From info at arin.net Tue May 24 12:46:13 2022 From: info at arin.net (ARIN) Date: Tue, 24 May 2022 12:46:13 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts Message-ID: **Background** In 2015, ARIN deployed a Time-Based One-Time password (TOTP) implementation of Two-Factor Authentication (2FA). Since the time of implementing that login security feature, 3.2 percent of ARIN Online users have opted to use 2FA with their accounts. Since October 2020, the ARIN Online system has been subject to a series of dictionary-based password guessing attacks. In March of 2021, we conducted ACSP Consultation 2021.2: Password Security for ARIN Online Accounts (https://www.arin.net/participate/community/acsp/consultations/2021/2021-2/) on proposed improvements to increase account security. This consultation resulted in an agreement to move forward with several improvements that have subsequently been deployed. However, we continue to see frequent attacks on our log-in systems, and ARIN staff continues to be heavily engaged in mitigating these attacks. Accounts not using 2FA are susceptible to these attacks. We recently updated the community on this topic during ARIN 49 held in Nashville and online in April. You can review this information from the ARIN 49 Meeting Report (https://www.arin.net/participate/meetings/ARIN49/) by looking for the presentation titled ?Brute Force Login Attacks?. It is our intention to make 2FA mandatory for all existing and new ARIN Online accounts going forward. The security of ARIN Online accounts is paramount to the success of the registry, and we do not believe it is tenable to continue without making 2FA required for all ARIN Online accounts. We are currently developing a second method of 2FA use with ARIN Online to add to our long-deployed TOTP implementation. In the coming months, we will deploy a Short Message Service (SMS) 2FA implementation, thereby adding a second 2FA option for ARIN Online users. At that time, users will be able to choose between two types of 2FA ? SMS and TOTP. Adoption of TOTP 2FA has been limited in part due to perceived complexity, and the addition of SMS-based 2FA will provide a second option that is easier to use for many customers ? and provide much more protection than the simple username-password condition of many ARIN Online user accounts today. (ARIN also plans on adding support for a third 2FA option in the future ? Fast Identity Online 2 (FIDO2) ? in response to community suggestions, but we do not believe it is prudent to delay requiring 2FA on ARIN Online accounts until that third option becomes available.) **Requiring 2FA For ARIN Online Accounts** By requiring 2FA for ARIN Online accounts that control number resources, the ARIN community should see stronger security for the registry, reduced risk of account fraud attempts, and increased confidence in the integrity of their ARIN resources. ARIN intends to require 2FA for all ARIN Online accounts shortly after SMS-based 2FA authentication is generally available. We are seeking confirmation from the ARIN community regarding this plan, and ask the following consultation question: ------------------- Once SMS-based two-factor authentication (2FA) is available for ARIN Online, do you believe ARIN *should not* proceed with requiring 2FA authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, why? ------------------- The feedback you provide during this consultation will help form our path forward to increasing the security of ARIN Online for all customers. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: http://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 24 June 2022. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts From ler at lerctr.org Tue May 24 12:52:41 2022 From: ler at lerctr.org (Larry Rosenman) Date: Tue, 24 May 2022 11:52:41 -0500 Subject: [ARIN-consult] SMS 2FA: Not as secure..... Message-ID: In answer to the consult: Once SMS-based two-factor authentication (2FA) is available for ARIN Online, do you believe ARIN *should not* proceed with requiring 2FA authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, why? SMS 2FA is subject to security flaws, interception, sim-card theft, etc. I don't believe SMS 2FA is appropriate at all. TOTP or FIDO should be the only methods, IMO. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: ler at lerctr.org US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 From bill at herrin.us Tue May 24 13:40:42 2022 From: bill at herrin.us (William Herrin) Date: Tue, 24 May 2022 10:40:42 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: On Tue, May 24, 2022 at 9:46 AM ARIN wrote: > ------------------- > Once SMS-based two-factor authentication (2FA) is available for ARIN Online, do you believe ARIN *should not* proceed with requiring 2FA authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, why? > ------------------- Hello, I believe ARIN is IN ERROR to yet again consider requiring Two Factor Authentication (2FA) of its customers. Firstly, 2FA is technologically unsuitable for API access to ARIN. Is it ARIN's intention to also disable portions of the API access? Or simply leave it open as a less secured hole in the system? Secondly, 2FA is problematic for rarely accessed systems. When systems are not accessed on a daily or weekly basis, phone numbers change and TOTP devices are replaced or lost. This is especially true when network administrators who brought their cell phones with them take them when they move on to new jobs. This leaves registrants more frequently going through the password recovery procedures which, when structured to be frequently usable, are almost always less secure than a suitably long or complex password. I note that both of the proposed technologies rely on the user's cell phone. More COMPETENT 2FA implementations also support placing a voice call with a code so that users with company-provided desk phones may use them too, and often support optionally setting a browser authentication cookie which allows frequent logins without repeating the hassle of the 2FA process. The implementation proposed by ARIN does not read like a competent one. Moreover, there are suitable alternatives to generalized 2FA. For example, processing potentially irreversible changes like transfers from non-2FA accounts could require a postal mail confirmation -- a process far more secure than generalized SMS. In some use cases, 2FA is an excellent security tool which should be available to ARIN customers. While it's use should be encouraged, It is my opinion that 2FA should NEVER be required. Let customers identify the access process which fits THEIR use of ARIN Online. Regards, Bill Herrin -- William Herrin bill at herrin.us https://bill.herrin.us/ From rgreenwood at shastacoe.org Tue May 24 14:47:56 2022 From: rgreenwood at shastacoe.org (Rich Greenwood) Date: Tue, 24 May 2022 11:47:56 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: While I'm sure most of us agree that SMS based MFA is the worst option out of all the MFA options, I support proceeding with requiring MFA for all accounts. The rest of this message is outside the scope of this consultation, so it can be safely ignored. This should probably be a different consultation discussion. I would like to see the option for multiple MFA options for a single account and additional MFA options like a YubiKey hardware token. Having a YubiKey locked in the office safe would help negate the risk of a single person's phone being the key to all the records. Having the option of choosing which MFA option to use during login would mean I wouldn't have to go get my phone if my YubiKey was in my pocket, or vise-versa. Thanks. --Rich On Tue, May 24, 2022 at 9:46 AM ARIN wrote: > **Background** > > In 2015, ARIN deployed a Time-Based One-Time password (TOTP) > implementation of Two-Factor Authentication (2FA). Since the time of > implementing that login security feature, 3.2 percent of ARIN Online users > have opted to use 2FA with their accounts. > > Since October 2020, the ARIN Online system has been subject to a series of > dictionary-based password guessing attacks. In March of 2021, we conducted > ACSP Consultation 2021.2: Password Security for ARIN Online Accounts ( > https://www.arin.net/participate/community/acsp/consultations/2021/2021-2/) > on proposed improvements to increase account security. This consultation > resulted in an agreement to move forward with several improvements that > have subsequently been deployed. However, we continue to see frequent > attacks on our log-in systems, and ARIN staff continues to be heavily > engaged in mitigating these attacks. Accounts not using 2FA are susceptible > to these attacks. We recently updated the community on this topic during > ARIN 49 held in Nashville and online in April. You can review this > information from the ARIN 49 Meeting Report ( > https://www.arin.net/participate/meetings/ARIN49/) by looking for the > presentation titled ?Brute Force Login Attacks?. > > It is our intention to make 2FA mandatory for all existing and new ARIN > Online accounts going forward. The security of ARIN Online accounts is > paramount to the success of the registry, and we do not believe it is > tenable to continue without making 2FA required for all ARIN Online > accounts. > > We are currently developing a second method of 2FA use with ARIN Online to > add to our long-deployed TOTP implementation. In the coming months, we will > deploy a Short Message Service (SMS) 2FA implementation, thereby adding a > second 2FA option for ARIN Online users. At that time, users will be able > to choose between two types of 2FA ? SMS and TOTP. Adoption of TOTP 2FA > has been limited in part due to perceived complexity, and the addition of > SMS-based 2FA will provide a second option that is easier to use for many > customers ? and provide much more protection than the simple > username-password condition of many ARIN Online user accounts today. (ARIN > also plans on adding support for a third 2FA option in the future ? Fast > Identity Online 2 (FIDO2) ? in response to community suggestions, but we do > not believe it is prudent to delay requiring 2FA on ARIN Online accounts > until that third option becomes available.) > > **Requiring 2FA For ARIN Online Accounts** > > By requiring 2FA for ARIN Online accounts that control number resources, > the ARIN community should see stronger security for the registry, reduced > risk of account fraud attempts, and increased confidence in the integrity > of their ARIN resources. > > ARIN intends to require 2FA for all ARIN Online accounts shortly after > SMS-based 2FA authentication is generally available. We are seeking > confirmation from the ARIN community regarding this plan, and ask the > following consultation question: > > ------------------- > Once SMS-based two-factor authentication (2FA) is available for ARIN > Online, do you believe ARIN *should not* proceed with requiring 2FA > authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, > why? > ------------------- > > The feedback you provide during this consultation will help form our path > forward to increasing the security of ARIN Online for all customers. Thank > you for your participation in the ARIN Consultation and Suggestion Process. > Please provide comments to arin-consult at arin.net. You can subscribe to > this mailing list at: > > http://lists.arin.net/mailman/listinfo/arin-consult > > This consultation will remain open through 5:00 PM ET on 24 June 2022. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online > Accounts > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -- Rich Greenwood Network Engineer Shasta County Office of Education Information Technology 1644 Magnolia Ave. Redding, CA 96001 Office: 530-225-0161 Hotline: 530-225-0279 rgreenwood at shastacoe.org -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/pkcs7-signature Size: 5623 bytes Desc: S/MIME Cryptographic Signature URL: From rs at seastrom.com Tue May 24 14:49:51 2022 From: rs at seastrom.com (Rob Seastrom) Date: Tue, 24 May 2022 14:49:51 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: > On May 24, 2022, at 1:40 PM, William Herrin wrote: > > While it's use should be encouraged, It > is my opinion that 2FA should NEVER be required. Let customers > identify the access process which fits THEIR use of ARIN Online. Disagree strongly. Requiring a second factor, even a crummy one like SMS (colloquially "1.2FA-not-2FA") reduces risk substantially. We can expect some increased workload for ARIN help desk staff who will face incrementally more work dealing with credential issues due to increased complexity, lost second factor tokens, changed, phone numbers, etc. I believe the trade-off is worth it. I applaud having FIDO2 on the roadmap and concur that requirement of a second factor should not be delayed to wait for it. I would support guidance to customerrs to only use SMS if they have no other option. Based on hallway discussion at ARIN 49, I want to make sure to make it clear I am advocating for evolving to an underlying identity platform that supports multiple flavors of MFA and can be extended to support new ones. This is important for lifecycle management. No doubt the day will come that FIDO2 looks as old and crufty as TOTP or as inadvisable as SMS. In other words, it is the capability and the ability to implement the second factor using technology that will evolve over time that matters. Speaking for myself, all the usual disclaimers, -r -------------- next part -------------- An HTML attachment was scrubbed... URL: From rlaager at wiktel.com Tue May 24 14:59:12 2022 From: rlaager at wiktel.com (Richard Laager) Date: Tue, 24 May 2022 13:59:12 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: I believe ARIN absolutely should require 2FA. Your actual experience with dictionary attacks confirms that. SMS 2FA seems like a pragmatic compromise. I?m aware that SMS is generally considered a less secure 2nd factor, but: 1) I?m not sure how much less secure it really is. It obviously cannot be worse than a password alone. 2) Major financial institutions seem okay with it. 3) It might be necessary in practice to get people to turn on / accept 2FA. You will have to think hard about recovery procedures. They will become the weak link in the security. -- Richard From rlaager at wiktel.com Tue May 24 14:59:12 2022 From: rlaager at wiktel.com (Richard Laager) Date: Tue, 24 May 2022 13:59:12 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: I believe ARIN absolutely should require 2FA. Your actual experience with dictionary attacks confirms that. SMS 2FA seems like a pragmatic compromise. I?m aware that SMS is generally considered a less secure 2nd factor, but: 1) I?m not sure how much less secure it really is. It obviously cannot be worse than a password alone. 2) Major financial institutions seem okay with it. 3) It might be necessary in practice to get people to turn on / accept 2FA. You will have to think hard about recovery procedures. They will become the weak link in the security. -- Richard From max at codingdirect.com Tue May 24 15:23:30 2022 From: max at codingdirect.com (Max Krivanek) Date: Tue, 24 May 2022 14:23:30 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: Hi, I find SMS highly insecure since it can be intercepted (it goes across the system in plain text, similar to HTTP) and there is also SIM hijacking. This article by Krebs goes into more detail of why it's insecure. https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ The fact that major financial institutions use it is a detriment to them. As TOTP or FIDO2 are way more secure. But this is where reality hits the road. Most people will not want to set up TOTP or FIDO2, but as long as those of us who are more security minded can make sure SMS or the phone number in general cannot be used for authentication purposes I would be fine with including it as a stop gap. On Tue, May 24, 2022 at 1:59 PM Richard Laager wrote: > I believe ARIN absolutely should require 2FA. Your actual experience with > dictionary attacks confirms that. > > SMS 2FA seems like a pragmatic compromise. I?m aware that SMS is generally > considered a less secure 2nd factor, but: 1) I?m not sure how much less > secure it really is. It obviously cannot be worse than a password alone. 2) > Major financial institutions seem okay with it. 3) It might be necessary in > practice to get people to turn on / accept 2FA. > > You will have to think hard about recovery procedures. They will become > the weak link in the security. > > -- > Richard > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -- Max Krivanek Managing Member Coding*Direct* Phone: (682) 232-4867 -------------- next part -------------- An HTML attachment was scrubbed... URL: From ross at tajvar.io Tue May 24 15:52:35 2022 From: ross at tajvar.io (Ross Tajvar) Date: Tue, 24 May 2022 15:52:35 -0400 Subject: [ARIN-consult] SMS 2FA: Not as secure..... Message-ID: I strongly agree with Larry. I have had money stolen from accounts protected with SMS 2FA because it is not secure. I do not support enablement of SMS 2FA at all, even as a second option. I *do* support mandatory enforcement of TOTP or FIDO 2FA for all users, new or not. -Ross In answer to the consult: > Once SMS-based two-factor authentication (2FA) is available for ARIN > Online, do you believe ARIN *should not* proceed with requiring 2FA > authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, > why? > > SMS 2FA is subject to security flaws, interception, sim-card theft, etc. > I don't believe SMS 2FA is appropriate at all. > > TOTP or FIDO should be the only methods, IMO. > > > -- > Larry Rosenman http://www.lerctr.org/~ler > Phone: +1 214-642-9640 E-Mail: ler at lerctr.org > US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From matt at netfire.net Tue May 24 16:08:44 2022 From: matt at netfire.net (Matt Harris) Date: Tue, 24 May 2022 15:08:44 -0500 Subject: [ARIN-consult] SMS 2FA: Not as secure..... In-Reply-To: References: Message-ID: Matt Harris|VP of Infrastructure 816-256-5446|Direct Looking for help? Helpdesk|Email Support We build customized end-to-end technology solutions powered by NetFire Cloud. On Tue, May 24, 2022 at 2:52 PM Ross Tajvar wrote: > I strongly agree with Larry. I have had money stolen from accounts > protected with SMS 2FA because it is not secure. I do not support > enablement of SMS 2FA at all, even as a second option. I *do* support > mandatory enforcement of TOTP or FIDO 2FA for all users, new or not. > > -Ross > > In answer to the consult: >> Once SMS-based two-factor authentication (2FA) is available for ARIN >> Online, do you believe ARIN *should not* proceed with requiring 2FA >> authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, >> why? >> >> SMS 2FA is subject to security flaws, interception, sim-card theft, etc. >> I don't believe SMS 2FA is appropriate at all. >> >> TOTP or FIDO should be the only methods, IMO. >> >> I agree, as well. I believe that any perceived difficulty inherent in utilizing totp 2fa is simply a mis-perception. Indeed, if you have a device capable of receiving SMS, you likely have a device capable of running a totp app. On the other hand, a device capable of running a totp app - or, alternatively as Ross mentioned, performing FIDO auth - is far less expensive than a device capable of receiving SMS and the associated subscriptions required in order to do so. For example, there are a number of free totp apps (I use google authenticator) for both android and ios. If you have access to neither, and FIDO were implemented, a simple FIDO device such as a yubikey can likely be had for $25 USD if not less. ARIN should proceed with requiring 2fa for at least all accounts which are holders of resources such as ASNs and address resources. This should not be dependent on implementing SMS 2fa, and FIDO support should be considered as a superior secondary option for those who do not wish to utilize totp. This will offer the greatest added security while additionally providing for the lowest possible cost of participation, as a FIDO (blue) yubikey is widely available for $25 USD, a one-time charge unlike the subscription required to receive SMS at a distinct DID or shortcode. - mdh -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image444934.png Type: image/png Size: 14877 bytes Desc: image444934.png URL: From matt at conundrum.com Tue May 24 17:22:05 2022 From: matt at conundrum.com (Matthew Pounsett) Date: Tue, 24 May 2022 17:22:05 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: I agree with making 2FA required on all accounts. SMS is absolutely less secure than other 2FA options, but more secure than no 2FA at all. This would be a marginal security improvement for users, and from the sounds of things a massive decrease in workload for staff. However, given the known problems with SMS, I would urge staff to make it possible for those of us with other 2FA methods configured to be able to *disable* SMS 2FA on our accounts, to prevent it from ever being used even as a fallback authentication method. Additionally, if SMS-based password recovery is ever on the table I would like to be able to indicate that it should never be available for recovery for my account. As RS says, I'm happy FIDO is on the roadmap, but I don't see a reason to wait for it to be ready before making 2FA mandatory. -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompson at merlin.mb.ca Tue May 24 17:35:38 2022 From: athompson at merlin.mb.ca (Adam Thompson) Date: Tue, 24 May 2022 21:35:38 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <8084A98E-F3A3-41B6-8855-A1B011B7207C@arin.net> References: <8084A98E-F3A3-41B6-8855-A1B011B7207C@arin.net> Message-ID: SMS-based authentication is fine, as long as: a) it isn't limited to a maximum of one phone number, b) ARIN doesn't mistakenly try to determine what #s are truly cell phones (vs. floating #s, voip systems, etc.) and c) choice of 2FA system (SMS vs OTP) isn't an XOR selection, i.e. any supported 2FA system can be used to login at any given time. I spend a non-negligible amount of time working in areas without cell phone reception, and/or where I need a different SIM card (and thus phone#) to get service - I can have to up 3 valid cell#s at any given time, only 1 or 2 of which might be active/reachable/valid at the moment. Then, some other websites have determined that one of my cell#s isn't really a cell#, so refuse to send SMS messages there... kind of a problem. I don't know what database or service they use, and I've found no way around the problem so far. (For those about to comment, it's an OTT follow-me phone#, not a standard cell#. I still get and send SMS messages there through a separate app.) Beyond the sheer usability problems when you aren't in a populated area, and/or aren't working inside accidental faraday cages (e.g. one of the sites I visit), SMS has a whole host of security concerns. It's still better than **nothing at all**, but IMHO should be considered a stop-gap measure. I believe TOTP and/or FIDO both require significant user education, even among ARIN users, and AFAIK no user-friendly guides exist today. -Adam Adam Thompson Consultant, Infrastructure Services MERLIN 100 - 135 Innovation Drive Winnipeg, MB R3T 6A8 (204) 977-6824 or 1-800-430-6404 (MB only) https://www.merlin.mb.ca Chat with me on Teams: athompson at merlin.mb.ca > -----Original Message----- > From: ARIN-announce On Behalf Of ARIN > Sent: Tuesday, May 24, 2022 11:46 AM > To: arin-announce at arin.net > Subject: [arin-announce] Consultation on Requiring Two-Factor > Authentication (2FA) for ARIN Online Accounts > > **Background** > > In 2015, ARIN deployed a Time-Based One-Time password (TOTP) > implementation of Two-Factor Authentication (2FA). Since the time of > implementing that login security feature, 3.2 percent of ARIN Online > users have opted to use 2FA with their accounts. > > Since October 2020, the ARIN Online system has been subject to a > series of dictionary-based password guessing attacks. In March of > 2021, we conducted ACSP Consultation 2021.2: Password Security for > ARIN Online Accounts > (https://www.arin.net/participate/community/acsp/consultations/2021/20 > 21-2/) on proposed improvements to increase account security. This > consultation resulted in an agreement to move forward with several > improvements that have subsequently been deployed. However, we > continue to see frequent attacks on our log-in systems, and ARIN staff > continues to be heavily engaged in mitigating these attacks. Accounts > not using 2FA are susceptible to these attacks. We recently updated > the community on this topic during ARIN 49 held in Nashville and > online in April. You can review this information from the ARIN 49 > Meeting Report (https://www.arin.net/participate/meetings/ARIN49/) by > looking for the presentation titled ?Brute Force Login Attacks?. > > It is our intention to make 2FA mandatory for all existing and new > ARIN Online accounts going forward. The security of ARIN Online > accounts is paramount to the success of the registry, and we do not > believe it is tenable to continue without making 2FA required for all > ARIN Online accounts. > > We are currently developing a second method of 2FA use with ARIN > Online to add to our long-deployed TOTP implementation. In the coming > months, we will deploy a Short Message Service (SMS) 2FA > implementation, thereby adding a second 2FA option for ARIN Online > users. At that time, users will be able to choose between two types of > 2FA ? SMS and TOTP. Adoption of TOTP 2FA has been limited in part > due to perceived complexity, and the addition of SMS-based 2FA will > provide a second option that is easier to use for many customers ? and > provide much more protection than the simple username-password > condition of many ARIN Online user accounts today. (ARIN also plans > on adding support for a third 2FA option in the future ? Fast Identity > Online 2 (FIDO2) ? in response to community suggestions, but we do not > believe it is prudent to delay requiring 2FA on ARIN Online accounts > until that third option becomes available.) > > **Requiring 2FA For ARIN Online Accounts** > > By requiring 2FA for ARIN Online accounts that control number > resources, the ARIN community should see stronger security for the > registry, reduced risk of account fraud attempts, and increased > confidence in the integrity of their ARIN resources. > > ARIN intends to require 2FA for all ARIN Online accounts shortly after > SMS-based 2FA authentication is generally available. We are seeking > confirmation from the ARIN community regarding this plan, and ask the > following consultation question: > > ------------------- > Once SMS-based two-factor authentication (2FA) is available for ARIN > Online, do you believe ARIN *should not* proceed with requiring 2FA > authentication (SMS-based or TOTP) for all ARIN Online accounts? If > so, why? > ------------------- > > The feedback you provide during this consultation will help form our > path forward to increasing the security of ARIN Online for all > customers. Thank you for your participation in the ARIN Consultation > and Suggestion Process. Please provide comments to arin- > consult at arin.net. You can subscribe to this mailing list at: > > http://lists.arin.net/mailman/listinfo/arin-consult > > This consultation will remain open through 5:00 PM ET on 24 June 2022. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > > _______________________________________________ > ARIN-Announce > You are receiving this message because you are subscribed to > the ARIN Announce Mailing List (ARIN-announce at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-announce > Please contact info at arin.net if you experience any issues. From matt at netfire.net Tue May 24 17:45:58 2022 From: matt at netfire.net (Matt Harris) Date: Tue, 24 May 2022 16:45:58 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <8084A98E-F3A3-41B6-8855-A1B011B7207C@arin.net> Message-ID: On Tue, May 24, 2022 at 4:35 PM Adam Thompson wrote: > c) choice of 2FA system (SMS vs OTP) isn't an XOR selection, i.e. any > supported 2FA system can be used to login at any given time. > I believe TOTP and/or FIDO both require significant user education, even > among ARIN users, and AFAIK no user-friendly guides exist today. > > -Adam > A couple of points here: For one, I would never want SMS 2fa to be allowed on my account. I have had totp setup for years with no issues. Adding an additional vulnerability to my existing strong configuration is not acceptable. So indeed, if SMS is an option that 2fa users can opt into, it must be that, and not something that those of us with totp configurations currently need to opt out of, or worse, are forced to accept. Another is that I disagree that TOTP or FIDO require significant user education. TOTP apps for android and ios are readily available and easy to use: in most of them (Google Authenticator is a good example, and if you don't want to use Google's app, you can also check out Duo (owned by Cisco) or any number of other apps), the process is simply to click add account, point your device's camera at the QR code associated with the account which you'll be presented with during setup, and off you go. FIDO isn't significantly more difficult when using a yubikey with modern browsers. - mdh Matt Harris|VP of Infrastructure 816-256-5446|Direct Looking for help? Helpdesk|Email Support We build customized end-to-end technology solutions powered by NetFire Cloud. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image728475.png Type: image/png Size: 14877 bytes Desc: image728475.png URL: From beckman at angryox.com Tue May 24 18:49:21 2022 From: beckman at angryox.com (Peter Beckman) Date: Tue, 24 May 2022 18:49:21 -0400 Subject: [ARIN-consult] 2FA TOTP Required: I support Message-ID: <6d63e84-706d-3edf-1375-a2975331a45a@angryox.com> I'm writing in support of moving away from Two-Factor Authentication by SMS to Two-Factor Authentication by TOTP (application-based). I run a phone company and changing SMS routing without changing the Voice routing is far to easy and lacking enough controls and notifications about such changes, which puts SMS OTP at risk for abuse and theft. While TOTP may not be as secure as a physical token, it is harder to steal, only good for 30 seconds, and does not transit any 3rd party network (such as with SMS) that can be externally intercepted. I strongly believe that TFA should be required, for ARIN as well as most any web service that authenticates users. Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- From chris at semihuman.com Tue May 24 20:25:07 2022 From: chris at semihuman.com (Chris Woodfield) Date: Tue, 24 May 2022 17:25:07 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: <4D7CC90F-667A-4D34-B79E-199641CF7002@semihuman.com> If given the choice between and SMS-based second factor and no second factor at all, which would you choose? I agree that SMS is the weakest form of 2FA of the options being considered, and I would not be happy with a system that only supported it and did not support TOTP or FIDO2. I would find it highly unlikely, however, that requiring 2FA for logins and *not* allowing SMS as an option will prove a successful approach, however - it?s Just Complex Enough that I can see a far-too-large segment of ARIN?s user base requiring quite a bit of support to enable it. -C > On May 24, 2022, at 12:23 PM, Max Krivanek via ARIN-consult wrote: > > Hi, > > I find SMS highly insecure since it can be intercepted (it goes across the system in plain text, similar to HTTP) and there is also SIM hijacking. This article by Krebs goes into more detail of why it's insecure. > https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ > > The fact that major financial institutions use it is a detriment to them. As TOTP or FIDO2 are way more secure. But this is where reality hits the road. Most people will not want to set up TOTP or FIDO2, but as long as those of us who are more security minded can make sure SMS or the phone number in general cannot be used for authentication purposes I would be fine with including it as a stop gap. > > On Tue, May 24, 2022 at 1:59 PM Richard Laager > wrote: > I believe ARIN absolutely should require 2FA. Your actual experience with dictionary attacks confirms that. > > SMS 2FA seems like a pragmatic compromise. I?m aware that SMS is generally considered a less secure 2nd factor, but: 1) I?m not sure how much less secure it really is. It obviously cannot be worse than a password alone. 2) Major financial institutions seem okay with it. 3) It might be necessary in practice to get people to turn on / accept 2FA. > > You will have to think hard about recovery procedures. They will become the weak link in the security. > > -- > Richard > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net ). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > > > -- > Max Krivanek > Managing Member > CodingDirect > > Phone: (682) 232-4867 <> > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From max at codingdirect.com Wed May 25 00:40:29 2022 From: max at codingdirect.com (Max Krivanek) Date: Tue, 24 May 2022 23:40:29 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <4D7CC90F-667A-4D34-B79E-199641CF7002@semihuman.com> References: <4D7CC90F-667A-4D34-B79E-199641CF7002@semihuman.com> Message-ID: The problem that I'm concerned about is that a lot of organizations that add SMS 2FA often end up resorting to it as a crutch. So let's say that person A did set up TOTP. But then person B finds enough information about person A to do a social engineering attack. Person B still doesn't have access to person A's TOTP application, but they know person A's phone number (this is generally easy to find, I wouldn't be surprised if many WHOIS phone numbers are associated with accounts on ARIN, or white/yellow pages). So they contact ARIN pretending to be person A, claiming to have lost their TOTP. So because SMS is now an option for authentication ARIN reverts the 2FA to SMS because it's easy. SIM hijack or interception is easy enough. Well, now person B's only hurdle is going to be the password anyway. They could have tried to brute force earlier and gotten the correct password. Or also attempt a password reset when resetting the 2FA. So the biggest thing I would impart to ARIN is do not trust SMS at all. I understand it's a stop gap that has high appeal for its ease of deployment. But do not trust it when doing account recoveries, or 2FA resets, etc. On Tue, May 24, 2022 at 7:25 PM Chris Woodfield wrote: > > > If given the choice between and SMS-based second factor and no second > factor at all, which would you choose? > > I agree that SMS is the weakest form of 2FA of the options being > considered, and I would not be happy with a system that only supported it > and did not support TOTP or FIDO2. I would find it highly unlikely, > however, that requiring 2FA for logins and *not* allowing SMS as an option > will prove a successful approach, however - it?s Just Complex Enough that I > can see a far-too-large segment of ARIN?s user base requiring quite a bit > of support to enable it. > > -C > > On May 24, 2022, at 12:23 PM, Max Krivanek via ARIN-consult < > arin-consult at arin.net> wrote: > > Hi, > > I find SMS highly insecure since it can be intercepted (it goes across the > system in plain text, similar to HTTP) and there is also SIM hijacking. > This article by Krebs goes into more detail of why it's insecure. > > https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ > > The fact that major financial institutions use it is a detriment to them. > As TOTP or FIDO2 are way more secure. But this is where reality hits the > road. Most people will not want to set up TOTP or FIDO2, but as long as > those of us who are more security minded can make sure SMS or the phone > number in general cannot be used for authentication purposes I would be > fine with including it as a stop gap. > > On Tue, May 24, 2022 at 1:59 PM Richard Laager wrote: > >> I believe ARIN absolutely should require 2FA. Your actual experience with >> dictionary attacks confirms that. >> >> SMS 2FA seems like a pragmatic compromise. I?m aware that SMS is >> generally considered a less secure 2nd factor, but: 1) I?m not sure how >> much less secure it really is. It obviously cannot be worse than a password >> alone. 2) Major financial institutions seem okay with it. 3) It might be >> necessary in practice to get people to turn on / accept 2FA. >> >> You will have to think hard about recovery procedures. They will become >> the weak link in the security. >> >> -- >> Richard >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN >> Consult Mailing >> List (ARIN-consult at arin.net). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the >> ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. >> > > > -- > Max Krivanek > Managing Member > Coding*Direct* > > Phone: (682) 232-4867 > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -- Max Krivanek Managing Member Coding*Direct* Phone: (682) 232-4867 -------------- next part -------------- An HTML attachment was scrubbed... URL: From owen at delong.com Wed May 25 03:12:55 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 00:12:55 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty awful, but all forms of 2FA come with a variety of inconveniences. With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that 2FA is a solution looking for a problem here. I know that?s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that our passwords are adequate continue in that manner. Owen > On May 24, 2022, at 09:46, ARIN wrote: > > **Background** > > In 2015, ARIN deployed a Time-Based One-Time password (TOTP) implementation of Two-Factor Authentication (2FA). Since the time of implementing that login security feature, 3.2 percent of ARIN Online users have opted to use 2FA with their accounts. > > Since October 2020, the ARIN Online system has been subject to a series of dictionary-based password guessing attacks. In March of 2021, we conducted ACSP Consultation 2021.2: Password Security for ARIN Online Accounts (https://www.arin.net/participate/community/acsp/consultations/2021/2021-2/) on proposed improvements to increase account security. This consultation resulted in an agreement to move forward with several improvements that have subsequently been deployed. However, we continue to see frequent attacks on our log-in systems, and ARIN staff continues to be heavily engaged in mitigating these attacks. Accounts not using 2FA are susceptible to these attacks. We recently updated the community on this topic during ARIN 49 held in Nashville and online in April. You can review this information from the ARIN 49 Meeting Report (https://www.arin.net/participate/meetings/ARIN49/) by looking for the presentation titled ?Brute Force Login Attacks?. > > It is our intention to make 2FA mandatory for all existing and new ARIN Online accounts going forward. The security of ARIN Online accounts is paramount to the success of the registry, and we do not believe it is tenable to continue without making 2FA required for all ARIN Online accounts. > > We are currently developing a second method of 2FA use with ARIN Online to add to our long-deployed TOTP implementation. In the coming months, we will deploy a Short Message Service (SMS) 2FA implementation, thereby adding a second 2FA option for ARIN Online users. At that time, users will be able to choose between two types of 2FA ? SMS and TOTP. Adoption of TOTP 2FA has been limited in part due to perceived complexity, and the addition of SMS-based 2FA will provide a second option that is easier to use for many customers ? and provide much more protection than the simple username-password condition of many ARIN Online user accounts today. (ARIN also plans on adding support for a third 2FA option in the future ? Fast Identity Online 2 (FIDO2) ? in response to community suggestions, but we do not believe it is prudent to delay requiring 2FA on ARIN Online accounts until that third option becomes available.) > > **Requiring 2FA For ARIN Online Accounts** > > By requiring 2FA for ARIN Online accounts that control number resources, the ARIN community should see stronger security for the registry, reduced risk of account fraud attempts, and increased confidence in the integrity of their ARIN resources. > > ARIN intends to require 2FA for all ARIN Online accounts shortly after SMS-based 2FA authentication is generally available. We are seeking confirmation from the ARIN community regarding this plan, and ask the following consultation question: > > ------------------- > Once SMS-based two-factor authentication (2FA) is available for ARIN Online, do you believe ARIN *should not* proceed with requiring 2FA authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, why? > ------------------- > > The feedback you provide during this consultation will help form our path forward to increasing the security of ARIN Online for all customers. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: > > http://lists.arin.net/mailman/listinfo/arin-consult > > This consultation will remain open through 5:00 PM ET on 24 June 2022. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. From mje at posix.co.za Wed May 25 04:06:20 2022 From: mje at posix.co.za (Mark Elkins) Date: Wed, 25 May 2022 10:06:20 +0200 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: On 5/24/22 6:46 PM, ARIN wrote: > **Background** > > In 2015, ARIN deployed a Time-Based One-Time password (TOTP) implementation of Two-Factor Authentication (2FA). Since the time of implementing that login security feature, 3.2 percent of ARIN Online users have opted to use 2FA with their accounts. Years back, I added TOTP (Time based one time password) to the front end of my "Virtual Web" management system (I sell domains - etc). The TOTP APP is easy to install on any modern mobile device (I use mOTP). I allow the customer to configure their TOTP backend "OTP management" codes and to also test that the TOTP works locally before enforcing it. (the grey text above are prompts) This is also combined with the ability to specify an access list made up of multiple network blocks from where the OTP is not needed, that is some machines with static IP's on the persons home network. To enforce OTP - just use an address such as 1.0.0.0/32 (or similar). This access list is similar to some of the validation that EPP uses. The php code was not too complicated. Using TOTP is free - no SMS's - etc. One then has the best of both worlds - some secure locations from where OTP is not required and the OTP's for other (transient) locations. TOTP security is optional - so of course very few customers use it (1% or so) - but it is there! Education would be necessary. I provide the following... -- Mark James ELKINS? -? Posix Systems - (South) Africa mje at posix.co.za?????? Tel: +27.826010496 -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: kbmdcmhlnngimhca.png Type: image/png Size: 10728 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: mipgcaboncbcaodl.png Type: image/png Size: 82039 bytes Desc: not available URL: From bda at bazu.org Wed May 25 10:26:59 2022 From: bda at bazu.org (Bram Abramson) Date: Wed, 25 May 2022 10:26:59 -0400 Subject: [ARIN-consult] increasing 2FA take-up Message-ID: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> All, The current consultation is about rendering SMS a 2FA option, then making 2FA mandatory. But it also notes that TOTP 2FA has been available since 2015 with a 3.2 percent take-up. Optional 2FA is perhaps inevitably doomed to low take-up, but I it?s likely worth documenting any learnings from the implementation thus far, on the way to that 3.2 percent take-up: - Have most folks involved in this discussion already activated 2FA (are we preaching to the converted)? If not ? why has it made sense for you not to? - Do we think most of the broader community is aware of the 2FA opportunity ? and are there thoughts, UX or otherwise, on why the crushing majority of folks haven?t availed themselves of it? Thanks, and cheers, --- Bram Abramson bda at bazu.org / @bramabramson -------------- next part -------------- An HTML attachment was scrubbed... URL: From owen at delong.com Wed May 25 10:37:54 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 07:37:54 -0700 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> References: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> Message-ID: In my case, no, I have not opted in to 2FA for ARIN. It?s a calculated risk. I believe my non-dictionary password provides sufficient protection against what can be done with malicious access to my account vs. the added inconvenience of 2FA. Owen > On May 25, 2022, at 07:27, Bram Abramson wrote: > > ? > All, > > The current consultation is about rendering SMS a 2FA option, then making 2FA mandatory. But it also notes that TOTP 2FA has been available since 2015 with a 3.2 percent take-up. > > Optional 2FA is perhaps inevitably doomed to low take-up, but I it?s likely worth documenting any learnings from the implementation thus far, on the way to that 3.2 percent take-up: > > Have most folks involved in this discussion already activated 2FA (are we preaching to the converted)? If not ? why has it made sense for you not to? > > Do we think most of the broader community is aware of the 2FA opportunity ? and are there thoughts, UX or otherwise, on why the crushing majority of folks haven?t availed themselves of it? > > Thanks, and cheers, > > Bram Abramson > bda at bazu.org / @bramabramson > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From daveid at panix.com Wed May 25 10:40:24 2022 From: daveid at panix.com (David R Huberman) Date: Wed, 25 May 2022 14:40:24 +0000 () Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> References: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> Message-ID: Hi! Bram wrote: > But it also notes that TOTP 2FA has been available since 2015 with > a 3.2 percent take-up. ... and: > - Do we think most of the broader community is aware of the 2FA opportunity > ??? and are there thoughts, UX or otherwise, on why the crushing majority of > folks haven???t availed themselves of it? I note that in the Engineering Report at ARIN49, found at: https://www.arin.net/participate/meetings/ARIN49/materials/425_engineeringreport.pdf ... only a minority percentage of ARIN Online users login with any frequency. Further, as noted by others, the priority in our thinking may need to be on ARIN Online accounts associated with number resources. Putting the two ideas together, I think the 3.2% number is a bit unfocused. Perhaps it would be helpful if we knew the percentage take-up of 2FA for ARIN Online accounts that are associated with number resources as we delve into this discussion. Just my opinion, and writing solely for myself, /david From athompso at athompso.net Wed May 25 10:46:48 2022 From: athompso at athompso.net (Adam Thompson) Date: Wed, 25 May 2022 14:46:48 +0000 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> References: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> Message-ID: I have not enabled 2FA. TOTP lies at the unfortunate confluence of vendor misfeatures and organizational policies that render it not durable or resilient in the face of mobile device failure (which seems to happen to me a LOT more often than normal). Possibly I don't know something about our approved authenticator apps that might solve the problem, but last time I checked, it was a no-go for me. I've instead opted to use a long, randomly-generated password that I can store in ways that are both secure and durable/resilient. -Adam Get Outlook for Android ________________________________ From: ARIN-consult on behalf of Bram Abramson Sent: Wednesday, May 25, 2022 9:26:59 AM To: ARIN-consult Subject: [ARIN-consult] increasing 2FA take-up All, The current consultation is about rendering SMS a 2FA option, then making 2FA mandatory. But it also notes that TOTP 2FA has been available since 2015 with a 3.2 percent take-up. Optional 2FA is perhaps inevitably doomed to low take-up, but I it?s likely worth documenting any learnings from the implementation thus far, on the way to that 3.2 percent take-up: * Have most folks involved in this discussion already activated 2FA (are we preaching to the converted)? If not ? why has it made sense for you not to? * Do we think most of the broader community is aware of the 2FA opportunity ? and are there thoughts, UX or otherwise, on why the crushing majority of folks haven?t availed themselves of it? Thanks, and cheers, ________________________________ Bram Abramson bda at bazu.org / @bramabramson -------------- next part -------------- An HTML attachment was scrubbed... URL: From matt at netfire.net Wed May 25 11:13:09 2022 From: matt at netfire.net (Matt Harris) Date: Wed, 25 May 2022 10:13:09 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult < arin-consult at arin.net> wrote: > I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty awful, > but all forms of 2FA come with a variety of inconveniences. > > With an account that goes back to the beginnings of ARIN online, I?ve > never had a security problem with my ARIN online account, so I think that > 2FA is a solution looking for a problem here. > > I know that?s not a popular view among the more security conscious, but > the reality is that security should be commensurate with what is being > protected. Let users who think their account warrants such additional > measures opt in. Let those of use who feel that our passwords are adequate > continue in that manner. > > Owen > Owen, The problem is that compromised ARIN accounts can result in issues that don't just impact the owner of the account that held those resources. Compromised ARIN accounts with resources can potentially adversely impact us all in terms of upticks in spam and the resulting management burdens, at the very least, and potentially in other (perhaps even thus far unforeseen) ways as well. I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring 2fa, only requiring it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. - mdh Matt Harris|VP of Infrastructure 816-256-5446|Direct Looking for help? Helpdesk|Email Support We build customized end-to-end technology solutions powered by NetFire Cloud. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image007435.png Type: image/png Size: 14877 bytes Desc: image007435.png URL: From rlaager at wiktel.com Wed May 25 11:20:56 2022 From: rlaager at wiktel.com (Richard Laager) Date: Wed, 25 May 2022 10:20:56 -0500 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: Message-ID: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> You can put your TOTP in something like 1Password. -- Richard > On May 25, 2022, at 09:46, Adam Thompson wrote: > > ? > I have not enabled 2FA. > > TOTP lies at the unfortunate confluence of vendor misfeatures and organizational policies that render it not durable or resilient in the face of mobile device failure (which seems to happen to me a LOT more often than normal). Possibly I don't know something about our approved authenticator apps that might solve the problem, but last time I checked, it was a no-go for me. > > I've instead opted to use a long, randomly-generated password that I can store in ways that are both secure and durable/resilient. > > -Adam > > Get Outlook for Android > From: ARIN-consult on behalf of Bram Abramson > Sent: Wednesday, May 25, 2022 9:26:59 AM > To: ARIN-consult > Subject: [ARIN-consult] increasing 2FA take-up > > All, > > The current consultation is about rendering SMS a 2FA option, then making 2FA mandatory. But it also notes that TOTP 2FA has been available since 2015 with a 3.2 percent take-up. > > Optional 2FA is perhaps inevitably doomed to low take-up, but I it?s likely worth documenting any learnings from the implementation thus far, on the way to that 3.2 percent take-up: > > Have most folks involved in this discussion already activated 2FA (are we preaching to the converted)? If not ? why has it made sense for you not to? > > Do we think most of the broader community is aware of the 2FA opportunity ? and are there thoughts, UX or otherwise, on why the crushing majority of folks haven?t availed themselves of it? > > Thanks, and cheers, > > Bram Abramson > bda at bazu.org / @bramabramson > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From jcurran at arin.net Wed May 25 11:24:59 2022 From: jcurran at arin.net (John Curran) Date: Wed, 25 May 2022 15:24:59 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: <403D340D-481A-4C65-A310-9DFA9E3A7A58@arin.net> On 25 May 2022, at 11:13 AM, Matt Harris > wrote: I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring 2fa, only requiring it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. Matt - Wouldn?t the ?compromise approach? shown above leave ARIN with accounts that are still subject to brute-force login attacks, and therefore not address the other aspect raised in the consultation: However, we continue to see frequent attacks on our log-in systems, and ARIN staff continues to be heavily engaged in mitigating these attacks. Accounts not using 2FA are susceptible to these attacks. We recently updated the community on this topic during ARIN 49 held in Nashville and online in April. You can review this information from the ARIN 49 Meeting Report (https://www.arin.net/participate/meetings/ARIN49/) by looking for the presentation titled ?Brute Force Login Attacks?. Thoughts? /John John Curran President and CEO American Registry for Internet Numbers -------------- next part -------------- An HTML attachment was scrubbed... URL: From owen at delong.com Wed May 25 11:35:34 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 08:35:34 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> > On May 25, 2022, at 08:13 , Matt Harris wrote: > > > Matt Harris? > | > VP of Infrastructure > 816?256?5446 > | > Direct > Looking for help? > Helpdesk > | > Email?Support > > We build customized end?to?end technology solutions powered by NetFire Cloud. > On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult > wrote: > I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty awful, but all forms of 2FA come with a variety of inconveniences. > > With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that 2FA is a solution looking for a problem here. > > I know that?s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that our passwords are adequate continue in that manner. > > Owen > > Owen, > The problem is that compromised ARIN accounts can result in issues that don't just impact the owner of the account that held those resources. Compromised ARIN accounts with resources can potentially adversely impact us all in terms of upticks in spam and the resulting management burdens, at the very least, and potentially in other (perhaps even thus far unforeseen) ways as well. I disagree? If my ARIN account is compromised, I?m going to get notified of any changes made. (So far, that hasn?t happened). I know exactly where to go to get those changes reverted quickly. My account is associated with resources, but I remain unconvinced that inflicting 2FA on me solves a real problem that actually exists. > I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring 2fa, only requiring it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. Perhaps requiring better (non-dictionary) passwords on accounts that don?t have 2FA would be a solution more targeted at the actual problem. Owen -------------- next part -------------- An HTML attachment was scrubbed... URL: From matt at netfire.net Wed May 25 11:40:23 2022 From: matt at netfire.net (Matt Harris) Date: Wed, 25 May 2022 10:40:23 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <403D340D-481A-4C65-A310-9DFA9E3A7A58@arin.net> References: <403D340D-481A-4C65-A310-9DFA9E3A7A58@arin.net> Message-ID: Matt Harris|VP of Infrastructure 816-256-5446|Direct Looking for help? Helpdesk|Email Support We build customized end-to-end technology solutions powered by NetFire Cloud. On Wed, May 25, 2022 at 10:25 AM John Curran wrote: > > > On 25 May 2022, at 11:13 AM, Matt Harris wrote: > > I do agree with your statement "security should be commensurate with what > is being protected." Thus, I would consider that we perhaps continue to > allow accounts without control of any resources to continue without > requiring 2fa, only requiring it when resources are allocated. An ARIN > account with control of nothing, or perhaps just contact records for SWIP'd > space, etc, is not one that is a huge hazard to the community at large imho > compared to one that controls ASNs or IPv4 and IPv6 resources. > > > Matt - > > Wouldn?t the ?compromise approach? shown above leave ARIN with accounts > that are still subject to brute-force login attacks, and therefore not > address the other aspect raised in the consultation: > > *However, we continue to see frequent attacks on our log-in systems, and > ARIN staff continues to be heavily engaged in mitigating these > attacks. Accounts not using 2FA are susceptible to these attacks. We > recently updated the community on this topic during ARIN 49 held in > Nashville and online in April. You can review this information from the > ARIN 49 Meeting Report (https://www.arin.net/participate/meetings/ARIN49/ > ) by looking for the > presentation titled ?Brute Force Login Attacks?. * > > > > Thoughts? > /John > Indeed, it's a compromise, just like the proposed use of SMS as a method is a compromise. The ideal is, imho, probably to implement FIDO as a second 2fa measure in addition to the already well-supported TOTP method and leave SMS off the table, and enforce it on all accounts across the board. I don't want to let perfect be the enemy of good, though. - mdh -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image618101.png Type: image/png Size: 14877 bytes Desc: image618101.png URL: From scottleibrand at gmail.com Wed May 25 11:40:45 2022 From: scottleibrand at gmail.com (Scott Leibrand) Date: Wed, 25 May 2022 08:40:45 -0700 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: Putting TOTP in 1Password makes login far more convenient than SMS 2FA, and almost as convenient as password-only, even for shared accounts. ARIN should probably provide instructions for how to add your TOTP to 1Password (and any other password managers that support that workflow), because it's not a very intuitive enrollment experience. We could also make 2FA only mandatory for activities that change resource control (outbound transfers, reassignments, etc.)... -Scott On Wed, May 25, 2022 at 8:21 AM Richard Laager wrote: > You can put your TOTP in something like 1Password. > > -- > Richard > > On May 25, 2022, at 09:46, Adam Thompson wrote: > > ? > I have not enabled 2FA. > > TOTP lies at the unfortunate confluence of vendor misfeatures and > organizational policies that render it not durable or resilient in the face > of mobile device failure (which seems to happen to me a LOT more often than > normal). Possibly I don't know something about our approved > authenticator apps that might solve the problem, but last time I checked, > it was a no-go for me. > > I've instead opted to use a long, randomly-generated password that I can > store in ways that are both secure and durable/resilient. > > -Adam > > Get Outlook for Android > ------------------------------ > *From:* ARIN-consult on behalf of Bram > Abramson > *Sent:* Wednesday, May 25, 2022 9:26:59 AM > *To:* ARIN-consult > *Subject:* [ARIN-consult] increasing 2FA take-up > > > All, > > The current consultation is about rendering SMS a 2FA option, then making > 2FA mandatory. But it also notes that TOTP 2FA has been available since > 2015 with a 3.2 percent take-up. > > Optional 2FA is perhaps inevitably doomed to low take-up, but I it?s > likely worth documenting any learnings from the implementation thus far, on > the way to that 3.2 percent take-up: > > - > > Have most folks involved in this discussion already activated 2FA (are > we preaching to the converted)? If not ? why has it made sense for you not > to? > - > > Do we think most of the broader community is aware of the 2FA > opportunity ? and are there thoughts, UX or otherwise, on why the crushing > majority of folks haven?t availed themselves of it? > > Thanks, and cheers, > ------------------------------ > > Bram Abramson > bda at bazu.org / @bramabramson > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: From ross at tajvar.io Wed May 25 11:41:14 2022 From: ross at tajvar.io (Ross Tajvar) Date: Wed, 25 May 2022 11:41:14 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: > > I remain unconvinced that inflicting 2FA on me solves a real problem that > actually exists. I'm not sure why you (and others) seem to think 2FA is so incredibly inconvenient. In my experience, it only takes a few extra seconds, or a few extra clicks/taps depending on how it's set up. The added overhead really is very small. Perhaps requiring better (non-dictionary) passwords on accounts that don?t > have 2FA would be a solution more targeted at the actual problem. How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult < arin-consult at arin.net> wrote: > > > On May 25, 2022, at 08:13 , Matt Harris wrote: > > > Matt Harris? > | VP of Infrastructure > 816?256?5446 > | Direct > Looking for help? > *Helpdesk* > | *Email Support* > > We build customized end?to?end technology solutions powered by NetFire Cloud. > On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult < > arin-consult at arin.net> wrote: > >> I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty awful, >> but all forms of 2FA come with a variety of inconveniences. >> >> With an account that goes back to the beginnings of ARIN online, I?ve >> never had a security problem with my ARIN online account, so I think that >> 2FA is a solution looking for a problem here. >> >> I know that?s not a popular view among the more security conscious, but >> the reality is that security should be commensurate with what is being >> protected. Let users who think their account warrants such additional >> measures opt in. Let those of use who feel that our passwords are adequate >> continue in that manner. >> >> Owen >> > > Owen, > The problem is that compromised ARIN accounts can result in issues that > don't just impact the owner of the account that held those resources. > Compromised ARIN accounts with resources can potentially adversely impact > us all in terms of upticks in spam and the resulting management burdens, at > the very least, and potentially in other (perhaps even thus far unforeseen) > ways as well. > > > I disagree? If my ARIN account is compromised, I?m going to get notified > of any changes made. (So far, that hasn?t happened). I know exactly where > to go to get those changes reverted quickly. > > My account is associated with resources, but I remain unconvinced that > inflicting 2FA on me solves a real problem that actually exists. > > I do agree with your statement "security should be commensurate with what > is being protected." Thus, I would consider that we perhaps continue to > allow accounts without control of any resources to continue without > requiring 2fa, only requiring it when resources are allocated. An ARIN > account with control of nothing, or perhaps just contact records for SWIP'd > space, etc, is not one that is a huge hazard to the community at large imho > compared to one that controls ASNs or IPv4 and IPv6 resources. > > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t > have 2FA would be a solution more targeted at the actual problem. > > Owen > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: From jcurran at arin.net Wed May 25 11:44:39 2022 From: jcurran at arin.net (John Curran) Date: Wed, 25 May 2022 15:44:39 +0000 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: On 25 May 2022, at 11:40 AM, Scott Leibrand > wrote: Putting TOTP in 1Password makes login far more convenient than SMS 2FA, and almost as convenient as password-only, even for shared accounts. ARIN should probably provide instructions for how to add your TOTP to 1Password (and any other password managers that support that workflow), because it's not a very intuitive enrollment experience. Scott - Instructions for adding 2FA via TOTP are available here (this is what all of the ARIN 2FA documentation points to) ? https://www.arin.net/reference/materials/security/twofactor/ Do you have any suggestions for improvement? Thanks! /John John Curran President and CEO American Registry for Internet Numbers -------------- next part -------------- An HTML attachment was scrubbed... URL: From ross at tajvar.io Wed May 25 11:45:35 2022 From: ross at tajvar.io (Ross Tajvar) Date: Wed, 25 May 2022 11:45:35 -0400 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: Just to add to this, I use BitWarden and it supports TOTP as well. It's a single extra click (or ctrl+V) to get the OTP. [image: image.png] On Wed, May 25, 2022 at 11:41 AM Scott Leibrand wrote: > Putting TOTP in 1Password makes login far more convenient than SMS 2FA, > and almost as convenient as password-only, even for shared accounts. > > ARIN should probably provide instructions for how to add your TOTP to > 1Password (and any other password managers that support that workflow), > because it's not a very intuitive enrollment experience. > > We could also make 2FA only mandatory for activities that change resource > control (outbound transfers, reassignments, etc.)... > > -Scott > > On Wed, May 25, 2022 at 8:21 AM Richard Laager wrote: > >> You can put your TOTP in something like 1Password. >> >> -- >> Richard >> >> On May 25, 2022, at 09:46, Adam Thompson wrote: >> >> ? >> I have not enabled 2FA. >> >> TOTP lies at the unfortunate confluence of vendor misfeatures and >> organizational policies that render it not durable or resilient in the face >> of mobile device failure (which seems to happen to me a LOT more often than >> normal). Possibly I don't know something about our approved >> authenticator apps that might solve the problem, but last time I checked, >> it was a no-go for me. >> >> I've instead opted to use a long, randomly-generated password that I can >> store in ways that are both secure and durable/resilient. >> >> -Adam >> >> Get Outlook for Android >> ------------------------------ >> *From:* ARIN-consult on behalf of Bram >> Abramson >> *Sent:* Wednesday, May 25, 2022 9:26:59 AM >> *To:* ARIN-consult >> *Subject:* [ARIN-consult] increasing 2FA take-up >> >> >> All, >> >> The current consultation is about rendering SMS a 2FA option, then making >> 2FA mandatory. But it also notes that TOTP 2FA has been available since >> 2015 with a 3.2 percent take-up. >> >> Optional 2FA is perhaps inevitably doomed to low take-up, but I it?s >> likely worth documenting any learnings from the implementation thus far, on >> the way to that 3.2 percent take-up: >> >> - >> >> Have most folks involved in this discussion already activated 2FA >> (are we preaching to the converted)? If not ? why has it made sense for you >> not to? >> - >> >> Do we think most of the broader community is aware of the 2FA >> opportunity ? and are there thoughts, UX or otherwise, on why the crushing >> majority of folks haven?t availed themselves of it? >> >> Thanks, and cheers, >> ------------------------------ >> >> Bram Abramson >> bda at bazu.org / @bramabramson >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN >> Consult Mailing >> List (ARIN-consult at arin.net). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the >> ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN >> Consult Mailing >> List (ARIN-consult at arin.net). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the >> ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. >> > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 5721 bytes Desc: not available URL: From scottleibrand at gmail.com Wed May 25 11:52:04 2022 From: scottleibrand at gmail.com (Scott Leibrand) Date: Wed, 25 May 2022 08:52:04 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: On Wed, May 25, 2022 at 8:41 AM Ross Tajvar wrote: > I remain unconvinced that inflicting 2FA on me solves a real problem that >> actually exists. > > I'm not sure why you (and others) seem to think 2FA is so incredibly > inconvenient. In my experience, it only takes a few extra seconds, or a few > extra clicks/taps depending on how it's set up. The added overhead really > is very small. > When 2FA is set up "properly", you're correct. It's often not, either by users or system designers. One main challenge is when users make one of the very common errors in managing 2FA, like losing access to their second factor (often by only enrolling their phone and then switching phones). It's also quite common to want to log in but not have immediate access to your second factor. That can be addressed by allowing multiple types of 2FA to be set up simultaneously, but many implementations do so poorly. In ARIN's case, there's the added complexity of ARIN accounts being the property of an organization, not an individual, and all the chain-of-custody complications that introduces. Many organizations solve those by using shared credentials. If they don't have a shared-credential storage system like 1Password set up, 2FA significantly complicates that workflow. Whatever solutions you introduce to all of those problems, you have all the overhead of resetting people's 2FA credentials when they inevitably lose access. Such account reset workflows must be secure enough to avoid social engineering making the problem worse than it is today, while minimizing the additional burden on users and staff. This is not an easy problem, so some of the maximalist positions that have been previously expressed on this thread strike me as poorly-considered. -Scott -------------- next part -------------- An HTML attachment was scrubbed... URL: From scottleibrand at gmail.com Wed May 25 11:58:08 2022 From: scottleibrand at gmail.com (Scott Leibrand) Date: Wed, 25 May 2022 08:58:08 -0700 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: You currently have: > > 1. Open your third-party authenticator application. Choose one of the > following: > > > - Enter the 16-character key that is displayed in ARIN Online into > your authenticator application; or > - Choose Show QR Code and scan the code with your authenticator > application. > > You could add a section near there with usability tips. It should point out the possibility and extra convenience of putting the TOTP into password managers like 1Password and BitWarden, and for those not doing so, provide some guidance on how to ensure that your third-party authenticator application allows you to store your TOTP on more than one device (or otherwise back it up). It would also be useful to link to another page (written by ARIN or by the maker of each password manager) with per-application instructions (likely with screenshots) of how to add the TOTP to the password manager. It's not ARIN's job to directly support third-party authenticator applications, but IMO there is a best-practices gap that ARIN could fill here. -Scott On Wed, May 25, 2022 at 8:44 AM John Curran wrote: > > > On 25 May 2022, at 11:40 AM, Scott Leibrand > wrote: > > Putting TOTP in 1Password makes login far more convenient than SMS 2FA, > and almost as convenient as password-only, even for shared accounts. > > ARIN should probably provide instructions for how to add your TOTP to > 1Password (and any other password managers that support that workflow), > because it's not a very intuitive enrollment experience. > > > Scott - > > Instructions for adding 2FA via TOTP are available here (this is what all > of the ARIN 2FA documentation points to) ? > https://www.arin.net/reference/materials/security/twofactor/ > > Do you have any suggestions for improvement? > > Thanks! > /John > > John Curran > President and CEO > American Registry for Internet Numbers > > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Wed May 25 12:25:19 2022 From: athompso at athompso.net (Adam Thompson) Date: Wed, 25 May 2022 16:25:19 +0000 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: Given that I'd never seen that page before, and I thought I'd read every page on the ARIN website at least once, I repeat my earlier assertion that an education campaign will be necessary if 2FA becomes mandatory. I'm also concerned about language on that page that says the Recovery Code is the *only* way to regain access to the account. That is unacceptable in at least a couple of trivial scenarios (fired, died, fire, disaster, corrupted TOTP software, etc.). -Adam Get Outlook for Android ________________________________ From: ARIN-consult on behalf of John Curran Sent: Wednesday, May 25, 2022 10:44:39 AM To: Scott Leibrand Cc: ARIN-consult Subject: Re: [ARIN-consult] increasing 2FA take-up On 25 May 2022, at 11:40 AM, Scott Leibrand > wrote: Putting TOTP in 1Password makes login far more convenient than SMS 2FA, and almost as convenient as password-only, even for shared accounts. ARIN should probably provide instructions for how to add your TOTP to 1Password (and any other password managers that support that workflow), because it's not a very intuitive enrollment experience. Scott - Instructions for adding 2FA via TOTP are available here (this is what all of the ARIN 2FA documentation points to) ? https://www.arin.net/reference/materials/security/twofactor/ Do you have any suggestions for improvement? Thanks! /John John Curran President and CEO American Registry for Internet Numbers -------------- next part -------------- An HTML attachment was scrubbed... URL: From bill at herrin.us Wed May 25 12:39:12 2022 From: bill at herrin.us (William Herrin) Date: Wed, 25 May 2022 09:39:12 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: On Wed, May 25, 2022 at 8:41 AM Ross Tajvar wrote: >> I remain unconvinced that inflicting 2FA on me solves a real problem that actually exists. > > I'm not sure why you (and others) seem to think 2FA is so incredibly inconvenient. In my experience, it only takes a few extra seconds, or a few extra clicks/taps depending on how it's set up. The added overhead really is very small. It requires orgs which rarely interact with ARIN to keep track of THE cell phone which has the 2FA app. Oh, and the phone has to still be working. Otherwise, every interaction with ARIN for such orgs starts with a painful and likely insecure account recovery procedure. >> Perhaps requiring better (non-dictionary) passwords on accounts that don?t have 2FA would be a solution more targeted at the actual problem. > > How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. The last time I worked on this problem I followed the NIST guidance: check the proposed password against a large list of known compromised passwords (e.g. https://github.com/danielmiessler/SecLists/tree/master/Passwords, https://drive.google.com/drive/folders/14xB93b5YveOzCY7EuDrcL5ElpN-HCNse) and reject it if found there. It took me a couple of days to find a decent data source and write an app around it. It was rather trivial. Dictionary attacks are ineffective against a site which rejects the overwhelming majority of passwords in the attack dictionary. > And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. Among the reasons I'm against mandatory 2FA. Regards, Bill Herrin -- William Herrin bill at herrin.us https://bill.herrin.us/ From jcurran at arin.net Wed May 25 12:56:20 2022 From: jcurran at arin.net (John Curran) Date: Wed, 25 May 2022 16:56:20 +0000 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> Message-ID: <8B36EBF0-2500-4CEA-A484-7A8632A0105C@arin.net> > On 25 May 2022, at 10:40 AM, David R Huberman wrote: > > I note that in the Engineering Report at ARIN49, found at: > > https://www.arin.net/participate/meetings/ARIN49/materials/425_engineeringreport.pdf > > ... only a minority percentage of ARIN Online users login with any frequency. Further, as noted by others, the priority in our thinking may need to be on ARIN Online accounts associated with number resources. Putting the two ideas together, I think the 3.2% number is a bit unfocused. > > Perhaps it would be helpful if we knew the percentage take-up of 2FA for ARIN Online accounts that are associated with number resources as we delve into this discussion. There are 193,275 total ARIN online accounts today. Of those, 36184 are associated with directly registered network/ASN number resources and of those accounts with resources, 3628 have 2FA enabled. So approximately 10% of the ARIN Online accounts associated with number resources have 2FA enabled. FYI, /John John Curran President and CEO American Registry for Internet Numbers From bill at herrin.us Wed May 25 13:00:55 2022 From: bill at herrin.us (William Herrin) Date: Wed, 25 May 2022 10:00:55 -0700 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: On Wed, May 25, 2022 at 8:40 AM Scott Leibrand wrote: > Putting TOTP in 1Password makes login far more convenient than SMS 2FA, and almost as convenient as password-only, even for shared accounts. Hi Scott, Putting TOTP in 1Password alongside your actual password reduces it to 1-factor authentication: access to 1Password. That both defeats the point of two factor authentication and makes your ARIN access dependent on a third party (1Password). Regards, Bill Herrin -- William Herrin bill at herrin.us https://bill.herrin.us/ From daveid at panix.com Wed May 25 13:08:25 2022 From: daveid at panix.com (David Huberman) Date: Wed, 25 May 2022 13:08:25 -0400 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: <8B36EBF0-2500-4CEA-A484-7A8632A0105C@arin.net> References: <8B36EBF0-2500-4CEA-A484-7A8632A0105C@arin.net> Message-ID: > On May 25, 2022, at 1:04 PM, John Curran wrote: > > There are 193,275 total ARIN online accounts today. > > Of those, 36184 are associated with directly registered network/ASN number resources and of those accounts with resources, 3628 have 2FA enabled. > > So approximately 10% of the ARIN Online accounts associated with number resources have 2FA enabled. Thanks so much, John! From kevinb at thewire.ca Wed May 25 13:13:53 2022 From: kevinb at thewire.ca (Kevin Blumberg) Date: Wed, 25 May 2022 17:13:53 +0000 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> References: <7893C5A0-41EB-4CA8-B526-8DB02DAFD237@bazu.org> Message-ID: Bram, I?ve been using it since Day 1 that the feature came out. https://www.arin.net/participate/community/acsp/suggestions/2013/2013-8/ My suggestion in 2013 was to allow multiple authentication options. Since almost a decade has gone by since the ACSP request, my only regret is including SMS as an option back then. It has to many known vulnerabilities, with many better options (including TOTP which is being used). I do find it interesting that people think they will have a say in whether MFA is mandatory or not. That ship sailed a long time ago, insurance companies are mandating MFA for systems, it isn?t a question of IF but WHEN it will be mandatory. TOTP is a great lowest common denominator, it doesn?t require any external connectivity for usage, and can be setup on multiple devices, if you have the private key or scan the QR code to those devices. I would still like to see a hardware token or other robust MFA solution. Kevin Blumberg From: ARIN-consult On Behalf Of Bram Abramson Sent: Wednesday, May 25, 2022 10:27 AM To: ARIN-consult Subject: [ARIN-consult] increasing 2FA take-up All, The current consultation is about rendering SMS a 2FA option, then making 2FA mandatory. But it also notes that TOTP 2FA has been available since 2015 with a 3.2 percent take-up. Optional 2FA is perhaps inevitably doomed to low take-up, but I it?s likely worth documenting any learnings from the implementation thus far, on the way to that 3.2 percent take-up: * Have most folks involved in this discussion already activated 2FA (are we preaching to the converted)? If not ? why has it made sense for you not to? * Do we think most of the broader community is aware of the 2FA opportunity ? and are there thoughts, UX or otherwise, on why the crushing majority of folks haven?t availed themselves of it? Thanks, and cheers, ________________________________ Bram Abramson bda at bazu.org / @bramabramson -------------- next part -------------- An HTML attachment was scrubbed... URL: From gary.buhrmaster at gmail.com Wed May 25 13:15:07 2022 From: gary.buhrmaster at gmail.com (Gary Buhrmaster) Date: Wed, 25 May 2022 17:15:07 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: On Wed, May 25, 2022 at 3:41 PM Ross Tajvar wrote: > .... And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) As long as the passphrase is not "correcthorsebatterystaple" which is now in lists of well known compromised passwords. (obligatory xkcd ref: https://xkcd.com/936/ ) From davidbass570 at gmail.com Wed May 25 13:17:20 2022 From: davidbass570 at gmail.com (David Bass) Date: Wed, 25 May 2022 13:17:20 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: We are generally *always* reviewing and recommending our customers enable 2fa on everything they use, and look for alternatives (when possible) for things that don?t. The problem is so much broader than people think. They don?t necessarily need to take, or change your data?if you are a high value target, then they may be able to use the data in your account as an attack vector to gain access to their ultimate target. Anyone in control of high value resources should be taking additional steps to protect their accounts. On Wed, May 25, 2022 at 12:39 PM William Herrin wrote: > On Wed, May 25, 2022 at 8:41 AM Ross Tajvar wrote: > >> I remain unconvinced that inflicting 2FA on me solves a real problem > that actually exists. > > > > I'm not sure why you (and others) seem to think 2FA is so incredibly > inconvenient. In my experience, it only takes a few extra seconds, or a few > extra clicks/taps depending on how it's set up. The added overhead really > is very small. > > It requires orgs which rarely interact with ARIN to keep track of THE > cell phone which has the 2FA app. Oh, and the phone has to still be > working. Otherwise, every interaction with ARIN for such orgs starts > with a painful and likely insecure account recovery procedure. > > > >> Perhaps requiring better (non-dictionary) passwords on accounts that > don?t have 2FA would be a solution more targeted at the actual problem. > > > > How would ARIN judge the complexity of a password? As far as I'm aware, > checking if it uses dictionary words is non-trivial. > > The last time I worked on this problem I followed the NIST guidance: > check the proposed password against a large list of known compromised > passwords (e.g. > https://github.com/danielmiessler/SecLists/tree/master/Passwords, > https://drive.google.com/drive/folders/14xB93b5YveOzCY7EuDrcL5ElpN-HCNse) > and reject it if found there. It took me a couple of days to find a > decent data source and write an app around it. It was rather trivial. > > Dictionary attacks are ineffective against a site which rejects the > overwhelming majority of passwords in the attack dictionary. > > > > And even then, a sufficiently long passphrase using dictionary words is > pretty secure (vs a short one) - I don't think it makes sense to penalize > users for that. > > Among the reasons I'm against mandatory 2FA. > > Regards, > Bill Herrin > > -- > William Herrin > bill at herrin.us > https://bill.herrin.us/ > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: From bill at herrin.us Wed May 25 13:22:32 2022 From: bill at herrin.us (William Herrin) Date: Wed, 25 May 2022 10:22:32 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: On Wed, May 25, 2022 at 10:17 AM David Bass wrote: > We are generally *always* reviewing and recommending our customers enable 2fa on everything they use Should every bank branch employ an armed guard? Most don't. One size never fits all. Regards, Bill Herrin -- William Herrin bill at herrin.us https://bill.herrin.us/ From scottleibrand at gmail.com Wed May 25 13:54:58 2022 From: scottleibrand at gmail.com (Scott Leibrand) Date: Wed, 25 May 2022 10:54:58 -0700 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: I use 1Password with a local vault, not their new cloud-based service (which has more account-recovery options, for better or for worse). My two factors are possession of my 1Password vault and knowledge of the master password to it. So the point of 2FA is not defeated by that setup, just delegated. The end result is more secure than SMS 2FA using a password I have to remember (and might mistype into a phishing site). -Scott On Wed, May 25, 2022 at 10:01 AM William Herrin wrote: > On Wed, May 25, 2022 at 8:40 AM Scott Leibrand > wrote: > > Putting TOTP in 1Password makes login far more convenient than SMS 2FA, > and almost as convenient as password-only, even for shared accounts. > > Hi Scott, > > Putting TOTP in 1Password alongside your actual password reduces it to > 1-factor authentication: access to 1Password. That both defeats the > point of two factor authentication and makes your ARIN access > dependent on a third party (1Password). > > Regards, > Bill Herrin > > -- > William Herrin > bill at herrin.us > https://bill.herrin.us/ > -------------- next part -------------- An HTML attachment was scrubbed... URL: From gert at space.net Wed May 25 14:16:55 2022 From: gert at space.net (Gert Doering) Date: Wed, 25 May 2022 20:16:55 +0200 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: Hi, On Wed, May 25, 2022 at 11:41:14AM -0400, Ross Tajvar wrote: > > I remain unconvinced that inflicting 2FA on me solves a real problem that > > actually exists. > > I'm not sure why you (and others) seem to think 2FA is so incredibly > inconvenient. In my experience, it only takes a few extra seconds, or a few > extra clicks/taps depending on how it's set up. The added overhead really > is very small. I'm generally in favour of 2FA. But then... last week, RIPE meeting in Berlin, with physical presence there. Tried to log into the RIPE access system, only to discover that The Device that has *this particular* 2FA token was left at home. A few months before, trying to go to Teams for a customer that required "set up 2FA initially" for that account - and then turned it on for "must use 2FA once a week". Yeah, no big deal. 2FA token was on an Android device that was decommissioned because "old and half broken", and of course, Android-to-Android "new phone!" transfers don't do that. Do I have a Yubikey? Yes, of course. Do I not use it for all I should? Yes, because I carry around enough stuff with me... Just anecdotes, and me having not enough foresight? Of course. But 2FA is not "just a few moments and then it won't bother you anymore, ever". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 From bjones at vt.edu Wed May 25 14:21:24 2022 From: bjones at vt.edu (Brian Jones) Date: Wed, 25 May 2022 14:21:24 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: <090BEBC5-5953-49FE-B029-EA9D3CDC57E2@vt.edu> I for one am glad 2FA was added as an option. My ARIN account was rendered unreachable multiple times due to someone trying my email/account too many times, never successful mind you, but each time I had to open a ticket with ARIN to get my account re-enabled. I have not had this problem at all since 2FA was added as an option and I enabled it. Long time ARIN Tech/Admin POC for Virginia Tech. Brian Jones bjones at vt.edu > On May 25, 2022, at 3:12 AM, Owen DeLong via ARIN-consult wrote: > > With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that 2FA is a solution looking for a problem here. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: Message signed with OpenPGP URL: From jcurran at arin.net Wed May 25 14:30:26 2022 From: jcurran at arin.net (John Curran) Date: Wed, 25 May 2022 18:30:26 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: <81057CFB-8964-4CCF-AB94-841F85B4E3D8@arin.net> Gert ? Just curious - on those occasions where you were now on a new device, were you still receiving SMS messages on the same number? (i.e., if you had been using password and SMS 2FA instead, would you have been equally out of luck?) Thanks, /John John Curran President and CEO American Registry for Internet Numbers > On 25 May 2022, at 2:16 PM, Gert Doering wrote: > > Hi, > > On Wed, May 25, 2022 at 11:41:14AM -0400, Ross Tajvar wrote: >>> I remain unconvinced that inflicting 2FA on me solves a real problem that >>> actually exists. >> >> I'm not sure why you (and others) seem to think 2FA is so incredibly >> inconvenient. In my experience, it only takes a few extra seconds, or a few >> extra clicks/taps depending on how it's set up. The added overhead really >> is very small. > > I'm generally in favour of 2FA. > > But then... last week, RIPE meeting in Berlin, with physical presence > there. Tried to log into the RIPE access system, only to discover that > The Device that has *this particular* 2FA token was left at home. > > A few months before, trying to go to Teams for a customer that required > "set up 2FA initially" for that account - and then turned it on for > "must use 2FA once a week". Yeah, no big deal. 2FA token was on an > Android device that was decommissioned because "old and half broken", > and of course, Android-to-Android "new phone!" transfers don't do that. > > Do I have a Yubikey? Yes, of course. Do I not use it for all I should? > Yes, because I carry around enough stuff with me... > > Just anecdotes, and me having not enough foresight? Of course. > > But 2FA is not "just a few moments and then it won't bother you > anymore, ever". > > Gert Doering > -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. From beckman at angryox.com Wed May 25 16:42:33 2022 From: beckman at angryox.com (Peter Beckman) Date: Wed, 25 May 2022 16:42:33 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: <702abc39-668c-8fd2-b211-ef88784edcfc@angryox.com> I've read through most of the comments. tl;dr: I support mandatory TOTP 2FA, and strongly urge ARIN to consider support for physical tokens such as Yubikey. Summary - Bad things can be done when someone gains unauthorized access to an ARIN account - While individuals might use 16+ character random passwords that are never used for other sites, in 2022 most people still don't, and just have a handful of passwords they memorize - Password re-use is not detectable by any one organization, and thus requiring TOTP prevents accounts that re-use passwords from being an attack vector due to breaches on other websites/systems - Not enough people use a Password Manager like LastPass, 1Password, DashLane, etc. But when they do, TOTP 2FA becomes a non-issue. Plus these PW Managers securely deploy your logins to various devices, still protected with a passphrase in addition to the OS account passphrase or biometric, making the argument of a "single device lost" moot - Most TOTP 2FA implementations also provide backup codes to use in case the TOTP 2FA access is lost. These should be stored by the user in a secure way somewhere - While Owen and Bill may practice excellent personal security with random not-used-on-any-other-website-or-login passwords, most people do not. One Man-in-the-Middle attack because one didn't notice that the AT&T Hotspot they connected to wasn't really AT&T and they login into ARIN and poof, their accounts are accessed by a 3rd party for all lengths of time, whereas TOTP would give the attacker a 90 second window (implementations usually accept the previous, current, and next code to account for time drift) to log into the account, otherwise they'd be locked out. TOTP 2FA is the most portable and best generally used option currently in existence. Physical tokens, such as Yubikeys, are also excellent, and ARIN should consider providing support for this for those willing to jump through such hoops for security. SMS, while better in 2022, still uses an out-of-band over-the-air network where changing the eSPID/SPID/NNID for SMS or SIM cloning is still a potential attack vector. Certificate-based authentication is also a possible path, but it is NOT implemented yet in an easy way for most people. Any 2FA puts limits on the ability for an unauthorized 3rd party to access one's account. TOTP puts a 90-second window in place if someone knows the code at a certain point of time, and then that window is gone. Just because one has "never had a security problem" does not mean that one has never occurred, and that one cannot occur in the future. Breaches occur with regularity across the internet, and it seems ARIN accounts already have been. Password Managers eliminate the "variety of inconveniences" as you hit "paste" after you tapped the command keyboard shortcut to fill the login, which starts with verifying the domain matches your Password Manager's record for your login. The negative impacts of individual's bad security choices are not limited to that individual, and thus, I believe ARIN is well within its position to require 2FA in order to enforce security best practices. Until a better and more secure way is presented, I support ARIN requiring TOTP 2FA or a physical token in order to access ARIN accounts and assets. Beckman On Wed, 25 May 2022, Owen DeLong via ARIN-consult wrote: > I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty awful, but all forms of 2FA come with a variety of inconveniences. > > With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that 2FA is a solution looking for a problem here. > > I know that?s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that our passwords are adequate continue in that manner. > > Owen > > >> On May 24, 2022, at 09:46, ARIN wrote: >> >> **Background** >> >> In 2015, ARIN deployed a Time-Based One-Time password (TOTP) implementation of Two-Factor Authentication (2FA). Since the time of implementing that login security feature, 3.2 percent of ARIN Online users have opted to use 2FA with their accounts. >> >> Since October 2020, the ARIN Online system has been subject to a series of dictionary-based password guessing attacks. In March of 2021, we conducted ACSP Consultation 2021.2: Password Security for ARIN Online Accounts (https://www.arin.net/participate/community/acsp/consultations/2021/2021-2/) on proposed improvements to increase account security. This consultation resulted in an agreement to move forward with several improvements that have subsequently been deployed. However, we continue to see frequent attacks on our log-in systems, and ARIN staff continues to be heavily engaged in mitigating these attacks. Accounts not using 2FA are susceptible to these attacks. We recently updated the community on this topic during ARIN 49 held in Nashville and online in April. You can review this information from the ARIN 49 Meeting Report (https://www.arin.net/participate/meetings/ARIN49/) by looking for the presentation titled ?Brute Force Login Attacks?. >> >> It is our intention to make 2FA mandatory for all existing and new ARIN Online accounts going forward. The security of ARIN Online accounts is paramount to the success of the registry, and we do not believe it is tenable to continue without making 2FA required for all ARIN Online accounts. >> >> We are currently developing a second method of 2FA use with ARIN Online to add to our long-deployed TOTP implementation. In the coming months, we will deploy a Short Message Service (SMS) 2FA implementation, thereby adding a second 2FA option for ARIN Online users. At that time, users will be able to choose between two types of 2FA ? SMS and TOTP. Adoption of TOTP 2FA has been limited in part due to perceived complexity, and the addition of SMS-based 2FA will provide a second option that is easier to use for many customers ? and provide much more protection than the simple username-password condition of many ARIN Online user accounts today. (ARIN also plans on adding support for a third 2FA option in the future ? Fast Identity Online 2 (FIDO2) ? in response to community suggestions, but we do not believe it is prudent to delay requiring 2FA on ARIN Online accounts until that third option becomes available.) >> >> **Requiring 2FA For ARIN Online Accounts** >> >> By requiring 2FA for ARIN Online accounts that control number resources, the ARIN community should see stronger security for the registry, reduced risk of account fraud attempts, and increased confidence in the integrity of their ARIN resources. >> >> ARIN intends to require 2FA for all ARIN Online accounts shortly after SMS-based 2FA authentication is generally available. We are seeking confirmation from the ARIN community regarding this plan, and ask the following consultation question: >> >> ------------------- >> Once SMS-based two-factor authentication (2FA) is available for ARIN Online, do you believe ARIN *should not* proceed with requiring 2FA authentication (SMS-based or TOTP) for all ARIN Online accounts? If so, why? >> ------------------- >> >> The feedback you provide during this consultation will help form our path forward to increasing the security of ARIN Online for all customers. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: >> >> http://lists.arin.net/mailman/listinfo/arin-consult >> >> This consultation will remain open through 5:00 PM ET on 24 June 2022. >> >> Regards, >> >> John Curran >> President and CEO >> American Registry for Internet Numbers (ARIN) >> >> Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts >> >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN Consult Mailing >> List (ARIN-consult at arin.net). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- From athompson at merlin.mb.ca Wed May 25 17:08:55 2022 From: athompson at merlin.mb.ca (Adam Thompson) Date: Wed, 25 May 2022 21:08:55 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <81057CFB-8964-4CCF-AB94-841F85B4E3D8@arin.net> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <81057CFB-8964-4CCF-AB94-841F85B4E3D8@arin.net> Message-ID: FWIW, I've had both scenarios happen to me within the last 2 years. Many SMS-based 2FA systems suddenly broke on one of those occasions, for obvious reasons. Both involved phones and phone numbers not under my direct control, i.e. corporate. -Adam Adam Thompson Consultant, Infrastructure Services MERLIN 100 - 135 Innovation Drive Winnipeg, MB R3T 6A8 (204) 977-6824 or 1-800-430-6404 (MB only) https://www.merlin.mb.ca Chat with me on Teams: athompson at merlin.mb.ca > -----Original Message----- > From: ARIN-consult On Behalf Of John > Curran > Sent: Wednesday, May 25, 2022 1:30 PM > To: Gert Doering > Cc: > Subject: Re: [ARIN-consult] Consultation on Requiring Two-Factor > Authentication (2FA) for ARIN Online Accounts > > Gert ? > > Just curious - on those occasions where you were now on a new device, > were you still receiving SMS messages on the same number? > > (i.e., if you had been using password and SMS 2FA instead, would you > have been equally out of luck?) > > Thanks, > /John > > John Curran > President and CEO > American Registry for Internet Numbers > > > On 25 May 2022, at 2:16 PM, Gert Doering wrote: > > > > Hi, > > > > On Wed, May 25, 2022 at 11:41:14AM -0400, Ross Tajvar wrote: > >>> I remain unconvinced that inflicting 2FA on me solves a real > problem that > >>> actually exists. > >> > >> I'm not sure why you (and others) seem to think 2FA is so > incredibly > >> inconvenient. In my experience, it only takes a few extra seconds, > or a few > >> extra clicks/taps depending on how it's set up. The added overhead > really > >> is very small. > > > > I'm generally in favour of 2FA. > > > > But then... last week, RIPE meeting in Berlin, with physical > presence > > there. Tried to log into the RIPE access system, only to discover > that > > The Device that has *this particular* 2FA token was left at home. > > > > A few months before, trying to go to Teams for a customer that > required > > "set up 2FA initially" for that account - and then turned it on for > > "must use 2FA once a week". Yeah, no big deal. 2FA token was on an > > Android device that was decommissioned because "old and half > broken", > > and of course, Android-to-Android "new phone!" transfers don't do > that. > > > > Do I have a Yubikey? Yes, of course. Do I not use it for all I > should? > > Yes, because I carry around enough stuff with me... > > > > Just anecdotes, and me having not enough foresight? Of course. > > > > But 2FA is not "just a few moments and then it won't bother you > > anymore, ever". > > > > Gert Doering > > -- NetMaster > > -- > > have you enabled IPv6 on something today...? > > > > SpaceNet AG Vorstand: Sebastian v. Bomhard, > Michael Emmer > > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner- > Culemann > > D-80807 Muenchen HRB: 136055 (AG Muenchen) > > Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 > > _______________________________________________ > > ARIN-Consult > > You are receiving this message because you are subscribed to the > ARIN Consult Mailing > > List (ARIN-consult at arin.net). > > Unsubscribe or manage your mailing list subscription at: > > https://lists.arin.net/mailman/listinfo/arin-consult Please contact > the ARIN Member Services > > Help Desk at info at arin.net if you experience any issues. > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact > the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. From athompson at merlin.mb.ca Wed May 25 17:33:31 2022 From: athompson at merlin.mb.ca (Adam Thompson) Date: Wed, 25 May 2022 21:33:31 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: The problem I have with MFA boils down to this: * Everyone has a reasonably convenient ?forgot my password? feature/link/process that takes minutes, not hours. * Almost no-one has a reasonably convenient ?lost my token? feature/link/process (?yet). Those that do can take many hours or days. I?ve seen arguments along the lines of ?well, just don?t lose your authenticator/token/key/thingy?, but I?ve been locked out of MFA-secured accounts and had to go through onerous, time-consuming processes to regain access, I think 4 times? within my memory. One of those times was not my fault in any way, created a very large problem with significant lasting consequences, and was utterly irresoluble until the token situation was manually resolved by someone else literally inventing a new process in real-time. Hardware tokens fail: misplacing it, irretrievable loss (e.g. down a sewer grate, into a fire, etc.), physical damage (car tire, in one case), electrostatic damage, premature battery or component failure, clock skew, I?ve seen them all. Software authenticators fail: uninstalling the app inadvertently (or deliberately), corrupting the app (usually inadvertent), new app update causes it to crash (but only for 2 or 3 people, making diagnosis impossible), forgetting the master password to the app, losing (or losing access to) the device containing the app, I?ve seen all of those, too. Any MFA system that does not permit multiple simultaneous enrolled modes of authentication ? which today seems to be the vast majority of them ? causes more problems that it solves. I do NOT dispute the need to move away from simple userid/password authentication, but please, please, please, at least let users protect themselves from themselves. Allow enrolment of multiple keys, multiple TOTP authenticators, multiple phone#s or emails to receive one-time codes, multiple FIDO keys, etc. I?m going to keep harping on this as long as I keep losing/damaging/destroying/corrupting MFA tokens, both hard and soft. Right now, my employer applies MFA via a very-large-company?s-authenticator; to mitigate what I see as an enormous risk, I have the authenticator loaded on a backup phone that?s reasonably accessible so I?m never 100% dead in the water. Relatively few authenticators let me do this, in my experience. I can?t share TOTP keys between phones with this particular software, for some reason, using a corporate account. I?ve already had to use that backup phone once, while responding to a customer-down event ? not a time when I want to be locked out of my systems. MFA/MFA mitigates one set of risks but introduces another. If those new risks aren?t managed/addressed/mitigated, we?ll just exchange one set of problems for a different set of problems. They?re not that difficult to mitigate, as long as it?s included in the design. -Adam Adam Thompson Consultant, Infrastructure Services [MERLIN] 100 - 135 Innovation Drive Winnipeg, MB R3T 6A8 (204) 977-6824 or 1-800-430-6404 (MB only) https://www.merlin.mb.ca [cid:image002.png at 01D87051.47981240]Chat with me on Teams From: ARIN-consult On Behalf Of Ross Tajvar Sent: Wednesday, May 25, 2022 10:41 AM To: Owen DeLong Cc: Subject: Re: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (MFA) for ARIN Online Accounts I remain unconvinced that inflicting MFA on me solves a real problem that actually exists. I'm not sure why you (and others) seem to think MFA is so incredibly inconvenient. In my experience, it only takes a few extra seconds, or a few extra clicks/taps depending on how it's set up. The added overhead really is very small. Perhaps requiring better (non-dictionary) passwords on accounts that don?t have MFA would be a solution more targeted at the actual problem. How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult > wrote: On May 25, 2022, at 08:13 , Matt Harris > wrote: Matt Harris? | VP of Infrastructure 816?256?5446 | Direct Looking for help? Helpdesk | Email Support [https://netfire.net/Flag-United-States-of-America.jpg] We build customized end?to?end technology solutions powered by NetFire Cloud. On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult > wrote: I?m not in favor of requiring MFA. I agree that SMS MFA is pretty awful, but all forms of MFA come with a variety of inconveniences. With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that MFA is a solution looking for a problem here. I know that?s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that our passwords are adequate continue in that manner. Owen Owen, The problem is that compromised ARIN accounts can result in issues that don't just impact the owner of the account that held those resources. Compromised ARIN accounts with resources can potentially adversely impact us all in terms of upticks in spam and the resulting management burdens, at the very least, and potentially in other (perhaps even thus far unforeseen) ways as well. I disagree? If my ARIN account is compromised, I?m going to get notified of any changes made. (So far, that hasn?t happened). I know exactly where to go to get those changes reverted quickly. My account is associated with resources, but I remain unconvinced that inflicting MFA on me solves a real problem that actually exists. I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring MFA, only requiring it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. Perhaps requiring better (non-dictionary) passwords on accounts that don?t have MFA would be a solution more targeted at the actual problem. Owen _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 13827 bytes Desc: image001.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image002.png Type: image/png Size: 359 bytes Desc: image002.png URL: From ross at tajvar.io Wed May 25 17:36:42 2022 From: ross at tajvar.io (Ross Tajvar) Date: Wed, 25 May 2022 17:36:42 -0400 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: To add to this - I access my BitWarden vault with 2FA using a hardware token. In my view, the two factors to access my ARIN account are 1) knowledge of my ARIN password (which could potentially be brute-forced or harvested via phishing or something) and 2) access to my BitWarden vault. Thus, my ARIN account has 2FA, and my BitWarden account also has 2FA (meaning ARIN access is not reduced to 1FA). On Wed, May 25, 2022 at 1:55 PM Scott Leibrand wrote: > I use 1Password with a local vault, not their new cloud-based service > (which has more account-recovery options, for better or for worse). My two > factors are possession of my 1Password vault and knowledge of the master > password to it. So the point of 2FA is not defeated by that setup, just > delegated. The end result is more secure than SMS 2FA using a password I > have to remember (and might mistype into a phishing site). > > -Scott > > On Wed, May 25, 2022 at 10:01 AM William Herrin wrote: > >> On Wed, May 25, 2022 at 8:40 AM Scott Leibrand >> wrote: >> > Putting TOTP in 1Password makes login far more convenient than SMS 2FA, >> and almost as convenient as password-only, even for shared accounts. >> >> Hi Scott, >> >> Putting TOTP in 1Password alongside your actual password reduces it to >> 1-factor authentication: access to 1Password. That both defeats the >> point of two factor authentication and makes your ARIN access >> dependent on a third party (1Password). >> >> Regards, >> Bill Herrin >> >> -- >> William Herrin >> bill at herrin.us >> https://bill.herrin.us/ >> > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: From kevinb at thewire.ca Wed May 25 18:15:21 2022 From: kevinb at thewire.ca (Kevin Blumberg) Date: Wed, 25 May 2022 22:15:21 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: <4e2c5db0-fbd3-4de4-a1ef-ef3e0c5054e0@thewire.ca> Adam, You can enroll multiple devices with TOTP today. When you register and use the QR code, do it on multiple devices. You can also copy the manual secret and put that in to a device anytime. Kevin ________________________________ From: Adam Thompson Sent: Wednesday, May 25, 2022 5:33 p.m. To: Subject: Re: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts The problem I have with MFA boils down to this: * Everyone has a reasonably convenient ?forgot my password? feature/link/process that takes minutes, not hours. * Almost no-one has a reasonably convenient ?lost my token? feature/link/process (?yet). Those that do can take many hours or days. I?ve seen arguments along the lines of ?well, just don?t lose your authenticator/token/key/thingy?, but I?ve been locked out of MFA-secured accounts and had to go through onerous, time-consuming processes to regain access, I think 4 times? within my memory. One of those times was not my fault in any way, created a very large problem with significant lasting consequences, and was utterly irresoluble until the token situation was manually resolved by someone else literally inventing a new process in real-time. Hardware tokens fail: misplacing it, irretrievable loss (e.g. down a sewer grate, into a fire, etc.), physical damage (car tire, in one case), electrostatic damage, premature battery or component failure, clock skew, I?ve seen them all. Software authenticators fail: uninstalling the app inadvertently (or deliberately), corrupting the app (usually inadvertent), new app update causes it to crash (but only for 2 or 3 people, making diagnosis impossible), forgetting the master password to the app, losing (or losing access to) the device containing the app, I?ve seen all of those, too. Any MFA system that does not permit multiple simultaneous enrolled modes of authentication ? which today seems to be the vast majority of them ? causes more problems that it solves. I do NOT dispute the need to move away from simple userid/password authentication, but please, please, please, at least let users protect themselves from themselves. Allow enrolment of multiple keys, multiple TOTP authenticators, multiple phone#s or emails to receive one-time codes, multiple FIDO keys, etc. I?m going to keep harping on this as long as I keep losing/damaging/destroying/corrupting MFA tokens, both hard and soft. Right now, my employer applies MFA via a very-large-company?s-authenticator; to mitigate what I see as an enormous risk, I have the authenticator loaded on a backup phone that?s reasonably accessible so I?m never 100% dead in the water. Relatively few authenticators let me do this, in my experience. I can?t share TOTP keys between phones with this particular software, for some reason, using a corporate account. I?ve already had to use that backup phone once, while responding to a customer-down event ? not a time when I want to be locked out of my systems. MFA/MFA mitigates one set of risks but introduces another. If those new risks aren?t managed/addressed/mitigated, we?ll just exchange one set of problems for a different set of problems. They?re not that difficult to mitigate, as long as it?s included in the design. -Adam Adam Thompson Consultant, Infrastructure Services [MERLIN] 100 - 135 Innovation Drive Winnipeg, MB R3T 6A8 (204) 977-6824 or 1-800-430-6404 (MB only) https://www.merlin.mb.ca [cid:image002.png at 01D87051.47981240]Chat with me on Teams From: ARIN-consult On Behalf Of Ross Tajvar Sent: Wednesday, May 25, 2022 10:41 AM To: Owen DeLong Cc: Subject: Re: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (MFA) for ARIN Online Accounts I remain unconvinced that inflicting MFA on me solves a real problem that actually exists. I'm not sure why you (and others) seem to think MFA is so incredibly inconvenient. In my experience, it only takes a few extra seconds, or a few extra clicks/taps depending on how it's set up. The added overhead really is very small. Perhaps requiring better (non-dictionary) passwords on accounts that don?t have MFA would be a solution more targeted at the actual problem. How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult > wrote: On May 25, 2022, at 08:13 , Matt Harris > wrote: Matt Harris? | VP of Infrastructure 816?256?5446 | Direct Looking for help? Helpdesk | Email Support [https://netfire.net/Flag-United-States-of-America.jpg] We build customized end?to?end technology solutions powered by NetFire Cloud. On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult > wrote: I?m not in favor of requiring MFA. I agree that SMS MFA is pretty awful, but all forms of MFA come with a variety of inconveniences. With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that MFA is a solution looking for a problem here. I know that?s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that our passwords are adequate continue in that manner. Owen Owen, The problem is that compromised ARIN accounts can result in issues that don't just impact the owner of the account that held those resources. Compromised ARIN accounts with resources can potentially adversely impact us all in terms of upticks in spam and the resulting management burdens, at the very least, and potentially in other (perhaps even thus far unforeseen) ways as well. I disagree? If my ARIN account is compromised, I?m going to get notified of any changes made. (So far, that hasn?t happened). I know exactly where to go to get those changes reverted quickly. My account is associated with resources, but I remain unconvinced that inflicting MFA on me solves a real problem that actually exists. I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring MFA, only requiring it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. Perhaps requiring better (non-dictionary) passwords on accounts that don?t have MFA would be a solution more targeted at the actual problem. Owen _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 13827 bytes Desc: image001.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image002.png Type: image/png Size: 359 bytes Desc: image002.png URL: From ross at tajvar.io Wed May 25 18:22:34 2022 From: ross at tajvar.io (Ross Tajvar) Date: Wed, 25 May 2022 18:22:34 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <4e2c5db0-fbd3-4de4-a1ef-ef3e0c5054e0@thewire.ca> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <4e2c5db0-fbd3-4de4-a1ef-ef3e0c5054e0@thewire.ca> Message-ID: That's true as a side-effect of how TOTP enrollment works, but multiple device enrollment would need to be deliberately included as a feature (or not excluded) if FIDO support were to be added. On Wed, May 25, 2022 at 6:15 PM Kevin Blumberg wrote: > Adam, > > You can enroll multiple devices with TOTP today. When you register and use > the QR code, do it on multiple devices. You can also copy the manual secret > and put that in to a device anytime. > > Kevin > ------------------------------ > *From:* Adam Thompson > *Sent:* Wednesday, May 25, 2022 5:33 p.m. > *To:* > *Subject:* Re: [ARIN-consult] Consultation on Requiring Two-Factor > Authentication (2FA) for ARIN Online Accounts > > The problem I have with MFA boils down to this: > > - Everyone has a reasonably convenient ?forgot my password? > feature/link/process that takes minutes, not hours. > - Almost no-one has a reasonably convenient ?lost my token? > feature/link/process (?yet). Those that do can take many hours or days. > > > > I?ve seen arguments along the lines of ?well, just don?t lose your > authenticator/token/key/thingy?, but I?ve been locked out of MFA-secured > accounts and had to go through onerous, time-consuming processes to regain > access, I think 4 times? within my memory. One of those times was not my > fault in any way, created a very large problem with significant lasting > consequences, and was utterly irresoluble until the token situation was > manually resolved by someone else literally inventing a new process in > real-time. > > > > Hardware tokens fail: misplacing it, irretrievable loss (e.g. down a sewer > grate, into a fire, etc.), physical damage (car tire, in one case), > electrostatic damage, premature battery or component failure, clock skew, > I?ve seen them all. > > Software authenticators fail: uninstalling the app inadvertently (or > deliberately), corrupting the app (usually inadvertent), new app update > causes it to crash (but only for 2 or 3 people, making diagnosis > impossible), forgetting the master password to the app, losing (or losing > access to) the device containing the app, I?ve seen all of those, too. > > > > Any MFA system that does not permit multiple simultaneous enrolled modes > of authentication ? which today seems to be the vast majority of them ? > causes more problems that it solves. > > > > I do NOT dispute the need to move away from simple userid/password > authentication, but please, please, please, at least let users protect > themselves from themselves. Allow enrolment of multiple keys, multiple > TOTP authenticators, multiple phone#s or emails to receive one-time codes, > multiple FIDO keys, etc. > > > > I?m going to keep harping on this as long as I keep > losing/damaging/destroying/corrupting MFA tokens, both hard and soft. > Right now, my employer applies MFA via a > very-large-company?s-authenticator; to mitigate what I see as an enormous > risk, I have the authenticator loaded on a backup phone that?s reasonably > accessible so I?m never 100% dead in the water. Relatively few > authenticators let me do this, in my experience. I can?t share TOTP keys > between phones with this particular software, for some reason, using a > corporate account. I?ve already had to use that backup phone once, while > responding to a customer-down event ? not a time when I want to be locked > out of my systems. > > > > MFA/MFA mitigates one set of risks but introduces another. If those new > risks aren?t managed/addressed/mitigated, we?ll just exchange one set of > problems for a different set of problems. They?re not that difficult to > mitigate, as long as it?s included in the design. > > > > -Adam > > > > *Adam Thompson* > > Consultant, Infrastructure Services > > [image: MERLIN] > > 100 - 135 Innovation Drive > > Winnipeg, MB R3T 6A8 > > (204) 977-6824 or 1-800-430-6404 (MB only) > > https://www.merlin.mb.ca > > Chat with me on Teams > > > > > *From:* ARIN-consult *On Behalf Of *Ross > Tajvar > *Sent:* Wednesday, May 25, 2022 10:41 AM > *To:* Owen DeLong > *Cc:* > *Subject:* Re: [ARIN-consult] Consultation on Requiring Two-Factor > Authentication (MFA) for ARIN Online Accounts > > > > I remain unconvinced that inflicting MFA on me solves a real problem that > actually exists. > > I'm not sure why you (and others) seem to think MFA is so incredibly > inconvenient. In my experience, it only takes a few extra seconds, or a few > extra clicks/taps depending on how it's set up. The added overhead really > is very small. > > > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t > have MFA would be a solution more targeted at the actual problem. > > How would ARIN judge the complexity of a password? As far as I'm aware, > checking if it uses dictionary words is non-trivial. And even then, a > sufficiently long passphrase using dictionary words is pretty secure (vs a > short one) - I don't think it makes sense to penalize users for that. > > > > On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult < > arin-consult at arin.net> wrote: > > > > > > On May 25, 2022, at 08:13 , Matt Harris wrote: > > > > > > Matt Harris? > > | > > VP of Infrastructure > > 816?256?5446 > > | > > Direct > > *Looking for help?* > > *Helpdesk * > > | > > *Email Support * > > > We build customized end?to?end technology solutions powered by NetFire Cloud. > > On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult < > arin-consult at arin.net> wrote: > > I?m not in favor of requiring MFA. I agree that SMS MFA is pretty awful, > but all forms of MFA come with a variety of inconveniences. > > With an account that goes back to the beginnings of ARIN online, I?ve > never had a security problem with my ARIN online account, so I think that > MFA is a solution looking for a problem here. > > I know that?s not a popular view among the more security conscious, but > the reality is that security should be commensurate with what is being > protected. Let users who think their account warrants such additional > measures opt in. Let those of use who feel that our passwords are adequate > continue in that manner. > > Owen > > > > Owen, > > The problem is that compromised ARIN accounts can result in issues that > don't just impact the owner of the account that held those resources. > Compromised ARIN accounts with resources can potentially adversely impact > us all in terms of upticks in spam and the resulting management burdens, at > the very least, and potentially in other (perhaps even thus far unforeseen) > ways as well. > > > > I disagree? If my ARIN account is compromised, I?m going to get notified > of any changes made. (So far, that hasn?t happened). I know exactly where > to go to get those changes reverted quickly. > > > > My account is associated with resources, but I remain unconvinced that > inflicting MFA on me solves a real problem that actually exists. > > > > I do agree with your statement "security should be commensurate with what > is being protected." Thus, I would consider that we perhaps continue to > allow accounts without control of any resources to continue without > requiring MFA, only requiring it when resources are allocated. An ARIN > account with control of nothing, or perhaps just contact records for SWIP'd > space, etc, is not one that is a huge hazard to the community at large imho > compared to one that controls ASNs or IPv4 and IPv6 resources. > > > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t > have MFA would be a solution more targeted at the actual problem. > > > > Owen > > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 13827 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image002.png Type: image/png Size: 359 bytes Desc: not available URL: From beckman at angryox.com Wed May 25 19:35:21 2022 From: beckman at angryox.com (Peter Beckman) Date: Wed, 25 May 2022 19:35:21 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: <315331ef-657f-93f2-dbd-f1df155ed99d@angryox.com> Adam wrote: > The problem I have with MFA boils down to this: > > * Everyone has a reasonably convenient ?forgot my password? > feature/link/process that takes minutes, not hours. > * Almost no-one has a reasonably convenient ?lost my token? > feature/link/process (?yet). Those that do can take many hours or > days. True. However, if the protection required is not self-service, then maybe this is the way it should be. YOU have the ability to avoid such things by securing your backup codes as well as knowing where and how your 2FA TOTP is backed up. If you have a plan in place, you won't "lose your token." If you do not, then yes, it will be inconvenient for you. In the 11 years I've used 1Password, I have always had access to my authentication through multiple secure encrypted means. Even when I lose my mobile phone or it is not nearby. If you got locked out of MFA-secured accounts, I'm pretty sure you did something wrong, or did not have a sufficient plan in place to ensure that you did not lose access to your important accounts. What time was this NOT your fault? We're not talking about hardware tokens. TOTP was designed to allow the holder to have multiple instances of the security token to generate the code, so that the loss of a single device or app was NOT the end of access. Plus there are backup codes that should be stored separately. If you did not document them, you have yourself to blame. If you forget your master password, you have larger problems than ARIN can solve for you. > Any MFA system that does not permit multiple simultaneous enrolled modes > of authentication ? which today seems to be the vast majority of them ? > causes more problems that it solves. TOTP 2FA allows you to have the security token installed on multiple devices, and hopefully you do so securely. You can put the token into multiple different apps if you want. And there are backup codes, so there's your "multiple simultaneous enrolled modes of authentication." > I do NOT dispute the need to move away from simple userid/password > authentication, but please, please, please, at least let users protect > themselves from themselves. Allow enrolment of multiple keys, multiple > TOTP authenticators, multiple phone#s or emails to receive one-time > codes, multiple FIDO keys, etc. Users are NOT trustworthy. Email and SMS are easily compromised. > I?m going to keep harping on this as long as I keep > losing/damaging/destroying/corrupting MFA tokens, both hard and soft. Holy hell man, the problem here is you! TOTP 2FA allows me to have the security token on my iPhone, Desktop, Laptop, and iPad, as well as accessible via a Javascript application in a web browser anywhere I can copy my 1Password vault. The ONLY time I might not be able to generate my TOTP 2FA code is when I am without the Internet, and then it doesn't even matter because I cannot log in without the Internet. We're not talking hardware tokens. > Relatively few authenticators let me do this, in my experience. I can?t > share TOTP keys between phones with this particular software, for some > reason, using a corporate account. This is patently false, because I'm doing it right now. A TOTP key is a string. You can share a string. I believe in you. Plus, where are you storing your backup codes? Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- -------------- next part -------------- The problem I have with MFA boils down to this: * Everyone has a reasonably convenient ?forgot my password? feature/link/process that takes minutes, not hours. * Almost no-one has a reasonably convenient ?lost my token? feature/link/process (?yet). Those that do can take many hours or days. I?ve seen arguments along the lines of ?well, just don?t lose your authenticator/token/key/thingy?, but I?ve been locked out of MFA-secured accounts and had to go through onerous, time-consuming processes to regain access, I think 4 times? within my memory. One of those times was not my fault in any way, created a very large problem with significant lasting consequences, and was utterly irresoluble until the token situation was manually resolved by someone else literally inventing a new process in real-time. Hardware tokens fail: misplacing it, irretrievable loss (e.g. down a sewer grate, into a fire, etc.), physical damage (car tire, in one case), electrostatic damage, premature battery or component failure, clock skew, I?ve seen them all. Software authenticators fail: uninstalling the app inadvertently (or deliberately), corrupting the app (usually inadvertent), new app update causes it to crash (but only for 2 or 3 people, making diagnosis impossible), forgetting the master password to the app, losing (or losing access to) the device containing the app, I?ve seen all of those, too. Any MFA system that does not permit multiple simultaneous enrolled modes of authentication ? which today seems to be the vast majority of them ? causes more problems that it solves. I do NOT dispute the need to move away from simple userid/password authentication, but please, please, please, at least let users protect themselves from themselves. Allow enrolment of multiple keys, multiple TOTP authenticators, multiple phone#s or emails to receive one-time codes, multiple FIDO keys, etc. I?m going to keep harping on this as long as I keep losing/damaging/destroying/corrupting MFA tokens, both hard and soft. Right now, my employer applies MFA via a very-large-company?s-authenticator; to mitigate what I see as an enormous risk, I have the authenticator loaded on a backup phone that?s reasonably accessible so I?m never 100% dead in the water. Relatively few authenticators let me do this, in my experience. I can?t share TOTP keys between phones with this particular software, for some reason, using a corporate account. I?ve already had to use that backup phone once, while responding to a customer-down event ? not a time when I want to be locked out of my systems. MFA/MFA mitigates one set of risks but introduces another. If those new risks aren?t managed/addressed/mitigated, we?ll just exchange one set of problems for a different set of problems. They?re not that difficult to mitigate, as long as it?s included in the design. -Adam Adam Thompson Consultant, Infrastructure Services [MERLIN] 100 - 135 Innovation Drive Winnipeg, MB R3T 6A8 (204) 977-6824 or 1-800-430-6404 (MB only) https://www.merlin.mb.ca [cid:image002.png at 01D87051.47981240]Chat with me on Teams From: ARIN-consult On Behalf Of Ross Tajvar Sent: Wednesday, May 25, 2022 10:41 AM To: Owen DeLong Cc: Subject: Re: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (MFA) for ARIN Online Accounts I remain unconvinced that inflicting MFA on me solves a real problem that actually exists. I'm not sure why you (and others) seem to think MFA is so incredibly inconvenient. In my experience, it only takes a few extra seconds, or a few extra clicks/taps depending on how it's set up. The added overhead really is very small. Perhaps requiring better (non-dictionary) passwords on accounts that don?t have MFA would be a solution more targeted at the actual problem. How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult > wrote: On May 25, 2022, at 08:13 , Matt Harris > wrote: Matt Harris? | VP of Infrastructure 816?256?5446 | Direct Looking for help? Helpdesk | Email Support [https://netfire.net/Flag-United-States-of-America.jpg] We build customized end?to?end technology solutions powered by NetFire Cloud. On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult > wrote: I?m not in favor of requiring MFA. I agree that SMS MFA is pretty awful, but all forms of MFA come with a variety of inconveniences. With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that MFA is a solution looking for a problem here. I know that?s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that our passwords are adequate continue in that manner. Owen Owen, The problem is that compromised ARIN accounts can result in issues that don't just impact the owner of the account that held those resources. Compromised ARIN accounts with resources can potentially adversely impact us all in terms of upticks in spam and the resulting management burdens, at the very least, and potentially in other (perhaps even thus far unforeseen) ways as well. I disagree? If my ARIN account is compromised, I?m going to get notified of any changes made. (So far, that hasn?t happened). I know exactly where to go to get those changes reverted quickly. My account is associated with resources, but I remain unconvinced that inflicting MFA on me solves a real problem that actually exists. I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring MFA, only requiring it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. Perhaps requiring better (non-dictionary) passwords on accounts that don?t have MFA would be a solution more targeted at the actual problem. Owen _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 13827 bytes Desc: image001.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image002.png Type: image/png Size: 359 bytes Desc: image002.png URL: -------------- next part -------------- _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. From beckman at angryox.com Wed May 25 19:41:33 2022 From: beckman at angryox.com (Peter Beckman) Date: Wed, 25 May 2022 19:41:33 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <4e2c5db0-fbd3-4de4-a1ef-ef3e0c5054e0@thewire.ca> Message-ID: <15b0a648-a049-2d6e-3eb9-71d0abf74682@angryox.com> There's no reason to have multiple TOTP security keys for a single account. Just copy the literal string from one TOTP app to another. Now you have exactly the same code being generated on multiple devices. If you are using a Password Manager, all of this is safely encrypted, plus your device itself is likely encrypted at rest and requires a different password and possibly biometrics to access. Here's a TOTP string I just generated (it gives you access to nothing): otpauth://totp/nobody%40example.com?secret=ULJ4R39FLCYKKH0477CSMUSO0HAOLJOA&issuer=Yer%20Mom&period=30&algorithm=SHA1&digits=6 That's it. You can plug that into any Password Manager or TOTP App and that will generate the correct code every 30 seconds. ARIN will provide you with the secret value, and you just store it. > That's true as a side-effect of how TOTP enrollment works, but multiple > device enrollment would need to be deliberately included as a feature (or > not excluded) if FIDO support were to be added. --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- -------------- next part -------------- That's true as a side-effect of how TOTP enrollment works, but multiple device enrollment would need to be deliberately included as a feature (or not excluded) if FIDO support were to be added. On Wed, May 25, 2022 at 6:15 PM Kevin Blumberg wrote: > Adam, > > You can enroll multiple devices with TOTP today. When you register and use > the QR code, do it on multiple devices. You can also copy the manual secret > and put that in to a device anytime. > > Kevin > ------------------------------ > *From:* Adam Thompson > *Sent:* Wednesday, May 25, 2022 5:33 p.m. > *To:* > *Subject:* Re: [ARIN-consult] Consultation on Requiring Two-Factor > Authentication (2FA) for ARIN Online Accounts > > The problem I have with MFA boils down to this: > > - Everyone has a reasonably convenient ?forgot my password? > feature/link/process that takes minutes, not hours. > - Almost no-one has a reasonably convenient ?lost my token? > feature/link/process (?yet). Those that do can take many hours or days. > > > > I?ve seen arguments along the lines of ?well, just don?t lose your > authenticator/token/key/thingy?, but I?ve been locked out of MFA-secured > accounts and had to go through onerous, time-consuming processes to regain > access, I think 4 times? within my memory. One of those times was not my > fault in any way, created a very large problem with significant lasting > consequences, and was utterly irresoluble until the token situation was > manually resolved by someone else literally inventing a new process in > real-time. > > > > Hardware tokens fail: misplacing it, irretrievable loss (e.g. down a sewer > grate, into a fire, etc.), physical damage (car tire, in one case), > electrostatic damage, premature battery or component failure, clock skew, > I?ve seen them all. > > Software authenticators fail: uninstalling the app inadvertently (or > deliberately), corrupting the app (usually inadvertent), new app update > causes it to crash (but only for 2 or 3 people, making diagnosis > impossible), forgetting the master password to the app, losing (or losing > access to) the device containing the app, I?ve seen all of those, too. > > > > Any MFA system that does not permit multiple simultaneous enrolled modes > of authentication ? which today seems to be the vast majority of them ? > causes more problems that it solves. > > > > I do NOT dispute the need to move away from simple userid/password > authentication, but please, please, please, at least let users protect > themselves from themselves. Allow enrolment of multiple keys, multiple > TOTP authenticators, multiple phone#s or emails to receive one-time codes, > multiple FIDO keys, etc. > > > > I?m going to keep harping on this as long as I keep > losing/damaging/destroying/corrupting MFA tokens, both hard and soft. > Right now, my employer applies MFA via a > very-large-company?s-authenticator; to mitigate what I see as an enormous > risk, I have the authenticator loaded on a backup phone that?s reasonably > accessible so I?m never 100% dead in the water. Relatively few > authenticators let me do this, in my experience. I can?t share TOTP keys > between phones with this particular software, for some reason, using a > corporate account. I?ve already had to use that backup phone once, while > responding to a customer-down event ? not a time when I want to be locked > out of my systems. > > > > MFA/MFA mitigates one set of risks but introduces another. If those new > risks aren?t managed/addressed/mitigated, we?ll just exchange one set of > problems for a different set of problems. They?re not that difficult to > mitigate, as long as it?s included in the design. > > > > -Adam > > > > *Adam Thompson* > > Consultant, Infrastructure Services > > [image: MERLIN] > > 100 - 135 Innovation Drive > > Winnipeg, MB R3T 6A8 > > (204) 977-6824 or 1-800-430-6404 (MB only) > > https://www.merlin.mb.ca > > Chat with me on Teams > > > > > *From:* ARIN-consult *On Behalf Of *Ross > Tajvar > *Sent:* Wednesday, May 25, 2022 10:41 AM > *To:* Owen DeLong > *Cc:* > *Subject:* Re: [ARIN-consult] Consultation on Requiring Two-Factor > Authentication (MFA) for ARIN Online Accounts > > > > I remain unconvinced that inflicting MFA on me solves a real problem that > actually exists. > > I'm not sure why you (and others) seem to think MFA is so incredibly > inconvenient. In my experience, it only takes a few extra seconds, or a few > extra clicks/taps depending on how it's set up. The added overhead really > is very small. > > > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t > have MFA would be a solution more targeted at the actual problem. > > How would ARIN judge the complexity of a password? As far as I'm aware, > checking if it uses dictionary words is non-trivial. And even then, a > sufficiently long passphrase using dictionary words is pretty secure (vs a > short one) - I don't think it makes sense to penalize users for that. > > > > On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult < > arin-consult at arin.net> wrote: > > > > > > On May 25, 2022, at 08:13 , Matt Harris wrote: > > > > > > Matt Harris? > > | > > VP of Infrastructure > > 816?256?5446 > > | > > Direct > > *Looking for help?* > > *Helpdesk * > > | > > *Email Support * > > > We build customized end?to?end technology solutions powered by NetFire Cloud. > > On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult < > arin-consult at arin.net> wrote: > > I?m not in favor of requiring MFA. I agree that SMS MFA is pretty awful, > but all forms of MFA come with a variety of inconveniences. > > With an account that goes back to the beginnings of ARIN online, I?ve > never had a security problem with my ARIN online account, so I think that > MFA is a solution looking for a problem here. > > I know that?s not a popular view among the more security conscious, but > the reality is that security should be commensurate with what is being > protected. Let users who think their account warrants such additional > measures opt in. Let those of use who feel that our passwords are adequate > continue in that manner. > > Owen > > > > Owen, > > The problem is that compromised ARIN accounts can result in issues that > don't just impact the owner of the account that held those resources. > Compromised ARIN accounts with resources can potentially adversely impact > us all in terms of upticks in spam and the resulting management burdens, at > the very least, and potentially in other (perhaps even thus far unforeseen) > ways as well. > > > > I disagree? If my ARIN account is compromised, I?m going to get notified > of any changes made. (So far, that hasn?t happened). I know exactly where > to go to get those changes reverted quickly. > > > > My account is associated with resources, but I remain unconvinced that > inflicting MFA on me solves a real problem that actually exists. > > > > I do agree with your statement "security should be commensurate with what > is being protected." Thus, I would consider that we perhaps continue to > allow accounts without control of any resources to continue without > requiring MFA, only requiring it when resources are allocated. An ARIN > account with control of nothing, or perhaps just contact records for SWIP'd > space, etc, is not one that is a huge hazard to the community at large imho > compared to one that controls ASNs or IPv4 and IPv6 resources. > > > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t > have MFA would be a solution more targeted at the actual problem. > > > > Owen > > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 13827 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image002.png Type: image/png Size: 359 bytes Desc: not available URL: -------------- next part -------------- _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. From owen at delong.com Wed May 25 22:26:19 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 19:26:19 -0700 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> Message-ID: <6561444A-2E53-4C47-B707-7EA048E65D19@delong.com> > On May 25, 2022, at 08:40, Scott Leibrand wrote: > > Putting TOTP in 1Password makes login far more convenient than SMS 2FA, and almost as convenient as password-only, even for shared accounts. > > ARIN should probably provide instructions for how to add your TOTP to 1Password (and any other password managers that support that workflow), because it's not a very intuitive enrollment experience. > > We could also make 2FA only mandatory for activities that change resource control (outbound transfers, reassignments, etc.)... I would support this. I?m fine if I have to 2FA to do something potentially harmful, but to have to 2FA every time I log in to check the status of a ticket would be less than ideal. Owen > > -Scott > > On Wed, May 25, 2022 at 8:21 AM Richard Laager > wrote: > You can put your TOTP in something like 1Password. > > -- > Richard > >> On May 25, 2022, at 09:46, Adam Thompson > wrote: >> >> ? >> I have not enabled 2FA. >> >> TOTP lies at the unfortunate confluence of vendor misfeatures and organizational policies that render it not durable or resilient in the face of mobile device failure (which seems to happen to me a LOT more often than normal). Possibly I don't know something about our approved authenticator apps that might solve the problem, but last time I checked, it was a no-go for me. >> >> I've instead opted to use a long, randomly-generated password that I can store in ways that are both secure and durable/resilient. >> >> -Adam >> >> Get Outlook for Android >> From: ARIN-consult > on behalf of Bram Abramson > >> Sent: Wednesday, May 25, 2022 9:26:59 AM >> To: ARIN-consult > >> Subject: [ARIN-consult] increasing 2FA take-up >> >> All, >> >> The current consultation is about rendering SMS a 2FA option, then making 2FA mandatory. But it also notes that TOTP 2FA has been available since 2015 with a 3.2 percent take-up. >> >> Optional 2FA is perhaps inevitably doomed to low take-up, but I it?s likely worth documenting any learnings from the implementation thus far, on the way to that 3.2 percent take-up: >> >> Have most folks involved in this discussion already activated 2FA (are we preaching to the converted)? If not ? why has it made sense for you not to? >> >> Do we think most of the broader community is aware of the 2FA opportunity ? and are there thoughts, UX or otherwise, on why the crushing majority of folks haven?t availed themselves of it? >> >> Thanks, and cheers, >> >> Bram Abramson >> bda at bazu.org / @bramabramson >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN Consult Mailing >> List (ARIN-consult at arin.net ). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net ). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From owen at delong.com Wed May 25 23:00:51 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 20:00:51 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: > On May 25, 2022, at 08:41, Ross Tajvar wrote: > > I remain unconvinced that inflicting 2FA on me solves a real problem that actually exists. > I'm not sure why you (and others) seem to think 2FA is so incredibly inconvenient. In my experience, it only takes a few extra seconds, or a few extra clicks/taps depending on how it's set up. The added overhead really is very small. The added overhead is small if you are in an office with your cell phone handy. It?s less convenient if your cell phone isn?t handy (for a variety of reasons), and you?re trying to do something quickly without having to retrieve said phone. > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t have 2FA would be a solution more targeted at the actual problem. > How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. Yes, sufficient length if just words (alpha only), or sufficient entropy if not long. Checking for dictionary words isn?t completely trivial, but it?s not particularly computationally difficult, either. Plenty of sites manage to do this. Owen > > On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult > wrote: > > >> On May 25, 2022, at 08:13 , Matt Harris > wrote: >> >> >> Matt Harris? >> | >> VP of Infrastructure >> 816?256?5446 >> | >> Direct >> Looking for help? >> Helpdesk >> | >> Email?Support >> >> We build customized end?to?end technology solutions powered by NetFire Cloud. >> On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult > wrote: >> I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty awful, but all forms of 2FA come with a variety of inconveniences. >> >> With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that 2FA is a solution looking for a problem here. >> >> I know that?s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that our passwords are adequate continue in that manner. >> >> Owen >> >> Owen, >> The problem is that compromised ARIN accounts can result in issues that don't just impact the owner of the account that held those resources. Compromised ARIN accounts with resources can potentially adversely impact us all in terms of upticks in spam and the resulting management burdens, at the very least, and potentially in other (perhaps even thus far unforeseen) ways as well. > > I disagree? If my ARIN account is compromised, I?m going to get notified of any changes made. (So far, that hasn?t happened). I know exactly where to go to get those changes reverted quickly. > > My account is associated with resources, but I remain unconvinced that inflicting 2FA on me solves a real problem that actually exists. > >> I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring 2fa, only requiring it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t have 2FA would be a solution more targeted at the actual problem. > > Owen > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net ). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From owen at delong.com Wed May 25 23:05:20 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 20:05:20 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: <0FED5927-EE44-4785-9DC2-83AF5AF65484@delong.com> A good point? Obtaining and comparing against compromised password lists is fairly trivial and provides computational low hanging fruit here. Owen > On May 25, 2022, at 10:15, Gary Buhrmaster wrote: > > On Wed, May 25, 2022 at 3:41 PM Ross Tajvar wrote: > >> .... And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) > > As long as the passphrase is not "correcthorsebatterystaple" > which is now in lists of well known compromised passwords. > > (obligatory xkcd ref: https://xkcd.com/936/ ) > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. From ross at tajvar.io Wed May 25 23:39:47 2022 From: ross at tajvar.io (Ross Tajvar) Date: Wed, 25 May 2022 23:39:47 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: > > The added overhead is small if you are in an office with your cell phone > handy. > > It?s less convenient if your cell phone isn?t handy (for a variety of > reasons), and you?re trying to do something quickly without having to > retrieve said phone. > I don't need my cell phone to do 2FA. I normally don't - I just use my password manager, or a hardware token depending on what I'm authenticating to. I *can* use my cell phone, but I don't have to. On Wed, May 25, 2022 at 11:00 PM Owen DeLong wrote: > > > On May 25, 2022, at 08:41, Ross Tajvar wrote: > > I remain unconvinced that inflicting 2FA on me solves a real problem that >> actually exists. > > I'm not sure why you (and others) seem to think 2FA is so incredibly > inconvenient. In my experience, it only takes a few extra seconds, or a few > extra clicks/taps depending on how it's set up. The added overhead really > is very small. > > > The added overhead is small if you are in an office with your cell phone > handy. > > It?s less convenient if your cell phone isn?t handy (for a variety of > reasons), and you?re trying to do something quickly without having to > retrieve said phone. > > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t >> have 2FA would be a solution more targeted at the actual problem. > > How would ARIN judge the complexity of a password? As far as I'm aware, > checking if it uses dictionary words is non-trivial. And even then, a > sufficiently long passphrase using dictionary words is pretty secure (vs a > short one) - I don't think it makes sense to penalize users for that. > > > Yes, sufficient length if just words (alpha only), or sufficient entropy > if not long. > > Checking for dictionary words isn?t completely trivial, but it?s not > particularly computationally difficult, either. > > Plenty of sites manage to do this. > > Owen > > > > On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult < > arin-consult at arin.net> wrote: > >> >> >> On May 25, 2022, at 08:13 , Matt Harris wrote: >> >> >> Matt Harris? >> | VP of Infrastructure >> 816?256?5446 >> | Direct >> Looking for help? >> *Helpdesk* >> | *Email Support* >> >> We build customized end?to?end technology solutions powered by NetFire Cloud. >> On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult < >> arin-consult at arin.net> wrote: >> >>> I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty awful, >>> but all forms of 2FA come with a variety of inconveniences. >>> >>> With an account that goes back to the beginnings of ARIN online, I?ve >>> never had a security problem with my ARIN online account, so I think that >>> 2FA is a solution looking for a problem here. >>> >>> I know that?s not a popular view among the more security conscious, but >>> the reality is that security should be commensurate with what is being >>> protected. Let users who think their account warrants such additional >>> measures opt in. Let those of use who feel that our passwords are adequate >>> continue in that manner. >>> >>> Owen >>> >> >> Owen, >> The problem is that compromised ARIN accounts can result in issues that >> don't just impact the owner of the account that held those resources. >> Compromised ARIN accounts with resources can potentially adversely impact >> us all in terms of upticks in spam and the resulting management burdens, at >> the very least, and potentially in other (perhaps even thus far unforeseen) >> ways as well. >> >> >> I disagree? If my ARIN account is compromised, I?m going to get notified >> of any changes made. (So far, that hasn?t happened). I know exactly where >> to go to get those changes reverted quickly. >> >> My account is associated with resources, but I remain unconvinced that >> inflicting 2FA on me solves a real problem that actually exists. >> >> I do agree with your statement "security should be commensurate with what >> is being protected." Thus, I would consider that we perhaps continue to >> allow accounts without control of any resources to continue without >> requiring 2fa, only requiring it when resources are allocated. An ARIN >> account with control of nothing, or perhaps just contact records for SWIP'd >> space, etc, is not one that is a huge hazard to the community at large imho >> compared to one that controls ASNs or IPv4 and IPv6 resources. >> >> >> Perhaps requiring better (non-dictionary) passwords on accounts that >> don?t have 2FA would be a solution more targeted at the actual problem. >> >> Owen >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN >> Consult Mailing >> List (ARIN-consult at arin.net). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the >> ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. >> > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From beckman at angryox.com Thu May 26 00:20:52 2022 From: beckman at angryox.com (Peter Beckman) Date: Thu, 26 May 2022 00:20:52 -0400 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: <6561444A-2E53-4C47-B707-7EA048E65D19@delong.com> References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> <6561444A-2E53-4C47-B707-7EA048E65D19@delong.com> Message-ID: Agreed. 2FA should be required when the account protects important assets. 2FA should be optional but available for those who wish to further secure their account for less important assets. This begs the question though -- could opening a ticket with ARIN and responding to it cause resource control to change? If so, tickets should also be protected. Always consider your threat matrix -- if someone could log into the ARIN Ticketing System and pretend to be you, could that have huge negative impacts on assignments and resources? If so, then 2FA should be mandatory there as well. Beckman On Wed, 25 May 2022, Owen DeLong via ARIN-consult wrote: >> We could also make 2FA only mandatory for activities that change resource control (outbound transfers, reassignments, etc.)... > > I would support this. > > I?m fine if I have to 2FA to do something potentially harmful, but to have to 2FA every time I log in to check the status of a ticket would be less than ideal. --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- -------------- next part -------------- _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. From beckman at angryox.com Thu May 26 00:25:23 2022 From: beckman at angryox.com (Peter Beckman) Date: Thu, 26 May 2022 00:25:23 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <0FED5927-EE44-4785-9DC2-83AF5AF65484@delong.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <0FED5927-EE44-4785-9DC2-83AF5AF65484@delong.com> Message-ID: <6a831b1d-f46d-9cc5-7120-b0d6b9216fdd@angryox.com> On Wed, 25 May 2022, Owen DeLong via ARIN-consult wrote: > A good point? Obtaining and comparing against compromised password lists > is fairly trivial and provides computational low hanging fruit here. > >> On May 25, 2022, at 10:15, Gary Buhrmaster wrote: >> >> On Wed, May 25, 2022 at 3:41 PM Ross Tajvar wrote: >> >>> .... And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) >> >> As long as the passphrase is not "correcthorsebatterystaple" >> which is now in lists of well known compromised passwords. >> >> (obligatory xkcd ref: https://xkcd.com/936/ ) Yet fails to address the future. Say you change your password today, and it does not match any currently disclosed passwords. And tomorrow there's a huge breach and disclosure, and your email and password is in there, and you use the same creds for ARIN (or anywhere). If the password is properly one-way encrypted, ARIN cannot detect that your password is now public (easily), and now your password is known to the public, and now your account, and therefore ARIN-managed assets, are at risk, UNLESS you have 2FA on your account. 2FA eliminates the risk of static data disclosure becoming a security liability. Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- From beckman at angryox.com Thu May 26 00:34:16 2022 From: beckman at angryox.com (Peter Beckman) Date: Thu, 26 May 2022 00:34:16 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: On Wed, 25 May 2022, Owen DeLong via ARIN-consult wrote: > The added overhead is small if you are in an office with your cell phone > handy. > > It?s less convenient if your cell phone isn?t handy (for a variety of > reasons), and you?re trying to do something quickly without having to > retrieve said phone. What exactly are you using then to log into ARIN?!? You do NOT need a mobile phone to use TOTP 2FA. I use 1Password on my Desktop all day long, and the same TOTP 2FA code generated on my desktop is the same TOTP 2FA code that is generated on my mobile phone. Watch how easy it is to add a new TOTP 2FA to 1Password. https://www.youtube.com/watch?v=lT-bPrkT4ds I am feeling like you aren't hearing that TOTP 2FA has support for practically ALL COMPUTERS: Linux, Windows, MacOS, IOS, Android, Javascript/Web. There is also a GitHub project code for running TOTP 2FA on a TI-83 calculator. https://github.com/jshin313/ti-authenticator >> Perhaps requiring better (non-dictionary) passwords on accounts that don?t have 2FA would be a solution more targeted at the actual problem. >> How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. > > Yes, sufficient length if just words (alpha only), or sufficient entropy if not long. > > Checking for dictionary words isn?t completely trivial, but it?s not particularly computationally difficult, either. > > Plenty of sites manage to do this. This does not solve the problem if the account and password are disclosed in a breach, and someone is re-using passwords on ARIN and elsewhere. 2FA prevents the disclosure of account creds from giving an unauthorized 3rd party from gaining access to other/any accounts. Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- -------------- next part -------------- _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. From owen at delong.com Thu May 26 00:39:13 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 21:39:13 -0700 Subject: [ARIN-consult] increasing 2FA take-up In-Reply-To: References: <2E0B894D-8035-4D0B-833A-0D1B1775F135@wiktel.com> <6561444A-2E53-4C47-B707-7EA048E65D19@delong.com> Message-ID: <4653428D-44AD-4F1E-9156-42763985A8FF@delong.com> Reading the status of a ticket can never be harmful. Since ARIN won?t send full-text ticket updates via email, 2FA for that can be rather tedious. Responding to a ticket can?t be any more harmful than the original intent of the ticket. Initiating a ticket is a valid target for protection. Other ticket operations should be 2FA optional. Owen > On May 25, 2022, at 21:20, Peter Beckman wrote: > > Agreed. 2FA should be required when the account protects important assets. > > 2FA should be optional but available for those who wish to further secure > their account for less important assets. > > This begs the question though -- could opening a ticket with ARIN and > responding to it cause resource control to change? If so, tickets should > also be protected. > > Always consider your threat matrix -- if someone could log into the ARIN > Ticketing System and pretend to be you, could that have huge negative > impacts on assignments and resources? If so, then 2FA should be mandatory > there as well. > > Beckman > > On Wed, 25 May 2022, Owen DeLong via ARIN-consult wrote: > >>> We could also make 2FA only mandatory for activities that change resource control (outbound transfers, reassignments, etc.)... >> >> I would support this. >> >> I?m fine if I have to 2FA to do something potentially harmful, but to have to 2FA every time I log in to check the status of a ticket would be less than ideal. > > --------------------------------------------------------------------------- > Peter Beckman Internet Guy > beckman at angryox.com https://www.angryox.com/ > ---------------------------------------------------------------------------_______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. From owen at delong.com Thu May 26 00:44:08 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 21:44:08 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: <0AA2E5F0-FEA1-4591-9CAB-FC975757EE68@delong.com> > On May 25, 2022, at 20:39, Ross Tajvar wrote: > > The added overhead is small if you are in an office with your cell phone handy. > > It?s less convenient if your cell phone isn?t handy (for a variety of reasons), and you?re trying to do something quickly without having to retrieve said phone. > > I don't need my cell phone to do 2FA. I normally don't - I just use my password manager, or a hardware token depending on what I'm authenticating to. I *can* use my cell phone, but I don't have to. Obviously this depends on the 2FA mechanism and other factors. The hardware token is even less likely to be at hand in situations where the cell isn?t handy, so that?s a laughable answer. The password manager only works if the particular TOTP mechanisms supported by the particular implementor are also supported by your particular preferred password manager. I?m not aware of a 2FA integration mechanism for iCloud Keychain, for example. Happy to be proven wrong. Owen > > On Wed, May 25, 2022 at 11:00 PM Owen DeLong > wrote: > > >> On May 25, 2022, at 08:41, Ross Tajvar > wrote: >> >> I remain unconvinced that inflicting 2FA on me solves a real problem that actually exists. >> I'm not sure why you (and others) seem to think 2FA is so incredibly inconvenient. In my experience, it only takes a few extra seconds, or a few extra clicks/taps depending on how it's set up. The added overhead really is very small. > > The added overhead is small if you are in an office with your cell phone handy. > > It?s less convenient if your cell phone isn?t handy (for a variety of reasons), and you?re trying to do something quickly without having to retrieve said phone. > >> >> Perhaps requiring better (non-dictionary) passwords on accounts that don?t have 2FA would be a solution more targeted at the actual problem. >> How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. > > Yes, sufficient length if just words (alpha only), or sufficient entropy if not long. > > Checking for dictionary words isn?t completely trivial, but it?s not particularly computationally difficult, either. > > Plenty of sites manage to do this. > > Owen > > >> >> On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult > wrote: >> >> >>> On May 25, 2022, at 08:13 , Matt Harris > wrote: >>> >>> >>> Matt Harris? >>> | >>> VP of Infrastructure >>> 816?256?5446 >>> | >>> Direct >>> Looking for help? >>> Helpdesk >>> | >>> Email?Support >>> >>> We build customized end?to?end technology solutions powered by NetFire Cloud. >>> On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult > wrote: >>> I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty awful, but all forms of 2FA come with a variety of inconveniences. >>> >>> With an account that goes back to the beginnings of ARIN online, I?ve never had a security problem with my ARIN online account, so I think that 2FA is a solution looking for a problem here. >>> >>> I know that?s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that our passwords are adequate continue in that manner. >>> >>> Owen >>> >>> Owen, >>> The problem is that compromised ARIN accounts can result in issues that don't just impact the owner of the account that held those resources. Compromised ARIN accounts with resources can potentially adversely impact us all in terms of upticks in spam and the resulting management burdens, at the very least, and potentially in other (perhaps even thus far unforeseen) ways as well. >> >> I disagree? If my ARIN account is compromised, I?m going to get notified of any changes made. (So far, that hasn?t happened). I know exactly where to go to get those changes reverted quickly. >> >> My account is associated with resources, but I remain unconvinced that inflicting 2FA on me solves a real problem that actually exists. >> >>> I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring 2fa, only requiring it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. >> >> Perhaps requiring better (non-dictionary) passwords on accounts that don?t have 2FA would be a solution more targeted at the actual problem. >> >> Owen >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN Consult Mailing >> List (ARIN-consult at arin.net ). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From owen at delong.com Thu May 26 00:48:29 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 21:48:29 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <6a831b1d-f46d-9cc5-7120-b0d6b9216fdd@angryox.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <0FED5927-EE44-4785-9DC2-83AF5AF65484@delong.com> <6a831b1d-f46d-9cc5-7120-b0d6b9216fdd@angryox.com> Message-ID: <7BE52F0E-8243-4DB1-B2DB-A24EC1E57171@delong.com> > On May 25, 2022, at 21:25, Peter Beckman wrote: > > On Wed, 25 May 2022, Owen DeLong via ARIN-consult wrote: > >> A good point? Obtaining and comparing against compromised password lists >> is fairly trivial and provides computational low hanging fruit here. >> >>> On May 25, 2022, at 10:15, Gary Buhrmaster wrote: >>> On Wed, May 25, 2022 at 3:41 PM Ross Tajvar wrote: >>>> .... And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) >>> As long as the passphrase is not "correcthorsebatterystaple" >>> which is now in lists of well known compromised passwords. >>> (obligatory xkcd ref: https://xkcd.com/936/ ) > > > Yet fails to address the future. > > Say you change your password today, and it does not match any currently > disclosed passwords. > > And tomorrow there's a huge breach and disclosure, and your email and > password is in there, and you use the same creds for ARIN (or anywhere). > > If the password is properly one-way encrypted, ARIN cannot detect that > your password is now public (easily), and now your password is known > to the public, and now your account, and therefore ARIN-managed assets, > are at risk, UNLESS you have 2FA on your account. Well? ARIN can?t detect that until your next (successful) login, anyway. Remember, you present the plain text password to ARIN every time you Authenticate... It is then one-way encrypted with the same seed and algorithm As the stored one-way encrypted password and compared to the encrypted string. > 2FA eliminates the risk of static data disclosure becoming a security > liability. Until the particular seed/algo/etc. for the 2FA is compromised (such as a Stolen hardware token, or the time when a batch of SecurID tokens were Compromised, or? Less frequent than password compromises? Sure. Sufficiently less frequent to be worth the inconvenience for securing something that isn?t a particularly attractive target? Not so sure. Owen From owen at delong.com Thu May 26 00:53:15 2022 From: owen at delong.com (Owen DeLong) Date: Wed, 25 May 2022 21:53:15 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: <3DEACB35-91F9-408A-B258-3D146969EF8D@delong.com> > On May 25, 2022, at 21:34, Peter Beckman wrote: > > On Wed, 25 May 2022, Owen DeLong via ARIN-consult wrote: > >> The added overhead is small if you are in an office with your cell phone >> handy. >> >> It?s less convenient if your cell phone isn?t handy (for a variety of >> reasons), and you?re trying to do something quickly without having to >> retrieve said phone. > > What exactly are you using then to log into ARIN?!? In many cases, Lynx on a busy-box based system. > You do NOT need a mobile phone to use TOTP 2FA. > > I use 1Password on my Desktop all day long, and the same TOTP 2FA code > generated on my desktop is the same TOTP 2FA code that is generated on my > mobile phone. I?m not always logging in from my desktop. I?m not even always logging in from a machine I generally control. What?s the support for TOTP from a shared system in, say a Library or a Maker Space? How am I supposed to secure that? > I am feeling like you aren't hearing that TOTP 2FA has support for > practically ALL COMPUTERS: Linux, Windows, MacOS, IOS, Android, > Javascript/Web. I am hearing it, I?m just saying that one size doesn?t fit all and that mere OS support isn?t the only issue here. > There is also a GitHub project code for running TOTP 2FA on a TI-83 > calculator. https://github.com/jshin313/ti-authenticator So? I have yet to see a good solution for putting a TOTP capability on a machine I can?t generally trust. That?s kind of like installing your SSH private keys on servers at a client site if you?re a consultant? Not too bright. > > >>> Perhaps requiring better (non-dictionary) passwords on accounts that don?t have 2FA would be a solution more targeted at the actual problem. >>> How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't think it makes sense to penalize users for that. >> >> Yes, sufficient length if just words (alpha only), or sufficient entropy if not long. >> >> Checking for dictionary words isn?t completely trivial, but it?s not particularly computationally difficult, either. >> >> Plenty of sites manage to do this. > > This does not solve the problem if the account and password are disclosed > in a breach, and someone is re-using passwords on ARIN and elsewhere. 2FA > prevents the disclosure of account creds from giving an unauthorized 3rd > party from gaining access to other/any accounts. Someone who reuses passwords in this day and age probably deserves whatever happens to them. Owen From ross at tajvar.io Thu May 26 01:00:54 2022 From: ross at tajvar.io (Ross Tajvar) Date: Thu, 26 May 2022 01:00:54 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <0AA2E5F0-FEA1-4591-9CAB-FC975757EE68@delong.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <0AA2E5F0-FEA1-4591-9CAB-FC975757EE68@delong.com> Message-ID: > > The hardware token is even less likely to be at hand in situations where > the cell isn?t handy, so that?s a laughable answer. > Laugh all you want but this could reasonably happen to me. I keep one hardware token on my keyring, and I always keep my keys in my pocket while I'm not at home, but sometimes I walk away from my cell phone. Your experiences are not universal. > The password manager only works if the particular TOTP mechanisms > supported by the particular implementor are also supported by your > particular preferred password manager. For standard code generation, all you need is the secret. I've never so much as changed an algorithm and it's worked flawlessly the first time every time. Yeah maybe there are some edge cases, but for the vast majority of cases it Just Works. On Thu, May 26, 2022 at 12:44 AM Owen DeLong wrote: > > > On May 25, 2022, at 20:39, Ross Tajvar wrote: > > The added overhead is small if you are in an office with your cell phone >> handy. >> >> It?s less convenient if your cell phone isn?t handy (for a variety of >> reasons), and you?re trying to do something quickly without having to >> retrieve said phone. >> > > I don't need my cell phone to do 2FA. I normally don't - I just use my > password manager, or a hardware token depending on what I'm authenticating > to. I *can* use my cell phone, but I don't have to. > > > Obviously this depends on the 2FA mechanism and other factors. > > The hardware token is even less likely to be at hand in situations where > the cell isn?t handy, so that?s a laughable answer. > > The password manager only works if the particular TOTP mechanisms > supported by the particular implementor are also supported by your > particular preferred password manager. > > I?m not aware of a 2FA integration mechanism for iCloud Keychain, for > example. Happy to be proven wrong. > > Owen > > > On Wed, May 25, 2022 at 11:00 PM Owen DeLong wrote: > >> >> >> On May 25, 2022, at 08:41, Ross Tajvar wrote: >> >> I remain unconvinced that inflicting 2FA on me solves a real problem that >>> actually exists. >> >> I'm not sure why you (and others) seem to think 2FA is so incredibly >> inconvenient. In my experience, it only takes a few extra seconds, or a few >> extra clicks/taps depending on how it's set up. The added overhead really >> is very small. >> >> >> The added overhead is small if you are in an office with your cell phone >> handy. >> >> It?s less convenient if your cell phone isn?t handy (for a variety of >> reasons), and you?re trying to do something quickly without having to >> retrieve said phone. >> >> >> Perhaps requiring better (non-dictionary) passwords on accounts that >>> don?t have 2FA would be a solution more targeted at the actual problem. >> >> How would ARIN judge the complexity of a password? As far as I'm aware, >> checking if it uses dictionary words is non-trivial. And even then, a >> sufficiently long passphrase using dictionary words is pretty secure (vs a >> short one) - I don't think it makes sense to penalize users for that. >> >> >> Yes, sufficient length if just words (alpha only), or sufficient entropy >> if not long. >> >> Checking for dictionary words isn?t completely trivial, but it?s not >> particularly computationally difficult, either. >> >> Plenty of sites manage to do this. >> >> Owen >> >> >> >> On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult < >> arin-consult at arin.net> wrote: >> >>> >>> >>> On May 25, 2022, at 08:13 , Matt Harris wrote: >>> >>> >>> Matt Harris? >>> | VP of Infrastructure >>> 816?256?5446 >>> | Direct >>> Looking for help? >>> *Helpdesk* >>> | *Email Support* >>> >>> We build customized end?to?end technology solutions powered by NetFire Cloud. >>> On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult < >>> arin-consult at arin.net> wrote: >>> >>>> I?m not in favor of requiring 2FA. I agree that SMS 2FA is pretty >>>> awful, but all forms of 2FA come with a variety of inconveniences. >>>> >>>> With an account that goes back to the beginnings of ARIN online, I?ve >>>> never had a security problem with my ARIN online account, so I think that >>>> 2FA is a solution looking for a problem here. >>>> >>>> I know that?s not a popular view among the more security conscious, but >>>> the reality is that security should be commensurate with what is being >>>> protected. Let users who think their account warrants such additional >>>> measures opt in. Let those of use who feel that our passwords are adequate >>>> continue in that manner. >>>> >>>> Owen >>>> >>> >>> Owen, >>> The problem is that compromised ARIN accounts can result in issues that >>> don't just impact the owner of the account that held those resources. >>> Compromised ARIN accounts with resources can potentially adversely impact >>> us all in terms of upticks in spam and the resulting management burdens, at >>> the very least, and potentially in other (perhaps even thus far unforeseen) >>> ways as well. >>> >>> >>> I disagree? If my ARIN account is compromised, I?m going to get notified >>> of any changes made. (So far, that hasn?t happened). I know exactly where >>> to go to get those changes reverted quickly. >>> >>> My account is associated with resources, but I remain unconvinced that >>> inflicting 2FA on me solves a real problem that actually exists. >>> >>> I do agree with your statement "security should be commensurate with >>> what is being protected." Thus, I would consider that we perhaps continue >>> to allow accounts without control of any resources to continue without >>> requiring 2fa, only requiring it when resources are allocated. An ARIN >>> account with control of nothing, or perhaps just contact records for SWIP'd >>> space, etc, is not one that is a huge hazard to the community at large imho >>> compared to one that controls ASNs or IPv4 and IPv6 resources. >>> >>> >>> Perhaps requiring better (non-dictionary) passwords on accounts that >>> don?t have 2FA would be a solution more targeted at the actual problem. >>> >>> Owen >>> >>> _______________________________________________ >>> ARIN-Consult >>> You are receiving this message because you are subscribed to the ARIN >>> Consult Mailing >>> List (ARIN-consult at arin.net). >>> Unsubscribe or manage your mailing list subscription at: >>> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the >>> ARIN Member Services >>> Help Desk at info at arin.net if you experience any issues. >> >> > -------------- next part -------------- An HTML attachment was scrubbed... URL: From rlaager at wiktel.com Thu May 26 01:17:45 2022 From: rlaager at wiktel.com (Richard Laager) Date: Thu, 26 May 2022 00:17:45 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <3DEACB35-91F9-408A-B258-3D146969EF8D@delong.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <3DEACB35-91F9-408A-B258-3D146969EF8D@delong.com> Message-ID: On 5/25/22 23:53, Owen DeLong via ARIN-consult wrote: > I?m not always logging in from my desktop. I?m not even always logging in from a machine I generally control. > > What?s the support for TOTP from a shared system in, say a Library or a Maker Space? How am I supposed to secure that? Ideally, you shouldn't be logging into an ARIN account from such a machine. What sort of real world scenarios are occurring where you need to do that, as opposed to just wait until you're back at a device you control? If you login from a device you don't control, a password alone (no matter how strong) is vulnerable to replay. While I don't think you should login to ARIN at the library, if you do so anyway but use 2FA, then that replay risk goes away: your account is only exposed while logged in at that machine. Replay of passwords is _the_ scenario that 2FA is designed to address. -- Richard From gert at space.net Thu May 26 05:51:05 2022 From: gert at space.net (Gert Doering) Date: Thu, 26 May 2022 11:51:05 +0200 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <81057CFB-8964-4CCF-AB94-841F85B4E3D8@arin.net> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <81057CFB-8964-4CCF-AB94-841F85B4E3D8@arin.net> Message-ID: Hi, On Wed, May 25, 2022 at 06:30:26PM +0000, John Curran wrote: > Gert ??? > > Just curious - on those occasions where you were now on a new device, were you still receiving SMS messages on the same number? > > (i.e., if you had been using password and SMS 2FA instead, would you have been equally out of luck?) Yes, my mobile phone number has not changed in 25+ years :) - so SMS reception was still possible. It has been an inconvenience as well, at times, when mobile reception was spotty, or Amazon decided to send not a 4- or 6-digit code, but an URL with a 32-byte random identifier - to my Nokia 208, which does "SMS and voice", but no "Internet"... If going for SMS 2FA, I think one should take into account that it's known to have attack vectors - so maybe combine that with an e-mail "SMS 2FA has been used to log into your account from an unknown device", etc. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: not available URL: From gert at space.net Thu May 26 05:55:30 2022 From: gert at space.net (Gert Doering) Date: Thu, 26 May 2022 11:55:30 +0200 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <315331ef-657f-93f2-dbd-f1df155ed99d@angryox.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <315331ef-657f-93f2-dbd-f1df155ed99d@angryox.com> Message-ID: Hi, On Wed, May 25, 2022 at 07:35:21PM -0400, Peter Beckman wrote: > In the 11 years I've used 1Password, I have always had access to my > authentication through multiple secure encrypted means. Even when I lose > my mobile phone or it is not nearby. So, if 1Password becomes corrupted (due to supply chain attacks), and you wake up one morning with the message "you can not trust this anymore, because we know the source code was backdoored", what do you do then? Your solution very much sounds like "I have this great tool which never failed for me", but eventually, it will. Then what? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 From scottleibrand at gmail.com Thu May 26 11:48:43 2022 From: scottleibrand at gmail.com (Scott Leibrand) Date: Thu, 26 May 2022 08:48:43 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: For me, that situation would require pulling out and powering on a backup phone that hasn?t gotten any app updates recently, putting it into airplane mode to protect against any C&C in case the back door has been in place longer than my phone has been off, and then start the tedious process of manually exporting all my important credentials. Once that is complete, I would need to go log into everything important, change my password, re-enroll 2FA, and store the new credentials in another uncompromised password manager. Scott > On May 26, 2022, at 2:55 AM, Gert Doering wrote: > > ?Hi, > >> On Wed, May 25, 2022 at 07:35:21PM -0400, Peter Beckman wrote: >> In the 11 years I've used 1Password, I have always had access to my >> authentication through multiple secure encrypted means. Even when I lose >> my mobile phone or it is not nearby. > > So, if 1Password becomes corrupted (due to supply chain attacks), and > you wake up one morning with the message "you can not trust this anymore, > because we know the source code was backdoored", what do you do then? > > Your solution very much sounds like "I have this great tool which never > failed for me", but eventually, it will. Then what? > > Gert Doering > -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. From davidbass570 at gmail.com Fri May 27 09:00:03 2022 From: davidbass570 at gmail.com (David Bass) Date: Fri, 27 May 2022 09:00:03 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> Message-ID: I completely agree with the multiple methods, or a backup method in case the primary is not available. ?I do NOT dispute the need to move away from simple userid/password authentication, but please, please, please, at least let users protect themselves from themselves. Allow enrolment of multiple keys, multiple TOTP authenticators, multiple phone#s or emails to receive one-time codes, multiple FIDO keys, etc.? On Wed, May 25, 2022 at 5:33 PM Adam Thompson wrote: > The problem I have with MFA boils down to this: > > - Everyone has a reasonably convenient ?forgot my password? > feature/link/process that takes minutes, not hours. > - Almost no-one has a reasonably convenient ?lost my token? > feature/link/process (?yet). Those that do can take many hours or days. > > > > I?ve seen arguments along the lines of ?well, just don?t lose your > authenticator/token/key/thingy?, but I?ve been locked out of MFA-secured > accounts and had to go through onerous, time-consuming processes to regain > access, I think 4 times? within my memory. One of those times was not my > fault in any way, created a very large problem with significant lasting > consequences, and was utterly irresoluble until the token situation was > manually resolved by someone else literally inventing a new process in > real-time. > > > > Hardware tokens fail: misplacing it, irretrievable loss (e.g. down a sewer > grate, into a fire, etc.), physical damage (car tire, in one case), > electrostatic damage, premature battery or component failure, clock skew, > I?ve seen them all. > > Software authenticators fail: uninstalling the app inadvertently (or > deliberately), corrupting the app (usually inadvertent), new app update > causes it to crash (but only for 2 or 3 people, making diagnosis > impossible), forgetting the master password to the app, losing (or losing > access to) the device containing the app, I?ve seen all of those, too. > > > > Any MFA system that does not permit multiple simultaneous enrolled modes > of authentication ? which today seems to be the vast majority of them ? > causes more problems that it solves. > > > > I do NOT dispute the need to move away from simple userid/password > authentication, but please, please, please, at least let users protect > themselves from themselves. Allow enrolment of multiple keys, multiple > TOTP authenticators, multiple phone#s or emails to receive one-time codes, > multiple FIDO keys, etc. > > > > I?m going to keep harping on this as long as I keep > losing/damaging/destroying/corrupting MFA tokens, both hard and soft. > Right now, my employer applies MFA via a > very-large-company?s-authenticator; to mitigate what I see as an enormous > risk, I have the authenticator loaded on a backup phone that?s reasonably > accessible so I?m never 100% dead in the water. Relatively few > authenticators let me do this, in my experience. I can?t share TOTP keys > between phones with this particular software, for some reason, using a > corporate account. I?ve already had to use that backup phone once, while > responding to a customer-down event ? not a time when I want to be locked > out of my systems. > > > > MFA/MFA mitigates one set of risks but introduces another. If those new > risks aren?t managed/addressed/mitigated, we?ll just exchange one set of > problems for a different set of problems. They?re not that difficult to > mitigate, as long as it?s included in the design. > > > > > > -Adam > > > > *Adam Thompson* > > Consultant, Infrastructure Services > > [image: MERLIN] > > 100 - 135 Innovation Drive > > > Winnipeg, MB R3T 6A8 > > > (204) 977-6824 or 1-800-430-6404 (MB only) > > https://www.merlin.mb.ca > > Chat with me on Teams > > > > > *From:* ARIN-consult *On Behalf Of *Ross > Tajvar > *Sent:* Wednesday, May 25, 2022 10:41 AM > *To:* Owen DeLong > *Cc:* > *Subject:* Re: [ARIN-consult] Consultation on Requiring Two-Factor > Authentication (MFA) for ARIN Online Accounts > > > > I remain unconvinced that inflicting MFA on me solves a real problem that > actually exists. > > I'm not sure why you (and others) seem to think MFA is so incredibly > inconvenient. In my experience, it only takes a few extra seconds, or a few > extra clicks/taps depending on how it's set up. The added overhead really > is very small. > > > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t > have MFA would be a solution more targeted at the actual problem. > > How would ARIN judge the complexity of a password? As far as I'm aware, > checking if it uses dictionary words is non-trivial. And even then, a > sufficiently long passphrase using dictionary words is pretty secure (vs a > short one) - I don't think it makes sense to penalize users for that. > > > > On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult < > arin-consult at arin.net> wrote: > > > > > > On May 25, 2022, at 08:13 , Matt Harris wrote: > > > > > > Matt Harris? > > | > > VP of Infrastructure > > 816?256?5446 > > | > > Direct > > *Looking for help?* > > *Helpdesk * > > | > > *Email Support * > > > We build customized end?to?end technology solutions powered by NetFire Cloud. > > On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult < > arin-consult at arin.net> wrote: > > I?m not in favor of requiring MFA. I agree that SMS MFA is pretty awful, > but all forms of MFA come with a variety of inconveniences. > > With an account that goes back to the beginnings of ARIN online, I?ve > never had a security problem with my ARIN online account, so I think that > MFA is a solution looking for a problem here. > > I know that?s not a popular view among the more security conscious, but > the reality is that security should be commensurate with what is being > protected. Let users who think their account warrants such additional > measures opt in. Let those of use who feel that our passwords are adequate > continue in that manner. > > Owen > > > > Owen, > > The problem is that compromised ARIN accounts can result in issues that > don't just impact the owner of the account that held those resources. > Compromised ARIN accounts with resources can potentially adversely impact > us all in terms of upticks in spam and the resulting management burdens, at > the very least, and potentially in other (perhaps even thus far unforeseen) > ways as well. > > > > I disagree? If my ARIN account is compromised, I?m going to get notified > of any changes made. (So far, that hasn?t happened). I know exactly where > to go to get those changes reverted quickly. > > > > My account is associated with resources, but I remain unconvinced that > inflicting MFA on me solves a real problem that actually exists. > > > > I do agree with your statement "security should be commensurate with what > is being protected." Thus, I would consider that we perhaps continue to > allow accounts without control of any resources to continue without > requiring MFA, only requiring it when resources are allocated. An ARIN > account with control of nothing, or perhaps just contact records for SWIP'd > space, etc, is not one that is a huge hazard to the community at large imho > compared to one that controls ASNs or IPv4 and IPv6 resources. > > > > Perhaps requiring better (non-dictionary) passwords on accounts that don?t > have MFA would be a solution more targeted at the actual problem. > > > > Owen > > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.png Type: image/png Size: 13827 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image002.png Type: image/png Size: 359 bytes Desc: not available URL: From beckman at angryox.com Fri May 27 22:56:22 2022 From: beckman at angryox.com (Peter Beckman) Date: Fri, 27 May 2022 22:56:22 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <7BE52F0E-8243-4DB1-B2DB-A24EC1E57171@delong.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <0FED5927-EE44-4785-9DC2-83AF5AF65484@delong.com> <6a831b1d-f46d-9cc5-7120-b0d6b9216fdd@angryox.com> <7BE52F0E-8243-4DB1-B2DB-A24EC1E57171@delong.com> Message-ID: <2cf0363c-374b-78a2-4a3-162f9230a79d@angryox.com> On Wed, 25 May 2022, Owen DeLong wrote: > Well? ARIN can?t detect that until your next (successful) login, anyway. Fair, agreed. This also requires ARIN to constantly be updating their "disclosed password" list, which seems like that could also fall through the cracks. >> 2FA eliminates the risk of static data disclosure becoming a security >> liability. > > Until the particular seed/algo/etc. for the 2FA is compromised (such as a > Stolen hardware token, or the time when a batch of SecurID tokens were > Compromised, or? > > Less frequent than password compromises? Sure. Sufficiently less frequent > to be worth the inconvenience for securing something that isn?t a > particularly attractive target? Not so sure. What would it take to convince you? Is there anything that would? Is it just to inconvenient for you to accept that it will improve security that you just want to keep throwing out arguments to not change your own processes? Password compromises: weekly 2FA compromises: none Can you point to any 2FA disclosures or breaches that occurred because the shared secret was also compromised? I could not find a single one. I honestly wanted to, just for you, Owen! It is theoretically plausible but either hasn't happened or has but has not been documented. Here's what I could find: - Coinbase 2FA Flaw using SMS contributed to breach (SMS not TOTP) https://www.cpomagazine.com/cyber-security/coinbase-hack-attributed-to-a-multi-factor-authentication-flaw-that-allowed-scammers-to-steal-cryptocurrency-from-6000-accounts/ - How to hack 2FA https://www.csoonline.com/article/3620223/how-to-hack-2fa.html (none suggested stealing the secret as an easy way) - Breaches 2FA could have prevented https://www.tyntec.com/blog/breaches-multifactor-authentication-could-have-prevented - Linode 2016 non-breach but 2FA implementation changed https://www.linode.com/blog/linode/security-investigation-retrospective/ - RSA SecurID 2011 Breach (phishing and hack of RSA, not TOTP) https://en.wikipedia.org/wiki/RSA_SecurID#March_2011_system_compromise I could not find anything but theoretical "the shared secret would be disclosed in a breach." And this is true, but ARIN would need to be hacked, not another website. ARIN could sufficiently protect accounts with 2FA by implementing a microservice like Linode and store the 2FA shared secrets in a secure enclave apart from other authentication and customer data, which would require hackers to target all of ARIN and breach MULTIPLE systems, which exponentially increases the difficulty of reaching a successful breach. Much more likely for a flaw in coding to allow someone into an account without 2FA. Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- From beckman at angryox.com Fri May 27 23:26:26 2022 From: beckman at angryox.com (Peter Beckman) Date: Fri, 27 May 2022 23:26:26 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <3DEACB35-91F9-408A-B258-3D146969EF8D@delong.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <3DEACB35-91F9-408A-B258-3D146969EF8D@delong.com> Message-ID: <173ad94d-7611-98ee-b3e2-f1c91184f9b9@angryox.com> Just to be explicit about a TOTP 2FA login flow: 1. Visit site 2. Enter Username & Password 3. Look at phone (or use app on computer you are using) to get or enter 6-digit code 4. Enter 6-digit code in text box 5. Press submit The 6-digit code is generally valid for 30 seconds, servers generally accept the previous, current, and next code to account for clock skew. Clocks skewed further than that would prevent a valid code from being generated. On Wed, 25 May 2022, Owen DeLong wrote: >> What exactly are you using then to log into ARIN?!? > > In many cases, Lynx on a busy-box based system. Is this because of an accessibility reason that you use a text-based web browser? A raspberry pi-based computer in your pocket would be an ideal system to carry on your person to avoid using untrusted computers. Have you found a Password Manager for Lynx? If so, you should see if it supports TOTP. If not, there are text-based TOTP code generators, I'd be happy find them for you. I will compile and build them for you! I'd be very curious why you use Lynx instead of a graphical-based browser. Or a generally GUI OS. > I?m not always logging in from my desktop. I?m not even always logging in > from a machine I generally control. Untrusted computers are called that because they cannot be trusted. Entering ARIN credentials there risks your account being stolen. 2FA would prevent your stolen creds from being used by an unauthorized 3rd party. > What?s the support for TOTP from a shared system in, say a Library or a > Maker Space? How am I supposed to secure that? You should always have a trusted device with you. If not, you should never log into your accounts on a shared or untrusted system, ever. > I am hearing it, I?m just saying that one size doesn?t fit all and that > mere OS support isn?t the only issue here. Multiple sizes, operating systems, software, apps have been presented. What size fits you, other than the status quo? > I have yet to see a good solution for putting a TOTP capability on a > machine I can?t generally trust. Nobody said to do this, and you should not. You should always carry a trusted device to generate the TOTP code. If you do not, you should not log into your accounts when using a untrusted terminal. > That?s kind of like installing your SSH private keys on servers at a > client site if you?re a consultant? Not too bright. You would never install the shared secret on an untrusted server. You don't need to. You're just reading the 6-digit code, which could be installed on multiple devices convenient for you, and entering it along with your username and password. > Someone who reuses passwords in this day and age probably deserves > whatever happens to them. It's not just the user who is harmed. In this case, ARIN is harmed. If the user represents the company, the company is harmed. It will cost everyone involved time and money. Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- From gary.buhrmaster at gmail.com Fri May 27 23:36:23 2022 From: gary.buhrmaster at gmail.com (Gary Buhrmaster) Date: Sat, 28 May 2022 03:36:23 +0000 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: On Tue, May 24, 2022 at 4:46 PM ARIN wrote: > > **Background** > First up, I am not a DMR, nor do I expect I will ever be one at this point. So, technically, I have (in my opinion) at best, "observer" status in ARIN. That said, since ARIN asked for opinions, I have one (there is an old adage, be careful what you ask for, for you may get it, and as with many of my opinions, you may not like mine). I look at this consultation as, in fact, two different issues (2FA and SMS usage), and believe those issues should be addressed separately (I will do so below). Background The NIST 800-63 suite of guidelines provide a useful framework to come to some common understandings and approaches, and provides advice for operating in best (or at least good) practices. I recommend everyone read the suite of guidelines. While ARIN is not obliged to follow the NIST guidelines well run organizations should be expected to document their reasoning and needs to diverge from the NIST guidance. I will not strictly adhere to the NIST terms in my comments below, but I believe the usage is aligned with the intent. Issue: SMS While NIST acknowledges the wide prevalence of orgs using SMS / PSTN for verification, the latest guidance has finally (they initially proposed doing so five or so years ago) moved to discourage SMS / PSTN factors, calling SMS a "Restricted Authenticator". That means that ideally new implementations should not use it, and organizations should start to make plans to migrate away from it (perhaps required to do so on very short notice). In addition, it is expected that orgs that use restricted authenticators must add in additional notifications and safeguards (which are, themselves, somewhat complicated to validate (I have no idea how to check if the phone number entered is a real mobile with MFA enabled, or a ITSP VoIP phone which accepts SMS (or the number has been ported to a ITSP VoIP phone after the number was entered, or if the number is set to ring in multiple locations), for example, although that might actually be a solved problem and simply reflects my lack of knowledge in that specific use case of knowing where a SMS really ends up)). At this point, it is my belief that ARIN should not adopt SMS / PSTN for a new factor ("Just say NO to SMS!") and if another factor type is desired to add to the current list to complete the work they have already agreed to do, which is implementing FIDO2. All the leading tech companies have agreed that (and are putting substantial efforts behind) FIDO2 as the way towards a future passwordless world (and I, for one, look forward to a day that I don't *need* to have various password management processes for hundreds of different site passwords, although I suspect my lifetime will be shorter than the date of that being finally accomplished, and there will always continue to be valid use cases where simple pin/password identification is acceptable due to the low value/risk of the information retrieved). Issue: 2FA Generically, multifactor. NIST discusses both identity assurance levels and risk evaluations. It is an *org's* responsibility to determine *their* risk to *their* resources. And those orgs should be able to require identity verification to *their* level of required assurance. Some orgs may be fine with a password, some may choose to require a pin/password and (say) a TOTP value, or even require a pin/password, and a TOTP and biometric data. Their information, their risk evaluation, their choice. ARINs responsibility should be to make sure that orgs are aware of their responsibility to make their own choices, and to enable orgs to enforce those choices for ARIN online accounts that access *their* resources in ARIN's registry. And the action requested may change the level requirements in some organizations' thoughts. I suspect many reading this comment (if anyone is still reading at this point) have encountered sites where doing something like changing your profile requires one to up their level of identity assurance (too many sites still use SMS) at the time of the more impactful action. I would be surprised to learn that ARIN has the capability to allow an organization to differentiate their identity assurance requirements for every different action on ARIN online (using Owen's example, looking at tickets might just require a password, while modifying org data might need the TOTP pin) which means at best an org might be able to specify the level of assurance required for an ARIN online account to access any of their resources. For those who have ARIN online accounts that can access multiple orgs resources, I would guess the easiest implementation will be to force the most restrictive org's level of identity assurance for login, and require one to have multiple ARIN online accounts if one desires to only use a lower assurance level for those orgs that have not required a higher level if identity assurance, but some future implementation should be considered where the ARIN online account login allows one to login without MFA, but a message of the form "Your view is currently restricted because one/more orgs require an additional level of identity assurance. Please login using MFA to enable access to all your organizations data"). That may not be a worthwhile investment in resources, but at least it is out there as a possible future option. Note that while organizations should be allowed to specify their minimal level of identity assurance for their resources, individuals should be able to choose a higher level requirement for themselves (there are individuals who, due to their specifics, are, or may be, chosen targets, and who believe they should always use MFA (I'll use as an example a theoretical CEO of an Internet Registry, whose account might be considered at greater risk of being seen as a useful target if compromised and would logically expect to be individually targeted and should want to require MFA "for the good in the innertubes" (FD: Google keeps telling me my account should require MFA because of access to various resources and commit access to various repos, even though my account actually already does require MFA (and I use it), but at least Google is trying to do the right thing)). So, I do not believe ARIN should *require* 2FA, it should provide the infrastructure to allow orgs to require it if *they* so choose, based on *their* risk evaluation. Now that I have mostly rejected most of the proposal, I think it is only fair to offer a few top of the head (not fully fleshed out) alternatives to consider: If ARIN wants to encourage MFA adoption, implement FIDO2 as agreed, and send out two FIDO2 keys to all ARIN online account holders who control resources under an RSA and who requests them (I'll bet most orgs can afford the keys, and would even prefer they do their own sourcing, but why give some orgs yet another reason to not use MFA? Make it easy). FD: I was an early adopter of U2F, and have more FIDO2 keys than one can shake a stick at, and whenever I can, I use the keys for the site(s) I have access to. Any change to an ARIN online account, or by an ARIN online account, should allow both the online account, and the impacted organization the ability to be notified (both to the old and new contact details). "The phone number associated with your online account has been changed. If you did not perform this action, contact ARIN immediately". "The ARIN online account which has access to your organizational data has been updated. If you do not approve of this action, contact ARIN...". While time based forced password changes are also discouraged by NIST, require all ARIN online accounts that do not have MFA enabled by a certain date to change their password before next use where ARIN will be able to (at least) ensure that password is not (currently) in one of the many lists of known compromised passwords (one can brute force any password with enough time, and the list of compromised passwords is added to all the time but a fair number of the brutes will use the various known password dictionary sets). I suppose if you want to be especially annoying, require a password change every six months if the account does not use MFA (although I do not really think that is a good thing). If implementing proper MFA is currently considered too hard, outsource the MFA support to companies such as okta, duo, or others (review Gartner's quadrants), which allows one to specific exactly what level identify assurance is required for the transaction being performed and authenticate appropriately. If not already done, add a captcha challenge to multiple failed password attempts against an account (if you fail nnn times, you are going to get slowed down just a bit as you have to identify the ships/trains/automobiles). Multiple different IP sources should also trigger the challenge (yes, I hate captcha as much as the next person, maybe more, but they do have some benefit of training a company's self driving AI to not drive into the train (which is generally considered a bad thing)). Gary From beckman at angryox.com Sat May 28 00:12:22 2022 From: beckman at angryox.com (Peter Beckman) Date: Sat, 28 May 2022 00:12:22 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: <3a5ee2c-1d0-42ee-7755-214a50f57d40@angryox.com> Excellently researched, well written, and yes I read it all, even past the point where you wondered. :-) Thanks Gary!!j I still disagree with your conclusion that ARIN should allow orgs to choose whether or not to use 2FA. ARIN "owns" the resources. Members are assigned portions of these resources. The resources can be taken away. Theft, modification, or general malfeasance of any member's account and resources will ALWAYS require ARIN's resources, time, and money to correct and repair. I think of ARIN resources like someone else's car. The owner let you borrow it, but if you crash or damage it, it is the owner of the car that is inconvenienced the most, and now has a less valuable asset, and must invest the time to fix it, cannot use it while it is being fixed, pays for a rental during repair, etc. While the borrower maybe pays out the financial cost (maybe) but loses no time nor value. When ARIN requires 2FA to manage critical account resources, they are protecting ARIN's assets that have been designated to you and allow you to manage. They are protecting ARIN from their weakest security link: humans. ARIN requiring 2FA for all accounts reduces or eliminates ARIN's cost of cleaning up the mess after a member's account is breached. Can someone at ARIN weigh in with a story about the cost to ARIN of a breached ARIN account? I assume it has happened, and thus this discussion. Beckman On Sat, 28 May 2022, Gary Buhrmaster wrote: > > So, I do not believe ARIN should *require* 2FA, > it should provide the infrastructure to allow orgs > to require it if *they* so choose, based on *their* > risk evaluation. > > > > > Now that I have mostly rejected most of the proposal, > I think it is only fair to offer a few top of the head (not > fully fleshed out) alternatives to consider: > > If ARIN wants to encourage MFA adoption, implement > FIDO2 as agreed, and send out two FIDO2 keys to all > ARIN online account holders who control resources > under an RSA and who requests them (I'll bet most > orgs can afford the keys, and would even prefer they > do their own sourcing, but why give some orgs yet > another reason to not use MFA? Make it easy). > FD: I was an early adopter of U2F, and have more > FIDO2 keys than one can shake a stick at, and > whenever I can, I use the keys for the site(s) I have > access to. > > Any change to an ARIN online account, or by an > ARIN online account, should allow both the online > account, and the impacted organization the ability > to be notified (both to the old and new contact > details). "The phone number associated with your > online account has been changed. If you did not > perform this action, contact ARIN immediately". > "The ARIN online account which has access to your > organizational data has been updated. If you do > not approve of this action, contact ARIN...". > > While time based forced password changes are > also discouraged by NIST, require all ARIN online > accounts that do not have MFA enabled by a > certain date to change their password before next > use where ARIN will be able to (at least) ensure > that password is not (currently) in one of the > many lists of known compromised passwords > (one can brute force any password with enough > time, and the list of compromised passwords > is added to all the time but a fair number of the > brutes will use the various known password > dictionary sets). I suppose if you want to be > especially annoying, require a password change > every six months if the account does not use MFA > (although I do not really think that is a good thing). > > If implementing proper MFA is currently considered > too hard, outsource the MFA support to companies > such as okta, duo, or others (review Gartner's > quadrants), which allows one to specific exactly > what level identify assurance is required for the > transaction being performed and authenticate > appropriately. > > If not already done, add a captcha challenge to > multiple failed password attempts against an > account (if you fail nnn times, you are going to > get slowed down just a bit as you have to identify > the ships/trains/automobiles). Multiple different > IP sources should also trigger the challenge (yes, > I hate captcha as much as the next person, maybe > more, but they do have some benefit of training > a company's self driving AI to not drive into the > train (which is generally considered a bad thing)). > > > > Gary > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ --------------------------------------------------------------------------- From rlaager at wiktel.com Sat May 28 01:10:25 2022 From: rlaager at wiktel.com (Richard Laager) Date: Sat, 28 May 2022 00:10:25 -0500 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: <2cf0363c-374b-78a2-4a3-162f9230a79d@angryox.com> References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <0FED5927-EE44-4785-9DC2-83AF5AF65484@delong.com> <6a831b1d-f46d-9cc5-7120-b0d6b9216fdd@angryox.com> <7BE52F0E-8243-4DB1-B2DB-A24EC1E57171@delong.com> <2cf0363c-374b-78a2-4a3-162f9230a79d@angryox.com> Message-ID: <5cf26031-ae8f-9513-425d-31baaa682fe4@wiktel.com> On 5/27/22 21:56, Peter Beckman wrote: > On Wed, 25 May 2022, Owen DeLong wrote: > >> Well? ARIN can?t detect that until your next (successful) login, anyway. > > ?Fair, agreed. This also requires ARIN to constantly be updating their > ?"disclosed password" list, which seems like that could also fall through > ?the cracks. https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange -- Richard -------------- next part -------------- An HTML attachment was scrubbed... URL: From arin-consult at ve4.ca Sat May 28 01:22:33 2022 From: arin-consult at ve4.ca (Glen A. Pearce) Date: Fri, 27 May 2022 23:22:33 -0600 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: Message-ID: I would prefer if 2FA is kept optional. As for why I have chosen to not implement it: 1: It's one more thing that can break. 2: Whatever 2FA is used will be on the same premises as the password so if someone compromises the premises to obtain the password they would also gain access to whatever 2FA is being used. My ARIN password is not a dictionary word, it contains letters and numbers , it is not used on any other site. I do not share any password between any sites so credential stuffing won't work on me.? I generate the passwords I use for each site using a process (that I won't disclose so as to not even give out the slightest clue).? Though now I have a bunch of different password for various things that I can't possibly remember so I can't log into anything away from my premises anyways. To get my passwords for anything someone would have to: A: Figure out where my premises is (which due to my use of a P.O. Box and some other measures is harder), break in through 2 doors (with alarm going off once they get through the first one) on the rare occasions I'm not here (pandemic keeping me from going out any more than needed and working from home at my "other" job apparently has a security benefit), figure out how and where the password is stored once in. B: Same as above but when I'm here forcing me under threat of violence to log into my ARIN account. C: Kidnapping me while I'm elsewhere (picking up snail mail from the P.O.Box?) at which point they would have to force me to take them back to the premises to log into my ARIN account. (As mentioned above I literally can't remember my password so I can't log in from anywhere else no matter how much they try to make me.) In situation A intruder traps or situation B or C me acquiring a firearm would both be effective at further securing my ARIN account (as a side effect of further securing my person and premises) while any 2FA would not be.? That said although IP space is valuable I don't think we are anywhere near people being kidnapped over it, especially a /24 that isn't eligible for a specified transfer for another 3 years. -- Glen A. Pearce gap at ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17 From owen at delong.com Sun May 29 19:43:50 2022 From: owen at delong.com (Owen DeLong) Date: Sun, 29 May 2022 16:43:50 -0700 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <3DEACB35-91F9-408A-B258-3D146969EF8D@delong.com> Message-ID: > On May 25, 2022, at 22:17, Richard Laager wrote: > > On 5/25/22 23:53, Owen DeLong via ARIN-consult wrote: >> I?m not always logging in from my desktop. I?m not even always logging in from a machine I generally control. >> What?s the support for TOTP from a shared system in, say a Library or a Maker Space? How am I supposed to secure that? > > Ideally, you shouldn't be logging into an ARIN account from such a machine. What sort of real world scenarios are occurring where you need to do that, as opposed to just wait until you're back at a device you control? On-call consulting work. > If you login from a device you don't control, a password alone (no matter how strong) is vulnerable to replay. While I don't think you should login to ARIN at the library, if you do so anyway but use 2FA, then that replay risk goes away: your account is only exposed while logged in at that machine. Replay of passwords is _the_ scenario that 2FA is designed to address. It?s only vulnerable to replay until it is changed. When I?m faced with such a situation, I?m smart enough to change it once I am able to use a machine I control to do so. The odds of a replay attack in the time that takes are relatively small. The odds of the replay attack causing significant damage given ARIN ticket turnaround times are even smaller. Owen From beckman at angryox.com Tue May 31 00:35:08 2022 From: beckman at angryox.com (Peter Beckman) Date: Tue, 31 May 2022 00:35:08 -0400 Subject: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts In-Reply-To: References: <4C3F5197-0106-4931-B875-F47AC26AE5F6@delong.com> <3DEACB35-91F9-408A-B258-3D146969EF8D@delong.com> Message-ID: On Sun, 29 May 2022, Owen DeLong via ARIN-consult wrote: >> Ideally, you shouldn't be logging into an ARIN account from such a machine. What sort of real world scenarios are occurring where you need to do that, as opposed to just wait until you're back at a device you control? > > On-call consulting work. And you are unable to bring your own laptop or other personal device to this on-call consulting work, where you can use their computers and their Internet access but you cannot use your own? >> If you login from a device you don't control, a password alone (no >> matter how strong) is vulnerable to replay. While I don't think you >> should login to ARIN at the library, if you do so anyway but use 2FA, >> then that replay risk goes away: your account is only exposed while >> logged in at that machine. Replay of passwords is _the_ scenario that >> 2FA is designed to address. > > It?s only vulnerable to replay until it is changed. When I?m faced with > such a situation, I?m smart enough to change it once I am able to use a > machine I control to do so. The odds of a replay attack in the time that > takes are relatively small. The odds of the replay attack causing > significant damage given ARIN ticket turnaround times are even smaller. Sure, the odds are pretty low that ARIN members wouldn't understand good security practices or get phished, yet it happens, often enough for ARIN to consider taking steps to reduce those odds further. It's all theoretical to someone until it happens to them. At that point, the odds are no longer too small to make no changes. Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com https://www.angryox.com/ ---------------------------------------------------------------------------