:

<4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com>

<3DEACB35-91F9-408A-B258-3D146969EF8D@delong.com>

Message-ID: <79CF23CB-517E-4AD0-B73D-C490E6C5632C@delong.com> > On May 30, 2022, at 21:35 , Peter Beckman wrote: > > On Sun, 29 May 2022, Owen DeLong via ARIN-consult wrote: > >>> Ideally, you shouldn't be logging into an ARIN account from such a machine. What sort of real world scenarios are occurring where you need to do that, as opposed to just wait until you're back at a device you control? >> >> On-call consulting work. > > And you are unable to bring your own laptop or other personal device to > this on-call consulting work, where you can use their computers and their > Internet access but you cannot use your own? In some cases, yes. >>> If you login from a device you don't control, a password alone (no >>> matter how strong) is vulnerable to replay. While I don't think you >>> should login to ARIN at the library, if you do so anyway but use 2FA, >>> then that replay risk goes away: your account is only exposed while >>> logged in at that machine. Replay of passwords is _the_ scenario that >>> 2FA is designed to address. >> >> It?s only vulnerable to replay until it is changed. When I?m faced with >> such a situation, I?m smart enough to change it once I am able to use a >> machine I control to do so. The odds of a replay attack in the time that >> takes are relatively small. The odds of the replay attack causing >> significant damage given ARIN ticket turnaround times are even smaller. > > Sure, the odds are pretty low that ARIN members wouldn't understand good > security practices or get phished, yet it happens, often enough for ARIN > to consider taking steps to reduce those odds further. Whether ARIN members in general do or not, I do and you were making allegations about my particular behavior. > It's all theoretical to someone until it happens to them. At that point, > the odds are no longer too small to make no changes. Well? I?ve got more than 20 years of it not happening to me, so I think that?s a reasonably good track record. Owen From nigarfield at verisign.com Fri Jun 17 11:44:35 2022 From: nigarfield at verisign.com (Garfield, Nicholas) Date: Fri, 17 Jun 2022 15:44:35 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts Message-ID: <59AF4CD7-EE73-45B9-912E-0A30987E0CC5@verisign.com> Hello, Verisign fully supports and encourages making 2FA a hard requirement for ARIN Online account access. As such, Verisign?s preference is to require 2FA using ARIN Online?s existing options which includes support for compatible third-party mobile authenticators. Due to the inherent weaknesses of SMS 2FA, this should only be used in the event all other third-party mobile authenticators are deemed unacceptable or not permitted for use due to country specific restrictions or the like. As ARIN is such a critical component of internet infrastructure, Verisign would recommend prioritizing the plans to support FIDO2 and would also recommend developing a cohesive plan to encourage and/or force users that do utilize SMS to migrate to the other two authentication methods. -- Nick Garfield Senior Network Engineer Verisign, Inc From info at arin.net Tue Jun 21 10:54:55 2022 From: info at arin.net (ARIN) Date: Tue, 21 Jun 2022 10:54:55 -0400 Subject: [ARIN-consult] Consultation on Whether ARIN Should Have a Public ARIN Discussion Mailing List Message-ID: Recent discussion on the ARIN Public Policy Mailing List (arin-ppml) raised an important question: Should ARIN have a public "ARIN discussion" mailing list for broad discussion of ARIN topics which is open to all (i.e., much like the present arin-ppml, but with a scope greater than supporting number resource policy development)? The arin-ppml mailing list has a more limited scope in order to keep ARIN public policy discussions focused and to reduce the number of extraneous messages that those who are participating solely for number resource policy development must process. Occasionally, there have been discussions on ARIN-ppml about topics outside number resource policy development, and this has been seen as a reasonable accommodation to allow discussion of other ARIN-related matters (such as ARIN?s governance) by the community. With General Membership available to any ARIN customer with IPv4/IPv6 number resources held under a registration services agreement (RSA/LRSA), we now have a General Member mailing list that can serve as a focused forum for many of the more general governance issues that have been discussed on arin-ppml in the past (e.g., election-related matters, changes in fees, etc.). However, recent discussions on arin-ppml have noted that there may be interest to have a more open forum for discussion of overall issues related to ARIN by those who consider themselves part of the overall ARIN community, but are not ARIN members To this end, ARIN seeks input on the following two questions: 1. Should ARIN have an ?arin-discuss? mailing list that is open to all for overall discussion of ARIN topics (conducted in accordance with ARIN?s normal rules of decorum)? Such a list would not displace the more focused ARIN-ppml, ARIN-consult, or ARIN?s general-member mailing lists, but rather provide a forum for topics not being formally considered under one of those lists. 2. If ARIN creates an arin-discuss mailing list, should the list be prepopulated in any manner? For example, if the new list ?arin-discuss? is created, should it be prepopulated with those who subscribe to arin-ppml at present? A topical discussion list isn?t very effective without a sizable base of participants, but ARIN has had poor experience in the past with prepopulating mailing lists. The feedback you provide during this consultation will help us determine the path forward regarding the possible creation of a new, open arin-discuss mailing list. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: http://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 21 July 2022. Regards, John Curran President and CEO American Registry for Internet Numbers REFERENCES: ARIN Mailing Lists ? https://www.arin.net/participate/community/mailing_lists/ Public Policy Mailing List Archive ? https://lists.arin.net/pipermail/arin-ppml/ ARIN Mailing List Acceptable Use Policy - https://www.arin.net/participate/community/mailing_lists/aup/ Announcement - New ARIN Membership Structure for 2022 - https://www.arin.net/announcements/20211229/ Announcement ? New ARIN Mailing List for General Members - https://www.arin.net/announcements/20220118/ From Marla.Azinger at FTR.com Tue Jun 21 11:27:21 2022 From: Marla.Azinger at FTR.com (Azinger, Marla) Date: Tue, 21 Jun 2022 15:27:21 +0000 Subject: [ARIN-consult] Consultation on Whether ARIN Should Have a Public ARIN Discussion Mailing List In-Reply-To: References: Message-ID: I don't want another list I have to subscribe into. My suggestion is either turn the existing one public, auto cc all posting to the public one to the private one, or don?t do it. Marla Azinger | Network Engineering, SPVR, IP Mgmt O 585-413-9128 | marla.azinger at ftr.com -----Original Message----- From: ARIN-consult On Behalf Of ARIN Sent: Tuesday, June 21, 2022 7:55 AM To: arin-consult at arin.net Subject: [ARIN-consult] Consultation on Whether ARIN Should Have a Public ARIN Discussion Mailing List ________________________________ WARNING: External email. Please verify sender before opening attachments or clicking on links. ________________________________ Recent discussion on the ARIN Public Policy Mailing List (arin-ppml) raised an important question: Should ARIN have a public "ARIN discussion" mailing list for broad discussion of ARIN topics which is open to all (i.e., much like the present arin-ppml, but with a scope greater than supporting number resource policy development)? The arin-ppml mailing list has a more limited scope in order to keep ARIN public policy discussions focused and to reduce the number of extraneous messages that those who are participating solely for number resource policy development must process. Occasionally, there have been discussions on ARIN-ppml about topics outside number resource policy development, and this has been seen as a reasonable accommodation to allow discussion of other ARIN-related matters (such as ARIN?s governance) by the community. With General Membership available to any ARIN customer with IPv4/IPv6 number resources held under a registration services agreement (RSA/LRSA), we now have a General Member mailing list that can serve as a focused forum for many of the more general governance issues that have been discussed on arin-ppml in the past (e.g., election-related matters, changes in fees, etc.). However, recent discussions on arin-ppml have noted that there may be interest to have a more open forum for discussion of overall issues related to ARIN by those who consider themselves part of the overall ARIN community, but are not ARIN members To this end, ARIN seeks input on the following two questions: 1. Should ARIN have an ?arin-discuss? mailing list that is open to all for overall discussion of ARIN topics (conducted in accordance with ARIN?s normal rules of decorum)? Such a list would not displace the more focused ARIN-ppml, ARIN-consult, or ARIN?s general-member mailing lists, but rather provide a forum for topics not being formally considered under one of those lists. 2. If ARIN creates an arin-discuss mailing list, should the list be prepopulated in any manner? For example, if the new list ?arin-discuss? is created, should it be prepopulated with those who subscribe to arin-ppml at present? A topical discussion list isn?t very effective without a sizable base of participants, but ARIN has had poor experience in the past with prepopulating mailing lists. The feedback you provide during this consultation will help us determine the path forward regarding the possible creation of a new, open arin-discuss mailing list. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://urldefense.com/v3/__http://lists.arin.net/mailman/listinfo/arin-consult__;!!M2UytebrhrTR!Je3J40809xLj1fRKTj4DFxNj_Sw8Ut7erAfe13x75GQ0gpQQPs8GN4NZPAxfQlBIalbwuoIcdyc$ This consultation will remain open through 5:00 PM ET on 21 July 2022. Regards, John Curran President and CEO American Registry for Internet Numbers REFERENCES: ARIN Mailing Lists ? https://urldefense.com/v3/__https://www.arin.net/participate/community/mailing_lists/__;!!M2UytebrhrTR!Je3J40809xLj1fRKTj4DFxNj_Sw8Ut7erAfe13x75GQ0gpQQPs8GN4NZPAxfQlBIalbwxhyazjM$ Public Policy Mailing List Archive ? https://urldefense.com/v3/__https://lists.arin.net/pipermail/arin-ppml/__;!!M2UytebrhrTR!Je3J40809xLj1fRKTj4DFxNj_Sw8Ut7erAfe13x75GQ0gpQQPs8GN4NZPAxfQlBIalbw5I2opPs$ ARIN Mailing List Acceptable Use Policy - https://urldefense.com/v3/__https://www.arin.net/participate/community/mailing_lists/aup/__;!!M2UytebrhrTR!Je3J40809xLj1fRKTj4DFxNj_Sw8Ut7erAfe13x75GQ0gpQQPs8GN4NZPAxfQlBIalbwG3R2Blc$ Announcement - New ARIN Membership Structure for 2022 - https://urldefense.com/v3/__https://www.arin.net/announcements/20211229/__;!!M2UytebrhrTR!Je3J40809xLj1fRKTj4DFxNj_Sw8Ut7erAfe13x75GQ0gpQQPs8GN4NZPAxfQlBIalbwZnKNHAo$ Announcement ? New ARIN Mailing List for General Members - https://urldefense.com/v3/__https://www.arin.net/announcements/20220118/__;!!M2UytebrhrTR!Je3J40809xLj1fRKTj4DFxNj_Sw8Ut7erAfe13x75GQ0gpQQPs8GN4NZPAxfQlBIalbwWx9I_a4$ _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://urldefense.com/v3/__https://lists.arin.net/mailman/listinfo/arin-consult__;!!M2UytebrhrTR!Je3J40809xLj1fRKTj4DFxNj_Sw8Ut7erAfe13x75GQ0gpQQPs8GN4NZPAxfQlBIalbwWKtFMLs$ Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. ________________________________ This communication is confidential. Frontier only sends and receives email on the basis of the terms set out at http://www.frontier.com/email_disclaimer. From bill at herrin.us Tue Jun 21 14:07:49 2022 From: bill at herrin.us (William Herrin) Date: Tue, 21 Jun 2022 11:07:49 -0700 Subject: [ARIN-consult] [arin-announce] Consultation on Whether ARIN Should Have a Public ARIN Discussion Mailing List In-Reply-To: References: Message-ID: On Tue, Jun 21, 2022 at 7:54 AM ARIN wrote: > 1. Should ARIN have an ?arin-discuss? mailing list that is open to > all for overall discussion of ARIN topics (conducted in accordance > with ARIN?s normal rules of decorum)? Yes, ARIN should have general discussion list open to the general public. I note that for 25 years those discussions have happened on PPML Consider whether PPML traffic is heavy enough to need to split the lists. There were all of 8 messages last month and only a few dozen the month before. Are folks who -want- to discuss ARIN public policy generally disinclined to participate in broader ARIN discussions? > 2. If ARIN creates an arin-discuss mailing list, It should absolutely not be given the same name of the members-only mailing list than ran 1999 to 2021. It's not immediately obvious to me why that list was retired last year only to be re-created under a new name this year. > should the list be prepopulated in any manner? For example, if the > new list ?arin-discuss? is created, should it be prepopulated with those > who subscribe to arin-ppml at present? A topical discussion list isn?t > very effective without a sizable base of participants, but ARIN has had > poor experience in the past with prepopulating mailing lists. That's a messy question. Folks react poorly to being auto-subscribed to mailing lists without their consent, even when it's because a list is split. Anyway, glad to see the discussion happening. Thanks John! Regards, Bill Herrin -- William Herrin bill at herrin.us https://bill.herrin.us/ From info at arin.net Mon Jun 27 09:52:04 2022 From: info at arin.net (ARIN) Date: Mon, 27 Jun 2022 09:52:04 -0400 Subject: [ARIN-consult] Now Closed - ACSP Consultation 2022.4 - Requiring Two-Factor Authentication for ARIN Online Accounts Message-ID: <9D3FA47D-96FE-49D4-B99B-D3D3B24F072E@arin.net> ARIN thanks those who provided valuable feedback during this consultation on requiring Two-Factor Authentication (2FA) on all ARIN Online accounts. This important feedback will help form our path forward to increasing the security of ARIN Online for all customers. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN)