From info at arin.net Tue Jan 24 13:53:23 2023 From: info at arin.net (ARIN) Date: Tue, 24 Jan 2023 13:53:23 -0500 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Message-ID: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA From athompso at athompso.net Tue Jan 24 13:56:07 2023 From: athompso at athompso.net (Adam Thompson) Date: Tue, 24 Jan 2023 18:56:07 +0000 Subject: [ARIN-consult] [General-members] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <02E3276A-9972-49D5-B061-73789BF10BAA@arin.net> References: <02E3276A-9972-49D5-B061-73789BF10BAA@arin.net> Message-ID: > 1. Would you support ARIN offering email as an additional 2FA method? Yes. > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? You should not limit SMS to the "ARIN Service Region" since by ARIN's own bylaws, people outside that geographic region can be ARIN customers. > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? Functionally infinite. Why on earth would you set a hard-coded limit? It's not like an additional database table is expensive. If you have to set a limit, it should be something large like 2^32. -Adam From ross at tajvar.io Tue Jan 24 14:16:07 2023 From: ross at tajvar.io (Ross Tajvar) Date: Tue, 24 Jan 2023 14:16:07 -0500 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: > 1. Would you support ARIN offering email as an additional 2FA method? *No.* Email can be used to reset one's password. If it's used for one-time login codes as well, that's only one authentication factor. An email compromise could therefore easily result in account takeover, which defeats the purpose of 2FA. > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? I am against SMS 2FA being offered as an option at all, so I'm ambivalent about this. > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? I can't see someone reasonably needing to register more than a handful, but I also don't think there's a good reason to set a low limit. I think 10 is a reasonable upper bound. On Tue, Jan 24, 2023 at 1:53 PM ARIN wrote: > On 1 November 2022, ARIN? announced?that we will require two-factor > authentication (2FA) on all ARIN Online accounts beginning 1 February > 2023.?ARIN currently has three options for customers to set up 2FA on their > ARIN Online accounts: > > - Time-based One-time Password (TOTP) using an authenticator of your choice > - Short Message Service (SMS) for customers within the ARIN service region > - FIDO2/Passkey-enabled Security Key > > Please note: Voice 2FA is not currently available for new 2FA activations; > it is still available to those customers who already have that method set > up on their accounts. > > Following the announcement of the planned enforcement date of 1 February > 2023, we received several suggestions for further expansion of our > authentication offerings, including: > > - Allowing email as an authentication method > - Enabling SMS support for customers who reside outside of the ARIN > service region > - Allowing registration of multiple hardware security keys. > > We are seeking community feedback on these suggestions as well as > additional input on our 2FA options. Specifically: > > 1. Would you support ARIN offering email as an additional 2FA method? > > 2. Given that 13% of web user accounts list phone numbers outside the ARIN > service region, should we widen the availability of SMS, or are the other > offered 2FA options sufficient to meet the needs of these users? > > 3. We agree that users should be allowed to register multiple hardware > security keys. The question is: What is the optimal number of keys that > should be allowed to be registered? > > The feedback you provide during this consultation will help us decide the > path forward regarding our 2FA options for ARIN Online. Thank you for your > participation in the ARIN Consultation and Suggestion Process. > > Please provide comments to arin-consult at arin.net. You can subscribe to > this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult > > This consultation will remain open through 5:00 PM ET on 7 February 2023. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > Helpful Resources: > > Consultation: > https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ > Two-Factor > > Authentication at ARIN: https://arin.net/2FA > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: From has at google.com Tue Jan 24 14:16:32 2023 From: has at google.com (Heather Schiller) Date: Tue, 24 Jan 2023 14:16:32 -0500 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. "*Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." * SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. Tangentially related, what percentage of accounts do you think have a single human poc? --Heather On Tue, Jan 24, 2023 at 1:54 PM ARIN wrote: > On 1 November 2022, ARIN? announced?that we will require two-factor > authentication (2FA) on all ARIN Online accounts beginning 1 February > 2023.?ARIN currently has three options for customers to set up 2FA on their > ARIN Online accounts: > > - Time-based One-time Password (TOTP) using an authenticator of your choice > - Short Message Service (SMS) for customers within the ARIN service region > - FIDO2/Passkey-enabled Security Key > > Please note: Voice 2FA is not currently available for new 2FA activations; > it is still available to those customers who already have that method set > up on their accounts. > > Following the announcement of the planned enforcement date of 1 February > 2023, we received several suggestions for further expansion of our > authentication offerings, including: > > - Allowing email as an authentication method > - Enabling SMS support for customers who reside outside of the ARIN > service region > - Allowing registration of multiple hardware security keys. > > We are seeking community feedback on these suggestions as well as > additional input on our 2FA options. Specifically: > > 1. Would you support ARIN offering email as an additional 2FA method? > > 2. Given that 13% of web user accounts list phone numbers outside the ARIN > service region, should we widen the availability of SMS, or are the other > offered 2FA options sufficient to meet the needs of these users? > > 3. We agree that users should be allowed to register multiple hardware > security keys. The question is: What is the optimal number of keys that > should be allowed to be registered? > > The feedback you provide during this consultation will help us decide the > path forward regarding our 2FA options for ARIN Online. Thank you for your > participation in the ARIN Consultation and Suggestion Process. > > Please provide comments to arin-consult at arin.net. You can subscribe to > this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult > > This consultation will remain open through 5:00 PM ET on 7 February 2023. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > Helpful Resources: > > Consultation: > https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ > Two-Factor > > Authentication at ARIN: https://arin.net/2FA > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: From chris at semihuman.com Tue Jan 24 14:30:21 2023 From: chris at semihuman.com (Chris Woodfield) Date: Tue, 24 Jan 2023 11:30:21 -0800 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: <952B42B7-B299-46D2-BFD9-198CEB938212@semihuman.com> > On Jan 24, 2023, at 11:16 AM, Ross Tajvar wrote: > > > 1. Would you support ARIN offering email as an additional 2FA method? > No. Email can be used to reset one's password. If it's used for one-time login codes as well, that's only one authentication factor. An email compromise could therefore easily result in account takeover, which defeats the purpose of 2FA. Agreed. The password-reset mechanism and standard 2FA login process should not both use the same auth path. > > > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? > I am against SMS 2FA being offered as an option at all, so I'm ambivalent about this. I?m not a fan of SMS as a 2FA for all the obvious reasons, but also recognize that requiring FIDO/TOTP as the *only* supported 2FA is a sure path to tepid adoption. I believe that we should highly encourage users to prefer those mechanisms over SMS but not prohibit SMS as an option. > > > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? > I can't see someone reasonably needing to register more than a handful, but I also don't think there's a good reason to set a low limit. I think 10 is a reasonable upper bound. > The only reason I can see to limit the number of keys is to discourage the use of a single account by multiple employees in an organization. I think a good approach is to have a soft limit (say, 8) that can be increased on request to help combat this. There should also be a mechanism to delete no-longer-used 2FA keys instead of simply disabling them (Seems obvious, but I have accounts on sites that don?t allow this, leading to a ever-growing list of registered auth apps on various phones shown in my account) Separate question - is there a workflow for manually resettting/removing user 2FA when users lose their tokens/auth apps/phone numbers/etc? How would ARIN staff authenticate those requests? Please, please don?t make that process involve a notary (I?m looking at you, AWS). Thanks, -Chris > On Tue, Jan 24, 2023 at 1:53 PM ARIN > wrote: >> On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: >> >> - Time-based One-time Password (TOTP) using an authenticator of your choice >> - Short Message Service (SMS) for customers within the ARIN service region >> - FIDO2/Passkey-enabled Security Key >> >> Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. >> >> Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: >> >> - Allowing email as an authentication method >> - Enabling SMS support for customers who reside outside of the ARIN service region >> - Allowing registration of multiple hardware security keys. >> >> We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: >> >> 1. Would you support ARIN offering email as an additional 2FA method? >> >> 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? >> >> 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? >> >> The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. >> >> Please provide comments to arin-consult at arin.net . You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult >> >> This consultation will remain open through 5:00 PM ET on 7 February 2023. >> >> Regards, >> >> John Curran >> President and CEO >> American Registry for Internet Numbers (ARIN) >> >> Helpful Resources: >> >> Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ >> Two-Factor Authentication at ARIN: https://arin.net/2FA >> >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN Consult Mailing >> List (ARIN-consult at arin.net ). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From jsweeting at arin.net Tue Jan 24 14:56:21 2023 From: jsweeting at arin.net (John Sweeting) Date: Tue, 24 Jan 2023 19:56:21 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Thanks for your input Heather. Tangentially related, what percentage of accounts do you think have a single human poc? Approximately 80% appear to have a single human poc From: ARIN-consult on behalf of Heather Schiller via ARIN-consult Reply-To: Heather Schiller Date: Tuesday, January 24, 2023 at 2:16 PM To: ARIN Cc: "arin-consult at arin.net" Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. "Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. Tangentially related, what percentage of accounts do you think have a single human poc? --Heather On Tue, Jan 24, 2023 at 1:54 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Tue Jan 24 14:58:36 2023 From: athompso at athompso.net (Adam Thompson) Date: Tue, 24 Jan 2023 19:58:36 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: I *don?t* think we can nonchalantly apply the Pareto principle to authentication: how are those ~20% of accounts going to do 2FA with ARIN next month? The only way I can see is to register multiple TOTP authenticators. Have I missed something? -Adam From: ARIN-consult On Behalf Of John Sweeting Sent: Tuesday, January 24, 2023 1:56 PM To: Heather Schiller ; ARIN Cc: arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Thanks for your input Heather. Tangentially related, what percentage of accounts do you think have a single human poc? Approximately 80% appear to have a single human poc From: ARIN-consult > on behalf of Heather Schiller via ARIN-consult > Reply-To: Heather Schiller > Date: Tuesday, January 24, 2023 at 2:16 PM To: ARIN > Cc: "arin-consult at arin.net" > Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. "Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. Tangentially related, what percentage of accounts do you think have a single human poc? --Heather On Tue, Jan 24, 2023 at 1:54 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From ross at tajvar.io Tue Jan 24 15:00:38 2023 From: ross at tajvar.io (Ross Tajvar) Date: Tue, 24 Jan 2023 15:00:38 -0500 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: Each account does its own 2FA. You don't need multiple hardware tokens on the same account unless you're sharing that account, which is unnecessary, because you can associate multiple accounts with one POC. I don't think limiting the number of tokens will cause an issue for orgs with multiple human POCs. Maybe I'm misunderstanding your concern? On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson wrote: > I **don?t** think we can nonchalantly apply the Pareto principle to > authentication: how are those ~20% of accounts going to do 2FA with ARIN > next month? The only way I can see is to register multiple TOTP > authenticators. Have I missed something? > > -Adam > > > > *From:* ARIN-consult *On Behalf Of *John > Sweeting > *Sent:* Tuesday, January 24, 2023 1:56 PM > *To:* Heather Schiller ; ARIN > *Cc:* arin-consult at arin.net > *Subject:* Re: [ARIN-consult] Consultation on Expanding 2FA Options for > ARIN Online > > > > Thanks for your input Heather. > > > > Tangentially related, what percentage of accounts do you think have a > single human poc? > > > > Approximately 80% appear to have a single human poc > > > > > > *From: *ARIN-consult on behalf of Heather > Schiller via ARIN-consult > *Reply-To: *Heather Schiller > *Date: *Tuesday, January 24, 2023 at 2:16 PM > *To: *ARIN > *Cc: *"arin-consult at arin.net" > *Subject: *Re: [ARIN-consult] Consultation on Expanding 2FA Options for > ARIN Online > > > > Can we add, authorization should expire in <24hrs? Per markk@ it expires > in a week, which means anyone that gains access to that browser session > will be able to effect changes. Given that we've added more, not less, > critical infrastructure impacting functionality to ARIN online, the > security requirements should be stricter. > > > > Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going > all the way back to 2016. > > "*Due to the risk that SMS messages or voice calls may be intercepted or > redirected, implementers of new systems SHOULD carefully consider > alternative authenticators. If the out-of-band verification is to be made > using the public switched telephone network (PSTN), the verifier SHALL > verify that the pre-registered telephone number being used is not > associated with a VoIP (or other software-based) service. It then sends the > SMS or voice message to the pre-registered telephone number. Changing the > pre-registered telephone number SHALL NOT be possible without two-factor > authentication at the time of the change." * > > > > SMS based 2FA hasn't really gotten any better over the years. I would not > be in support of expanding the functionality of SMS 2FA. Similarly, I > would not support the use of email as 2FA either. > > > > Tangentially related, what percentage of accounts do you think have a > single human poc? > > > > --Heather > > > > On Tue, Jan 24, 2023 at 1:54 PM ARIN wrote: > > On 1 November 2022, ARIN? announced?that we will require two-factor > authentication (2FA) on all ARIN Online accounts beginning 1 February > 2023.?ARIN currently has three options for customers to set up 2FA on their > ARIN Online accounts: > > - Time-based One-time Password (TOTP) using an authenticator of your choice > - Short Message Service (SMS) for customers within the ARIN service region > - FIDO2/Passkey-enabled Security Key > > Please note: Voice 2FA is not currently available for new 2FA activations; > it is still available to those customers who already have that method set > up on their accounts. > > Following the announcement of the planned enforcement date of 1 February > 2023, we received several suggestions for further expansion of our > authentication offerings, including: > > - Allowing email as an authentication method > - Enabling SMS support for customers who reside outside of the ARIN > service region > - Allowing registration of multiple hardware security keys. > > We are seeking community feedback on these suggestions as well as > additional input on our 2FA options. Specifically: > > 1. Would you support ARIN offering email as an additional 2FA method? > > 2. Given that 13% of web user accounts list phone numbers outside the ARIN > service region, should we widen the availability of SMS, or are the other > offered 2FA options sufficient to meet the needs of these users? > > 3. We agree that users should be allowed to register multiple hardware > security keys. The question is: What is the optimal number of keys that > should be allowed to be registered? > > The feedback you provide during this consultation will help us decide the > path forward regarding our 2FA options for ARIN Online. Thank you for your > participation in the ARIN Consultation and Suggestion Process. > > Please provide comments to arin-consult at arin.net. You can subscribe to > this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult > > This consultation will remain open through 5:00 PM ET on 7 February 2023. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > Helpful Resources: > > Consultation: > https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ > Two-Factor > > Authentication at ARIN: https://arin.net/2FA > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: From lyons at geekcq.com Tue Jan 24 15:02:59 2023 From: lyons at geekcq.com (Tim Lyons) Date: Tue, 24 Jan 2023 20:02:59 +0000 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: Message-ID: I don't recommend expanding the use of SMS for 2FA as it poses a significant security risk. SMS messages can be intercepted or redirected by attackers, potentially giving them access to a user's account. Therefore, I propose removing SMS as a factor altogether and focusing on more secure options such as Time-based One-time Password (TOTP) using an authenticator of your choice or FIDO2/Passkey-enabled Security Key. E-mail as an additional 2FA method is also not ideal as email accounts can be compromised if not properly secured, but it is still a somewhat better option than SMS. In terms of allowing the registration of multiple hardware security keys, I suggest allowing a maximum of 3 keys to be registered. This provides backup options in case a user loses or misplaces their primary key but encourages users to be cognizant of deleting old keys that have been lots or become non-functional. Regards, Tim ________________________________ From: ARIN-announce on behalf of ARIN Sent: Tuesday, January 24, 2023 13:52 To: arin-announce at arin.net Subject: [arin-announce] Consultation on Expanding 2FA Options for ARIN Online Caution: EXTERNAL EMAIL Caution: This is an external email and has a suspicious subject or content. Please take care when clicking links or opening attachments. When in doubt, DON'T CLICK! On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Announce You are receiving this message because you are subscribed to the ARIN Announce Mailing List (ARIN-announce at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-announce Please contact info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Tue Jan 24 15:06:33 2023 From: athompso at athompso.net (Adam Thompson) Date: Tue, 24 Jan 2023 20:06:33 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: I know several organizations that do share the web account, despite their being no ?need? to. If the goal is to make humans behave optimally, we have already failed. If the goal is to secure the accounts DESPITE what humans will do to the system, then we need to acknowledge that this happens. -Adam P.S. Speaking of humans behaving suboptimally, Voicenetwork.ca ? please do better. Mailing lists should never feed directly into your ticket system. From: Ross Tajvar Sent: Tuesday, January 24, 2023 2:01 PM To: Adam Thompson Cc: John Sweeting ; Heather Schiller ; ARIN ; arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Each account does its own 2FA. You don't need multiple hardware tokens on the same account unless you're sharing that account, which is unnecessary, because you can associate multiple accounts with one POC. I don't think limiting the number of tokens will cause an issue for orgs with multiple human POCs. Maybe I'm misunderstanding your concern? On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson > wrote: I *don?t* think we can nonchalantly apply the Pareto principle to authentication: how are those ~20% of accounts going to do 2FA with ARIN next month? The only way I can see is to register multiple TOTP authenticators. Have I missed something? -Adam From: ARIN-consult > On Behalf Of John Sweeting Sent: Tuesday, January 24, 2023 1:56 PM To: Heather Schiller >; ARIN > Cc: arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Thanks for your input Heather. Tangentially related, what percentage of accounts do you think have a single human poc? Approximately 80% appear to have a single human poc From: ARIN-consult > on behalf of Heather Schiller via ARIN-consult > Reply-To: Heather Schiller > Date: Tuesday, January 24, 2023 at 2:16 PM To: ARIN > Cc: "arin-consult at arin.net" > Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. "Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. Tangentially related, what percentage of accounts do you think have a single human poc? --Heather On Tue, Jan 24, 2023 at 1:54 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From has at google.com Tue Jan 24 15:06:39 2023 From: has at google.com (Heather Schiller) Date: Tue, 24 Jan 2023 15:06:39 -0500 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: My inquiry about the number of human pocs, was to better understand the volume of risk due to a single user needing to recover their access in some way. 80% is not reassuring. eek. --h On Tue, Jan 24, 2023 at 3:00 PM Ross Tajvar wrote: > Each account does its own 2FA. You don't need multiple hardware tokens on > the same account unless you're sharing that account, which is unnecessary, > because you can associate multiple accounts with one POC. I don't think > limiting the number of tokens will cause an issue for orgs with multiple > human POCs. > > Maybe I'm misunderstanding your concern? > > On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson > wrote: > >> I **don?t** think we can nonchalantly apply the Pareto principle to >> authentication: how are those ~20% of accounts going to do 2FA with ARIN >> next month? The only way I can see is to register multiple TOTP >> authenticators. Have I missed something? >> >> -Adam >> >> >> >> *From:* ARIN-consult *On Behalf Of *John >> Sweeting >> *Sent:* Tuesday, January 24, 2023 1:56 PM >> *To:* Heather Schiller ; ARIN >> *Cc:* arin-consult at arin.net >> *Subject:* Re: [ARIN-consult] Consultation on Expanding 2FA Options for >> ARIN Online >> >> >> >> Thanks for your input Heather. >> >> >> >> Tangentially related, what percentage of accounts do you think have a >> single human poc? >> >> >> >> Approximately 80% appear to have a single human poc >> >> >> >> >> >> *From: *ARIN-consult on behalf of >> Heather Schiller via ARIN-consult >> *Reply-To: *Heather Schiller >> *Date: *Tuesday, January 24, 2023 at 2:16 PM >> *To: *ARIN >> *Cc: *"arin-consult at arin.net" >> *Subject: *Re: [ARIN-consult] Consultation on Expanding 2FA Options for >> ARIN Online >> >> >> >> Can we add, authorization should expire in <24hrs? Per markk@ it >> expires in a week, which means anyone that gains access to that browser >> session will be able to effect changes. Given that we've added more, not >> less, critical infrastructure impacting functionality to ARIN online, the >> security requirements should be stricter. >> >> >> >> Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going >> all the way back to 2016. >> >> "*Due to the risk that SMS messages or voice calls may be intercepted >> or redirected, implementers of new systems SHOULD carefully consider >> alternative authenticators. If the out-of-band verification is to be made >> using the public switched telephone network (PSTN), the verifier SHALL >> verify that the pre-registered telephone number being used is not >> associated with a VoIP (or other software-based) service. It then sends the >> SMS or voice message to the pre-registered telephone number. Changing the >> pre-registered telephone number SHALL NOT be possible without two-factor >> authentication at the time of the change." * >> >> >> >> SMS based 2FA hasn't really gotten any better over the years. I would >> not be in support of expanding the functionality of SMS 2FA. Similarly, I >> would not support the use of email as 2FA either. >> >> >> >> Tangentially related, what percentage of accounts do you think have a >> single human poc? >> >> >> >> --Heather >> >> >> >> On Tue, Jan 24, 2023 at 1:54 PM ARIN wrote: >> >> On 1 November 2022, ARIN? announced?that we will require two-factor >> authentication (2FA) on all ARIN Online accounts beginning 1 February >> 2023.?ARIN currently has three options for customers to set up 2FA on their >> ARIN Online accounts: >> >> - Time-based One-time Password (TOTP) using an authenticator of your >> choice >> - Short Message Service (SMS) for customers within the ARIN service region >> - FIDO2/Passkey-enabled Security Key >> >> Please note: Voice 2FA is not currently available for new 2FA >> activations; it is still available to those customers who already have that >> method set up on their accounts. >> >> Following the announcement of the planned enforcement date of 1 February >> 2023, we received several suggestions for further expansion of our >> authentication offerings, including: >> >> - Allowing email as an authentication method >> - Enabling SMS support for customers who reside outside of the ARIN >> service region >> - Allowing registration of multiple hardware security keys. >> >> We are seeking community feedback on these suggestions as well as >> additional input on our 2FA options. Specifically: >> >> 1. Would you support ARIN offering email as an additional 2FA method? >> >> 2. Given that 13% of web user accounts list phone numbers outside the >> ARIN service region, should we widen the availability of SMS, or are the >> other offered 2FA options sufficient to meet the needs of these users? >> >> 3. We agree that users should be allowed to register multiple hardware >> security keys. The question is: What is the optimal number of keys that >> should be allowed to be registered? >> >> The feedback you provide during this consultation will help us decide the >> path forward regarding our 2FA options for ARIN Online. Thank you for your >> participation in the ARIN Consultation and Suggestion Process. >> >> Please provide comments to arin-consult at arin.net. You can subscribe to >> this mailing list at: >> https://lists.arin.net/mailman/listinfo/arin-consult >> >> This consultation will remain open through 5:00 PM ET on 7 February 2023. >> >> Regards, >> >> John Curran >> President and CEO >> American Registry for Internet Numbers (ARIN) >> >> Helpful Resources: >> >> Consultation: >> https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ >> Two-Factor >> >> Authentication at ARIN: https://arin.net/2FA >> >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN >> Consult Mailing >> List (ARIN-consult at arin.net). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the >> ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN >> Consult Mailing >> List (ARIN-consult at arin.net). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the >> ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. >> > -------------- next part -------------- An HTML attachment was scrubbed... URL: From chris at semihuman.com Tue Jan 24 15:07:05 2023 From: chris at semihuman.com (Chris Woodfield) Date: Tue, 24 Jan 2023 12:07:05 -0800 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: <8BC7B4DA-863E-4FE2-B581-E15091845657@semihuman.com> I?m thinking of account sharing, not POC. Yes, you can associate multiple accounts with a POC, but some orgs just don?t bother and share a single set of credentials. I?d hope that 2FA would put a stop to that, but nothing prevents simply having each person sharing the account getting their own 2FA key*, unless you put a limit on the number of tokens. -C * Sounds improbable but I?ve seen stranger methods of credential sharing. A webcam stream of an RSA token being my best/worst example :) > On Jan 24, 2023, at 12:00 PM, Ross Tajvar wrote: > > Each account does its own 2FA. You don't need multiple hardware tokens on the same account unless you're sharing that account, which is unnecessary, because you can associate multiple accounts with one POC. I don't think limiting the number of tokens will cause an issue for orgs with multiple human POCs. > > Maybe I'm misunderstanding your concern? > > On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson > wrote: >> I *don?t* think we can nonchalantly apply the Pareto principle to authentication: how are those ~20% of accounts going to do 2FA with ARIN next month? The only way I can see is to register multiple TOTP authenticators. Have I missed something? >> >> -Adam >> >> >> >> From: ARIN-consult > On Behalf Of John Sweeting >> Sent: Tuesday, January 24, 2023 1:56 PM >> To: Heather Schiller >; ARIN > >> Cc: arin-consult at arin.net >> Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online >> >> >> >> Thanks for your input Heather. >> >> >> >> Tangentially related, what percentage of accounts do you think have a single human poc? >> >> >> >> Approximately 80% appear to have a single human poc >> >> >> >> >> >> From: ARIN-consult > on behalf of Heather Schiller via ARIN-consult > >> Reply-To: Heather Schiller > >> Date: Tuesday, January 24, 2023 at 2:16 PM >> To: ARIN > >> Cc: "arin-consult at arin.net " > >> Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online >> >> >> >> Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. >> >> >> >> Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. >> >> "Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." >> >> >> >> SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. >> >> >> >> Tangentially related, what percentage of accounts do you think have a single human poc? >> >> >> >> --Heather >> >> >> >> On Tue, Jan 24, 2023 at 1:54 PM ARIN > wrote: >> >> On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: >> >> - Time-based One-time Password (TOTP) using an authenticator of your choice >> - Short Message Service (SMS) for customers within the ARIN service region >> - FIDO2/Passkey-enabled Security Key >> >> Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. >> >> Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: >> >> - Allowing email as an authentication method >> - Enabling SMS support for customers who reside outside of the ARIN service region >> - Allowing registration of multiple hardware security keys. >> >> We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: >> >> 1. Would you support ARIN offering email as an additional 2FA method? >> >> 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? >> >> 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? >> >> The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. >> >> Please provide comments to arin-consult at arin.net . You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult >> >> This consultation will remain open through 5:00 PM ET on 7 February 2023. >> >> Regards, >> >> John Curran >> President and CEO >> American Registry for Internet Numbers (ARIN) >> >> Helpful Resources: >> >> Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ >> Two-Factor Authentication at ARIN: https://arin.net/2FA >> >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN Consult Mailing >> List (ARIN-consult at arin.net ). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. >> >> _______________________________________________ >> ARIN-Consult >> You are receiving this message because you are subscribed to the ARIN Consult Mailing >> List (ARIN-consult at arin.net ). >> Unsubscribe or manage your mailing list subscription at: >> https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services >> Help Desk at info at arin.net if you experience any issues. > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Tue Jan 24 15:08:01 2023 From: athompso at athompso.net (Adam Thompson) Date: Tue, 24 Jan 2023 20:08:01 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: Welcome to 2FA: getting locked out of your account 2wice as Fast As before! -Adam From: Heather Schiller Sent: Tuesday, January 24, 2023 2:07 PM To: Ross Tajvar Cc: Adam Thompson ; John Sweeting ; arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online My inquiry about the number of human pocs, was to better understand the volume of risk due to a single user needing to recover their access in some way. 80% is not reassuring. eek. --h On Tue, Jan 24, 2023 at 3:00 PM Ross Tajvar > wrote: Each account does its own 2FA. You don't need multiple hardware tokens on the same account unless you're sharing that account, which is unnecessary, because you can associate multiple accounts with one POC. I don't think limiting the number of tokens will cause an issue for orgs with multiple human POCs. Maybe I'm misunderstanding your concern? On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson > wrote: I *don?t* think we can nonchalantly apply the Pareto principle to authentication: how are those ~20% of accounts going to do 2FA with ARIN next month? The only way I can see is to register multiple TOTP authenticators. Have I missed something? -Adam From: ARIN-consult > On Behalf Of John Sweeting Sent: Tuesday, January 24, 2023 1:56 PM To: Heather Schiller >; ARIN > Cc: arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Thanks for your input Heather. Tangentially related, what percentage of accounts do you think have a single human poc? Approximately 80% appear to have a single human poc From: ARIN-consult > on behalf of Heather Schiller via ARIN-consult > Reply-To: Heather Schiller > Date: Tuesday, January 24, 2023 at 2:16 PM To: ARIN > Cc: "arin-consult at arin.net" > Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. "Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. Tangentially related, what percentage of accounts do you think have a single human poc? --Heather On Tue, Jan 24, 2023 at 1:54 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From jsweeting at arin.net Tue Jan 24 15:09:05 2023 From: jsweeting at arin.net (John Sweeting) Date: Tue, 24 Jan 2023 20:09:05 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: From: Heather Schiller Date: Tuesday, January 24, 2023 at 3:06 PM To: Ross Tajvar Cc: Adam Thompson , John Sweeting , "arin-consult at arin.net" Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online My inquiry about the number of human pocs, was to better understand the volume of risk due to a single user needing to recover their access in some way. 80% is not reassuring. eek. Ok that is not what was provided, what was provided is the number of user accounts linked to a single POC and not a role POC. Let me get the information that you are actually asking for. --h On Tue, Jan 24, 2023 at 3:00 PM Ross Tajvar > wrote: Each account does its own 2FA. You don't need multiple hardware tokens on the same account unless you're sharing that account, which is unnecessary, because you can associate multiple accounts with one POC. I don't think limiting the number of tokens will cause an issue for orgs with multiple human POCs. Maybe I'm misunderstanding your concern? On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson > wrote: I *don?t* think we can nonchalantly apply the Pareto principle to authentication: how are those ~20% of accounts going to do 2FA with ARIN next month? The only way I can see is to register multiple TOTP authenticators. Have I missed something? -Adam From: ARIN-consult > On Behalf Of John Sweeting Sent: Tuesday, January 24, 2023 1:56 PM To: Heather Schiller >; ARIN > Cc: arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Thanks for your input Heather. Tangentially related, what percentage of accounts do you think have a single human poc? Approximately 80% appear to have a single human poc From: ARIN-consult > on behalf of Heather Schiller via ARIN-consult > Reply-To: Heather Schiller > Date: Tuesday, January 24, 2023 at 2:16 PM To: ARIN > Cc: "arin-consult at arin.net" > Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. "Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. Tangentially related, what percentage of accounts do you think have a single human poc? --Heather On Tue, Jan 24, 2023 at 1:54 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Tue Jan 24 15:09:47 2023 From: athompso at athompso.net (Adam Thompson) Date: Tue, 24 Jan 2023 20:09:47 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <8BC7B4DA-863E-4FE2-B581-E15091845657@semihuman.com> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> <8BC7B4DA-863E-4FE2-B581-E15091845657@semihuman.com> Message-ID: This is one reason I would strenuously oppose artificially limiting the # of TOTP / FIDO tokens one can register. We don?t know why someone else behaves in a seemingly-irrational fashion. (Actually, one outfit I?m vaguely-aware of refused to issue hardware keys to anyone except the senior execs because that?s a ?perk? that the lower ranks ?don?t deserve?. Go figure.) -Adam From: Chris Woodfield Sent: Tuesday, January 24, 2023 2:07 PM To: Ross Tajvar Cc: Adam Thompson ; arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online I?m thinking of account sharing, not POC. Yes, you can associate multiple accounts with a POC, but some orgs just don?t bother and share a single set of credentials. I?d hope that 2FA would put a stop to that, but nothing prevents simply having each person sharing the account getting their own 2FA key*, unless you put a limit on the number of tokens. -C * Sounds improbable but I?ve seen stranger methods of credential sharing. A webcam stream of an RSA token being my best/worst example :) On Jan 24, 2023, at 12:00 PM, Ross Tajvar > wrote: Each account does its own 2FA. You don't need multiple hardware tokens on the same account unless you're sharing that account, which is unnecessary, because you can associate multiple accounts with one POC. I don't think limiting the number of tokens will cause an issue for orgs with multiple human POCs. Maybe I'm misunderstanding your concern? On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson > wrote: I *don?t* think we can nonchalantly apply the Pareto principle to authentication: how are those ~20% of accounts going to do 2FA with ARIN next month? The only way I can see is to register multiple TOTP authenticators. Have I missed something? -Adam From: ARIN-consult > On Behalf Of John Sweeting Sent: Tuesday, January 24, 2023 1:56 PM To: Heather Schiller >; ARIN > Cc: arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Thanks for your input Heather. Tangentially related, what percentage of accounts do you think have a single human poc? Approximately 80% appear to have a single human poc From: ARIN-consult > on behalf of Heather Schiller via ARIN-consult > Reply-To: Heather Schiller > Date: Tuesday, January 24, 2023 at 2:16 PM To: ARIN > Cc: "arin-consult at arin.net" > Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. "Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. Tangentially related, what percentage of accounts do you think have a single human poc? --Heather On Tue, Jan 24, 2023 at 1:54 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From rlaager at wiktel.com Tue Jan 24 15:22:43 2023 From: rlaager at wiktel.com (Richard Laager) Date: Tue, 24 Jan 2023 14:22:43 -0600 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: Message-ID: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> On 1/24/23 12:56, Adam Thompson wrote: > Why on earth would you set a hard-coded limit? It's not like an additional database table is expensive. While, in general, I understand this sentiment (real world cardinality is usually: 1, 2, or many), I do see two counterpoints. Even speaking in general, it is sometimes useful to define a limit for testing purposes. If you say, "We support 5", then you are hopefully actually testing 5. In this particular situation, I think the following argument is even more relevant: On 1/24/23 14:02, Tim Lyons via ARIN-consult wrote: > In terms of allowing the registration of multiple hardware security > keys, I suggest allowing a maximum of 3 keys to be registered. This > provides backup options in case a user loses or misplaces their > primary key but encourages users to be cognizant of deleting old keys > that have been lots or become non-functional. -- Richard -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Tue Jan 24 15:36:03 2023 From: athompso at athompso.net (Adam Thompson) Date: Tue, 24 Jan 2023 20:36:03 +0000 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> References: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> Message-ID: Since I have a nearly magical ability to damage every authentication device I've ever been issued (including my phone - this one has lasted over a year, which I think is av record), I'm highly doubtful of any scheme that *assumes* any authenticator is durable. I would like a *minimum* of 3 active - one in my pocket, one in a locked drawer at work, one in a secure spot at home or in my car or somewhere else. Double + 1 that number to account for rollover, and I'll already want to have up to 7 registered at times, for any account that's super-critical. Yes, that's about how many copies of physical keys for locks that I like to get made, because I lose those, too. Could I live with a limit of 10? Yeah, probably. Which is more important: keeping bad actors out, or letting authorized users in? All I'm hearing during this discussion is protecting accounts against hypothetical compromise (with IIRC no evidence this has ever happened, or any negative outcome has occurred previously) with no consideration of people who have unusual needs. (Some of those needs, definitely not all, are referred to in American law as "disabilities", btw. I hope someone at ARIN has thought about how the proposed 2FA scheme complies with the ADA?) -Adam Get Outlook for Android ________________________________ From: ARIN-consult on behalf of Richard Laager Sent: Tuesday, January 24, 2023 2:22:43 PM To: arin-consult at arin.net Subject: Re: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online On 1/24/23 12:56, Adam Thompson wrote: Why on earth would you set a hard-coded limit? It's not like an additional database table is expensive. While, in general, I understand this sentiment (real world cardinality is usually: 1, 2, or many), I do see two counterpoints. Even speaking in general, it is sometimes useful to define a limit for testing purposes. If you say, "We support 5", then you are hopefully actually testing 5. In this particular situation, I think the following argument is even more relevant: On 1/24/23 14:02, Tim Lyons via ARIN-consult wrote: In terms of allowing the registration of multiple hardware security keys, I suggest allowing a maximum of 3 keys to be registered. This provides backup options in case a user loses or misplaces their primary key but encourages users to be cognizant of deleting old keys that have been lots or become non-functional. -- Richard -------------- next part -------------- An HTML attachment was scrubbed... URL: From chris at semihuman.com Tue Jan 24 15:48:41 2023 From: chris at semihuman.com (Chris Woodfield) Date: Tue, 24 Jan 2023 12:48:41 -0800 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> Message-ID: <6E2EE760-9974-4FB7-8DE3-3D45E89E6F0B@semihuman.com> > On Jan 24, 2023, at 12:36 PM, Adam Thompson wrote: > > > Which is more important: keeping bad actors out, or letting authorized users in? > > All I'm hearing during this discussion is protecting accounts against hypothetical compromise (with IIRC no evidence this has ever happened, or any negative outcome has occurred previously) with no consideration of people who have unusual needs. > > (Some of those needs, definitely not all, are referred to in American law as "disabilities", btw. I hope someone at ARIN has thought about how the proposed 2FA scheme complies with the ADA?) > > -Adam > Hence my recommendation that if a limit is set, it should not be a hard limit, and allow for the limit to be raised upon request (presumably after a manual authentication of the request by ARIN staff). -C -------------- next part -------------- An HTML attachment was scrubbed... URL: From rlaager at wiktel.com Tue Jan 24 15:50:41 2023 From: rlaager at wiktel.com (Richard Laager) Date: Tue, 24 Jan 2023 14:50:41 -0600 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> Message-ID: On 1/24/23 14:36, Adam Thompson wrote: > Double + 1 that number to account for rollover, and I'll already want > to have up to 7 registered at times, for any account that's > super-critical. Where is the doubling coming from? I follow the + 1 to allow for rollover. -- Richard -------------- next part -------------- An HTML attachment was scrubbed... URL: From ross at tajvar.io Tue Jan 24 15:51:11 2023 From: ross at tajvar.io (Ross Tajvar) Date: Tue, 24 Jan 2023 15:51:11 -0500 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> Message-ID: On the topic of hypothetical compromise - my ARIN account hasn't been compromised, but other accounts protected with SMS 2FA have been. I have had money stolen via that vector. So it's a real concern for me. Maybe *my* ARIN account isn't valuable enough to hack, but my employer's is. I don't think we should disregard real attack vectors that definitely do happen in the real world just because they're uncommon and the mitigations are inconvenient to some people. I also acknowledge the importance of disability accommodation; however, I doubt that disallowing email (or SMS) 2FA would be an issue there (though I welcome a correction if I'm wrong). On Tue, Jan 24, 2023 at 3:36 PM Adam Thompson wrote: > Since I have a nearly magical ability to damage every authentication > device I've ever been issued (including my phone - this one has lasted over > a year, which I think is av record), I'm highly doubtful of any scheme that > *assumes* any authenticator is durable. I would like a *minimum* of 3 > active - one in my pocket, one in a locked drawer at work, one in a secure > spot at home or in my car or somewhere else. > > Double + 1 that number to account for rollover, and I'll already want to > have up to 7 registered at times, for any account that's super-critical. > > Yes, that's about how many copies of physical keys for locks that I like > to get made, because I lose those, too. > > Could I live with a limit of 10? Yeah, probably. > > Which is more important: keeping bad actors out, or letting authorized > users in? > > All I'm hearing during this discussion is protecting accounts against > hypothetical compromise (with IIRC no evidence this has ever happened, or > any negative outcome has occurred previously) with no consideration of > people who have unusual needs. > > (Some of those needs, definitely not all, are referred to in American law > as "disabilities", btw. I hope someone at ARIN has thought about how the > proposed 2FA scheme complies with the ADA?) > > -Adam > > Get Outlook for Android > ------------------------------ > *From:* ARIN-consult on behalf of Richard > Laager > *Sent:* Tuesday, January 24, 2023 2:22:43 PM > *To:* arin-consult at arin.net > *Subject:* Re: [ARIN-consult] [ARIN-Consult] Consultation on Expanding > 2FA Options for ARIN Online > > On 1/24/23 12:56, Adam Thompson wrote: > > Why on earth would you set a hard-coded limit? It's not like an additional database table is expensive. > > While, in general, I understand this sentiment (real world cardinality is > usually: 1, 2, or many), I do see two counterpoints. Even speaking in > general, it is sometimes useful to define a limit for testing purposes. If > you say, "We support 5", then you are hopefully actually testing 5. > > In this particular situation, I think the following argument is even more > relevant: > > On 1/24/23 14:02, Tim Lyons via ARIN-consult wrote: > > In terms of allowing the registration of multiple hardware security keys, > I suggest allowing a maximum of 3 keys to be registered. This provides > backup options in case a user loses or misplaces their primary key but > encourages users to be cognizant of deleting old keys that have been lots > or become non-functional. > > -- > Richard > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the > ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > -------------- next part -------------- An HTML attachment was scrubbed... URL: From jsweeting at arin.net Tue Jan 24 16:16:23 2023 From: jsweeting at arin.net (John Sweeting) Date: Tue, 24 Jan 2023 21:16:23 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <952B42B7-B299-46D2-BFD9-198CEB938212@semihuman.com> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <952B42B7-B299-46D2-BFD9-198CEB938212@semihuman.com> Message-ID: From: ARIN-consult on behalf of Chris Woodfield Date: Tuesday, January 24, 2023 at 2:30 PM To: ARIN Cc: "" Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online On Jan 24, 2023, at 11:16 AM, Ross Tajvar wrote: > 1. Would you support ARIN offering email as an additional 2FA method? No. Email can be used to reset one's password. If it's used for one-time login codes as well, that's only one authentication factor. An email compromise could therefore easily result in account takeover, which defeats the purpose of 2FA. Agreed. The password-reset mechanism and standard 2FA login process should not both use the same auth path. > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? I am against SMS 2FA being offered as an option at all, so I'm ambivalent about this. I?m not a fan of SMS as a 2FA for all the obvious reasons, but also recognize that requiring FIDO/TOTP as the *only* supported 2FA is a sure path to tepid adoption. I believe that we should highly encourage users to prefer those mechanisms over SMS but not prohibit SMS as an option. > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? I can't see someone reasonably needing to register more than a handful, but I also don't think there's a good reason to set a low limit. I think 10 is a reasonable upper bound. The only reason I can see to limit the number of keys is to discourage the use of a single account by multiple employees in an organization. I think a good approach is to have a soft limit (say, 8) that can be increased on request to help combat this. There should also be a mechanism to delete no-longer-used 2FA keys instead of simply disabling them (Seems obvious, but I have accounts on sites that don?t allow this, leading to a ever-growing list of registered auth apps on various phones shown in my account) Separate question - is there a workflow for manually resettting/removing user 2FA when users lose their tokens/auth apps/phone numbers/etc? How would ARIN staff authenticate those requests? Please, please don?t make that process involve a notary (I?m looking at you, AWS). (JS) There are set procedures today to call into the ARIN RSD and go through the verification process in order to recover passwords or reset 2FA options. One of those processes is providing the answers to your challenge questions but there are other processes that RSD will use. There are no notaries involved with the process. Thanks, -Chris On Tue, Jan 24, 2023 at 1:53 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From jsweeting at arin.net Tue Jan 24 16:22:50 2023 From: jsweeting at arin.net (John Sweeting) Date: Tue, 24 Jan 2023 21:22:50 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <952B42B7-B299-46D2-BFD9-198CEB938212@semihuman.com> Message-ID: And of course, there are the recovery codes provided when you sign up for 2FA. Sorry for leaving that out From: ARIN-consult on behalf of John Sweeting Date: Tuesday, January 24, 2023 at 4:16 PM To: Chris Woodfield , ARIN Cc: "" Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online From: ARIN-consult on behalf of Chris Woodfield Date: Tuesday, January 24, 2023 at 2:30 PM To: ARIN Cc: "" Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online On Jan 24, 2023, at 11:16 AM, Ross Tajvar wrote: > 1. Would you support ARIN offering email as an additional 2FA method? No. Email can be used to reset one's password. If it's used for one-time login codes as well, that's only one authentication factor. An email compromise could therefore easily result in account takeover, which defeats the purpose of 2FA. Agreed. The password-reset mechanism and standard 2FA login process should not both use the same auth path. > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? I am against SMS 2FA being offered as an option at all, so I'm ambivalent about this. I?m not a fan of SMS as a 2FA for all the obvious reasons, but also recognize that requiring FIDO/TOTP as the *only* supported 2FA is a sure path to tepid adoption. I believe that we should highly encourage users to prefer those mechanisms over SMS but not prohibit SMS as an option. > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? I can't see someone reasonably needing to register more than a handful, but I also don't think there's a good reason to set a low limit. I think 10 is a reasonable upper bound. The only reason I can see to limit the number of keys is to discourage the use of a single account by multiple employees in an organization. I think a good approach is to have a soft limit (say, 8) that can be increased on request to help combat this. There should also be a mechanism to delete no-longer-used 2FA keys instead of simply disabling them (Seems obvious, but I have accounts on sites that don?t allow this, leading to a ever-growing list of registered auth apps on various phones shown in my account) Separate question - is there a workflow for manually resettting/removing user 2FA when users lose their tokens/auth apps/phone numbers/etc? How would ARIN staff authenticate those requests? Please, please don?t make that process involve a notary (I?m looking at you, AWS). (JS) There are set procedures today to call into the ARIN RSD and go through the verification process in order to recover passwords or reset 2FA options. One of those processes is providing the answers to your challenge questions but there are other processes that RSD will use. There are no notaries involved with the process. Thanks, -Chris On Tue, Jan 24, 2023 at 1:53 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From farmer at umn.edu Tue Jan 24 16:31:59 2023 From: farmer at umn.edu (David Farmer) Date: Tue, 24 Jan 2023 15:31:59 -0600 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: On Tue, Jan 24, 2023 at 12:53 PM ARIN wrote: > 1. Would you support ARIN offering email as an additional 2FA method? > As mentioned, email is used for password changes; also, allowing it for 2FA is a bad idea. 2. Given that 13% of web user accounts list phone numbers outside the ARIN > service region, should we widen the availability of SMS, or are the other > offered 2FA options sufficient to meet the needs of these users? > As SMS has several weaknesses, I prefer SMS was not allowed at all. Nevertheless, if SMS is allowed, I don't see the point in restricting it to the ARIN service region. Furthermore, it could be more important for those outside the ARIN service region in case of technology restrictions or embargos on the more secure FIDO or TOTP technologies. > 3. We agree that users should be allowed to register multiple hardware > security keys. The question is: What is the optimal number of keys that > should be allowed to be registered? > 10 is a reasonable limit. -- =============================================== David Farmer Email:farmer at umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 =============================================== -------------- next part -------------- An HTML attachment was scrubbed... URL: From jsweeting at arin.net Tue Jan 24 16:39:52 2023 From: jsweeting at arin.net (John Sweeting) Date: Tue, 24 Jan 2023 21:39:52 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: <7EC19832-E6B9-4351-BB86-3DDA40127599@arin.net> My inquiry about the number of human pocs, was to better understand the volume of risk due to a single user needing to recover their access in some way. 80% is not reassuring. eek. (JS) Ok that is not what was provided, what was provided is the number of user accounts linked to a single POC and not a role POC. Let me get the information that you are actually asking for. The actual number of accounts (OrgIDs) with a single user associated (linked) to it is closer to 20%. There are no limits to the number of users an Organization can have linked to it. From: ARIN-consult on behalf of John Sweeting Date: Tuesday, January 24, 2023 at 3:09 PM To: Heather Schiller , Ross Tajvar Cc: "arin-consult at arin.net" Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online From: Heather Schiller Date: Tuesday, January 24, 2023 at 3:06 PM To: Ross Tajvar Cc: Adam Thompson , John Sweeting , "arin-consult at arin.net" Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online My inquiry about the number of human pocs, was to better understand the volume of risk due to a single user needing to recover their access in some way. 80% is not reassuring. eek. (JS) Ok that is not what was provided, what was provided is the number of user accounts linked to a single POC and not a role POC. Let me get the information that you are actually asking for. The actual number of accounts (OrgIDs) with a single user associated (linked) to it is closer to 20%. There are no limits to the number of users an Organization can have linked to it. --h On Tue, Jan 24, 2023 at 3:00 PM Ross Tajvar > wrote: Each account does its own 2FA. You don't need multiple hardware tokens on the same account unless you're sharing that account, which is unnecessary, because you can associate multiple accounts with one POC. I don't think limiting the number of tokens will cause an issue for orgs with multiple human POCs. Maybe I'm misunderstanding your concern? On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson > wrote: I *don?t* think we can nonchalantly apply the Pareto principle to authentication: how are those ~20% of accounts going to do 2FA with ARIN next month? The only way I can see is to register multiple TOTP authenticators. Have I missed something? -Adam From: ARIN-consult > On Behalf Of John Sweeting Sent: Tuesday, January 24, 2023 1:56 PM To: Heather Schiller >; ARIN > Cc: arin-consult at arin.net Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Thanks for your input Heather. Tangentially related, what percentage of accounts do you think have a single human poc? Approximately 80% appear to have a single human poc From: ARIN-consult > on behalf of Heather Schiller via ARIN-consult > Reply-To: Heather Schiller > Date: Tuesday, January 24, 2023 at 2:16 PM To: ARIN > Cc: "arin-consult at arin.net" > Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes. Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter. Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. "Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email as 2FA either. Tangentially related, what percentage of accounts do you think have a single human poc? --Heather On Tue, Jan 24, 2023 at 1:54 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From chris at semihuman.com Tue Jan 24 16:39:21 2023 From: chris at semihuman.com (Chris Woodfield) Date: Tue, 24 Jan 2023 13:39:21 -0800 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: <0F950928-53FC-4333-ADE2-1B47AE766CD5@semihuman.com> Would requiring TOTP/FIDO (and not allowing SMS) be more palatable if ARIN were able/willing to furnish yubikeys (or alternate authenticators) to users free of charge? I don?t know what these cost in bulk nowadays, but it?s probably right on the edge of reasonable for this use case. Thanks, -Chris > On Jan 24, 2023, at 1:31 PM, David Farmer via ARIN-consult wrote: > > > > On Tue, Jan 24, 2023 at 12:53 PM ARIN > wrote: >> 1. Would you support ARIN offering email as an additional 2FA method? > As mentioned, email is used for password changes; also, allowing it for 2FA is a bad idea. > >> 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? > As SMS has several weaknesses, I prefer SMS was not allowed at all. Nevertheless, if SMS is allowed, I don't see the point in restricting it to the ARIN service region. Furthermore, it could be more important for those outside the ARIN service region in case of technology restrictions or embargos on the more secure FIDO or TOTP technologies. > >> 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? > 10 is a reasonable limit. > > -- > =============================================== > David Farmer Email:farmer at umn.edu > Networking & Telecommunication Services > Office of Information Technology > University of Minnesota > 2218 University Ave SE Phone: 612-626-0815 > Minneapolis, MN 55414-3029 Cell: 612-812-9952 > =============================================== > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Tue Jan 24 16:40:21 2023 From: athompso at athompso.net (Adam Thompson) Date: Tue, 24 Jan 2023 21:40:21 +0000 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> Message-ID: I don?t know myself whether there are any users with disabilities that would preclude the use of TOTP; my guess is there aren?t, whether because those people don?t exist or whether TOTP isn?t a problem ? dunno. I meant only exactly what I said, that I hope someone has put more than a few seconds? thought about that into this. Legal ramifications COULD occur, albeit with low likelihood. The main reason to allow SMS 2FA, despite its known weaknesses, is simply that the entire world is very much not ready for FIDO/TOTP yet. As Chris said, requiring only FIDO/TOTP is an excellent way to alienate people, especially the US and Canada, where non-SMS-based 2FA is still uncommon. I have precisely one system that requires non-SMS, non-email 2FA, and that was forced upon my org by external requirements. I really do not want to add more. Even the email-based 2FA systems have a high chance of causing a catch-22 situation. IMO, the least-bad 2FA system is one that lets me authenticate via whatever system I can right at the moment. If my AS has been hijacked, will I be able to receive email? SMS would probably still work, as would TOTP. If my phone is broken, what options do I have for logging in? A perfectly secure system is a perfectly unusable system. The balance between security and usability has been axiomatic in computing since before I was born. It?s not really up for debate right now. I DO NOT WANT SECURITY that presents any significant chance of denying me access to my own accounts and resources. SMS or email-based 2FA schemes are a giant PITA, but both are fairly easily recoverable when (not if) I lose access to them. Are they good 2FA? No. Absolutely not. Are they better than nothing? Yes. This entire discussion feels like https://xkcd.com/538/ to me. If someone wants access to my ARIN resources, one of the easier ways in would be to physically threaten me or my family, and the best 2FA implementations in the world do nothing (AFAIK) to protect against that. The specific technique or technology involved won?t make any difference. The people who insist that SMS shouldn?t be allowed, that email shouldn?t be allowed, that there should be a maximum of 3 TOTPs or keys registered ? you are alienating me, a user of ARIN resources. You are driving me away from the community. And when the pain of logging in to ARIN exceeds the pain of not having up-to-date SWIPs or contact info, guess what?ll happen? The database is already riddled with garbage/obsolete information, adding more security is going to make that situation worse, not better. The goal should be to add the minimum increment of security that satisfies the business objective. Unfortunately, the business objective here seems to have been ?add 2FA? which is a technical objective, not a business objective. Someone with the technical skills of your grandmother is probably the ARIN contact of record for some resource or other ? and it?s likely a job they inherited and have no idea what to do with. Can you imagine getting your grandparents to deal with 2FA? Unhappy about the whole process from start to finish, as it?s very clearly (to me) the tail wagging the dog. A solution in search of a problem, if you prefer that wording. Just enforcing password length > 20 would have increased security without needing 2FA. (Obviously not increased *enough* to satisfy everyone, but my statement stands.) BTW: having been the technical architect for a cellular telephone company in Canada, yes, I know exactly how easy it is and isn?t to divert SMS at the network/carrier level. It?s a non-zero risk, but it?s *still better than nothing*. -Adam From: Ross Tajvar Sent: Tuesday, January 24, 2023 2:51 PM To: Adam Thompson Cc: Richard Laager ; arin-consult at arin.net Subject: Re: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online On the topic of hypothetical compromise - my ARIN account hasn't been compromised, but other accounts protected with SMS 2FA have been. I have had money stolen via that vector. So it's a real concern for me. Maybe my ARIN account isn't valuable enough to hack, but my employer's is. I don't think we should disregard real attack vectors that definitely do happen in the real world just because they're uncommon and the mitigations are inconvenient to some people. I also acknowledge the importance of disability accommodation; however, I doubt that disallowing email (or SMS) 2FA would be an issue there (though I welcome a correction if I'm wrong). On Tue, Jan 24, 2023 at 3:36 PM Adam Thompson > wrote: Since I have a nearly magical ability to damage every authentication device I've ever been issued (including my phone - this one has lasted over a year, which I think is av record), I'm highly doubtful of any scheme that *assumes* any authenticator is durable. I would like a *minimum* of 3 active - one in my pocket, one in a locked drawer at work, one in a secure spot at home or in my car or somewhere else. Double + 1 that number to account for rollover, and I'll already want to have up to 7 registered at times, for any account that's super-critical. Yes, that's about how many copies of physical keys for locks that I like to get made, because I lose those, too. Could I live with a limit of 10? Yeah, probably. Which is more important: keeping bad actors out, or letting authorized users in? All I'm hearing during this discussion is protecting accounts against hypothetical compromise (with IIRC no evidence this has ever happened, or any negative outcome has occurred previously) with no consideration of people who have unusual needs. (Some of those needs, definitely not all, are referred to in American law as "disabilities", btw. I hope someone at ARIN has thought about how the proposed 2FA scheme complies with the ADA?) -Adam Get Outlook for Android ________________________________ From: ARIN-consult > on behalf of Richard Laager > Sent: Tuesday, January 24, 2023 2:22:43 PM To: arin-consult at arin.net > Subject: Re: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online On 1/24/23 12:56, Adam Thompson wrote: Why on earth would you set a hard-coded limit? It's not like an additional database table is expensive. While, in general, I understand this sentiment (real world cardinality is usually: 1, 2, or many), I do see two counterpoints. Even speaking in general, it is sometimes useful to define a limit for testing purposes. If you say, "We support 5", then you are hopefully actually testing 5. In this particular situation, I think the following argument is even more relevant: On 1/24/23 14:02, Tim Lyons via ARIN-consult wrote: In terms of allowing the registration of multiple hardware security keys, I suggest allowing a maximum of 3 keys to be registered. This provides backup options in case a user loses or misplaces their primary key but encourages users to be cognizant of deleting old keys that have been lots or become non-functional. -- Richard _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From chris at semihuman.com Tue Jan 24 16:39:21 2023 From: chris at semihuman.com (Chris Woodfield) Date: Tue, 24 Jan 2023 13:39:21 -0800 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: <0F950928-53FC-4333-ADE2-1B47AE766CD5@semihuman.com> Would requiring TOTP/FIDO (and not allowing SMS) be more palatable if ARIN were able/willing to furnish yubikeys (or alternate authenticators) to users free of charge? I don?t know what these cost in bulk nowadays, but it?s probably right on the edge of reasonable for this use case. Thanks, -Chris > On Jan 24, 2023, at 1:31 PM, David Farmer via ARIN-consult wrote: > > > > On Tue, Jan 24, 2023 at 12:53 PM ARIN > wrote: >> 1. Would you support ARIN offering email as an additional 2FA method? > As mentioned, email is used for password changes; also, allowing it for 2FA is a bad idea. > >> 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? > As SMS has several weaknesses, I prefer SMS was not allowed at all. Nevertheless, if SMS is allowed, I don't see the point in restricting it to the ARIN service region. Furthermore, it could be more important for those outside the ARIN service region in case of technology restrictions or embargos on the more secure FIDO or TOTP technologies. > >> 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? > 10 is a reasonable limit. > > -- > =============================================== > David Farmer Email:farmer at umn.edu > Networking & Telecommunication Services > Office of Information Technology > University of Minnesota > 2218 University Ave SE Phone: 612-626-0815 > Minneapolis, MN 55414-3029 Cell: 612-812-9952 > =============================================== > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From mcr at sandelman.ca Tue Jan 24 17:14:09 2023 From: mcr at sandelman.ca (Michael Richardson) Date: Tue, 24 Jan 2023 17:14:09 -0500 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: <4224.1674598449@localhost> Ross Tajvar captured all my opinions. I was going to say "5" keys, but any number O(10) is fine. top-quoting all his points. I went through the phone authentication process when my phone suddenly crapped out. Very frustrating that this is *not* backed up ever. I still prefer TOTP over anything else. At the time, ARIN was my only TOTP 2FA present, so it wasn't too bad. I have since taken to *printing* every initialization QR code and putting that in my safe. I feel confident that my printer is too stupid to retain the pages, but I'll bet this is a really bad idea in an enterprise environment, where the printers are likely the weakest link in security. I've since learnt that the Google Authenticator APP can *share* a QR code will *all* of your TOTP settings... It's a huge QR image and it's unclear how/where to save it, but.. Ross Tajvar wrote: >> 1. Would you support ARIN offering email as an additional 2FA method? > *No.* Email can be used to reset one's password. If it's used for one-time > login codes as well, that's only one authentication factor. An email > compromise could therefore easily result in account takeover, which defeats > the purpose of 2FA. >> 2. Given that 13% of web user accounts list phone numbers outside the >> ARIN service region, should we widen the availability of SMS, or are the >> other offered 2FA options sufficient to meet the needs of these users? > I am against SMS 2FA being offered as an option at all, so I'm ambivalent > about this. >> 3. We agree that users should be allowed to register multiple hardware >> security keys. The question is: What is the optimal number of keys that >> should be allowed to be registered? > I can't see someone reasonably needing to register more than a handful, but > I also don't think there's a good reason to set a low limit. I think 10 is > a reasonable upper bound. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 511 bytes Desc: not available URL: From roman at intlos.org Tue Jan 24 17:50:26 2023 From: roman at intlos.org (Roman Tatarnikov) Date: Tue, 24 Jan 2023 14:50:26 -0800 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <0F950928-53FC-4333-ADE2-1B47AE766CD5@semihuman.com> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <0F950928-53FC-4333-ADE2-1B47AE766CD5@semihuman.com> Message-ID: On Tue, Jan 24, 2023 at 01:39:21PM -0800, Chris Woodfield wrote: > Would requiring TOTP/FIDO (and not allowing SMS) be more palatable if ARIN were able/willing to furnish yubikeys (or alternate authenticators) to users free of charge? I don?t know what these cost in bulk nowadays, but it?s probably right on the edge of reasonable for this use case. TOTP itself does not require hardware. It's always possible to use LastPass or some other password manager ( open source https://keepassxc.org/ is great). So it can be completely free or the organization can cover the cost of hardware keys. No need for ARIN to pick up the bill. Looking at the emails in this thread, everyone says how insecure SMS and email options are. I agree completely, but what's important to keep in mind is why those options are provided by different providers. Google, MS, banks, etc - they are aimed for a wide audience that may not necessarily be tech-savvy. People who manage important and highly confidential information should have no problem using a password manager. Providing an SMS, email or other insecure options to people who manage such records (aka anyone with an ARIN account), just because they are "not tech savvy" is a poor excuse. Yes, we have to think of community, but holding back said community from advancement is a disservice to the very group we're talking about. I think TOTP, U2F and FIDO2 are great protocols for support of 2FA. What we need to do as a community is ensure that there are articles, manuals, and guides on how those can be used and why. This way, all members of our community, both those who are and are not familiar with these options, can advance. And we should also ensure to promote and educate those around us. -- Roman V Tatarnikov | https://linkedin.com/in/rtatarnikov From rlaager at wiktel.com Tue Jan 24 18:00:08 2023 From: rlaager at wiktel.com (Richard Laager) Date: Tue, 24 Jan 2023 17:00:08 -0600 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> Message-ID: On 1/24/23 15:40, Adam Thompson wrote: > The goal should be to add the minimum increment of security that > satisfies the business objective.? Unfortunately, the business > objective here seems to have been ?add 2FA? which is a technical > objective, not a business objective. 2FA is a business objective these days. If you don't use 2FA for email, VPN, and Domain Admin access, you are basically uninsurable for cyber risk right now (and have been for a year or more). I can't speak to exactly what underwriters would require of ARIN for ARIN's own services, so maybe this isn't a hard requirement today, but it's not unreasonable to think that it might be now or in the near future. > Just enforcing password length > 20 would have increased security > without needing 2FA. (Obviously not increased **enough** to satisfy > everyone, but my statement stands.) > A (the?) major goal of 2FA is to make it so that if your password is compromised, the attacker still cannot authenticate as you. No amount of password length or complexity helps with that. In the typical corporate example... If I get your corporate password, without 2FA, I can login as you to every server / network device / whatever. With 2FA required, I can't login to anything (without also compromising your second factor). In other words, 2FA contains the initial breach, rather than letting the attacker run wild through the whole infrastructure. Requiring a unique password for every single device would accomplish the same thing without 2FA, but 1) that's not practical to enforce, and 2) that's worse for usability. So 2FA it is. As to your particular troubles with breaking/losing authenticators... Get something like 1Password, set it up on multiple devices (which you're surely going to do anyway: phone, computer, etc.), and store your ARIN TOTP 2FA in there. You'll improve both security and convenience. -- Richard -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Tue Jan 24 19:27:52 2023 From: athompso at athompso.net (Adam Thompson) Date: Wed, 25 Jan 2023 00:27:52 +0000 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> Message-ID: I?ve recently (within the last year) had to deal with insurance companies changing the ground rules for an entire industry that I service. You?re partially but not entirely correct, vis-?-vis the scenario I had here: having SOME additional security beyond userid and password is now required, but it doesn?t have to be what we?re calling 2FA in this discussion. (We should be referring to ?MFA? instead, but that battle is long-since lost.) Here the question is enforcing MFA on logins to ARIN. This is not a ?typical corporate system? and lateral movement within the network is irrelevant. There?s also little to no confidential information behind ARIN credentials. Some of the data must be protected against unwanted alteration or deletion. Specific technologies should not be the requirement ? that?s how you get the US Congress passing laws mandating AES-128 encryption exclusively! The requirement should be phrased as something like ?User account IDs and passwords must not be, by themselves, sufficient to establish a newly-authenticated access to ARIN systems from an unknown public IP address.? One obvious solution is ?2FA? using SMS/email/TOTP/FIDO, but there other options exist. The added factor does not need, necessarily, to be a device from which you can read a code. I loathe systems that give you a printed grid with keywords where you locate and enter a word from the reference card, but that?s a non-device-based system that never runs out of battery or signal and satisfies any MFA requirement about as well as TOTP. It?s more secure than SMS or email, doesn?t require anyone to master Yet Another Technology, but is very rarely deployed. I use the Microsoft Authenticator to address my issues in the way you describe, as it?s easy to install on a backup phone. The backup phone no longer powers on. So I also have a Yubikey locked away in the office where it *hopefully* can?t bit-rot, but I need to physically be in the office to reset/fix anything. I also have LastPass available to me for this purpose. The UIs are embarrassingly bad if you have more than one or two things tied to them, and fall squarely into the ?my grandmother would not be able to deal with this? category. I strongly disagree with the idea that every ARIN account-holder is, or should be, a technologist, never mind that they should be at the forefront of security technology. I get paid to stay moderately current on how to build networks using basic tools ? spending time learning how to use TOTP is, very literally, something that will get me called on the carpet ? that sort of thing has already happened to me within the last year! (Yes, I work for government? hopefully private industry isn?t quite as inflexible.) If you want ARIN to drag all its customers along on a security journey, we need MASSIVELY better documentation covering MULTIPLE common systems/tools. I can find several examples local to me where the receptionist is now the ARIN contact person. I know several where a line-of-business administrator is the ARIN contact. I know of multiple ARIN resource holders who do not employ anyone technical (in the IT sense). Yes, those orgs rely on consultants, but now we?re effectively making business decisions for them, and I do not support that either. At this point, I feel like I?m shouting into the wind (or maybe I?m the old man shouting at clouds?) ? as if everyone else has drunk the 2FA Kool-Aid? and can?t see anything wrong with it. There are things wrong with computers and networks, why can?t there be something wrong with MFA, too? I?m perfectly OK with enabling SMS and Email for MFA because it?s better than what we have now. No, it?s not perfect. But if you?re arguing that SMS and Email are ?too insecure?, you?ve clearly never heard the saying ?the perfect is the enemy of the good?. BABY STEPS. Get SMS and Email 2FA today, for the luddites or laggards in the crowd, and deprecate them about 2 years from now. Otherwise, give me decent documentation that shows me, screen by screen, step by step, how to enable TOTP with LastPass, and MS Authenticator, and whatever Google?s thing is called, and some other free product; then ALSO let me register a decent number of TOTP systems (yes, I admit 10 should be more than adequate for any realistic scenario I can imagine) and we?re probably good. But the documentation is sorely lacking today. And you?re expecting people who don?t know what TOTP even is to be on-board with this? Nope. -Adam From: Richard Laager Sent: Tuesday, January 24, 2023 5:00 PM To: Adam Thompson Cc: arin-consult at arin.net Subject: Re: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online On 1/24/23 15:40, Adam Thompson wrote: The goal should be to add the minimum increment of security that satisfies the business objective. Unfortunately, the business objective here seems to have been ?add 2FA? which is a technical objective, not a business objective. 2FA is a business objective these days. If you don't use 2FA for email, VPN, and Domain Admin access, you are basically uninsurable for cyber risk right now (and have been for a year or more). I can't speak to exactly what underwriters would require of ARIN for ARIN's own services, so maybe this isn't a hard requirement today, but it's not unreasonable to think that it might be now or in the near future. Just enforcing password length > 20 would have increased security without needing 2FA. (Obviously not increased *enough* to satisfy everyone, but my statement stands.) A (the?) major goal of 2FA is to make it so that if your password is compromised, the attacker still cannot authenticate as you. No amount of password length or complexity helps with that. In the typical corporate example... If I get your corporate password, without 2FA, I can login as you to every server / network device / whatever. With 2FA required, I can't login to anything (without also compromising your second factor). In other words, 2FA contains the initial breach, rather than letting the attacker run wild through the whole infrastructure. Requiring a unique password for every single device would accomplish the same thing without 2FA, but 1) that's not practical to enforce, and 2) that's worse for usability. So 2FA it is. As to your particular troubles with breaking/losing authenticators... Get something like 1Password, set it up on multiple devices (which you're surely going to do anyway: phone, computer, etc.), and store your ARIN TOTP 2FA in there. You'll improve both security and convenience. -- Richard -------------- next part -------------- An HTML attachment was scrubbed... URL: From rlaager at wiktel.com Tue Jan 24 20:15:55 2023 From: rlaager at wiktel.com (Richard Laager) Date: Tue, 24 Jan 2023 19:15:55 -0600 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <02E3276A-9972-49D5-B061-73789BF10BAA@arin.net> References: <02E3276A-9972-49D5-B061-73789BF10BAA@arin.net> Message-ID: <7af788ef-3362-83bf-8a1a-87c8d022330f@wiktel.com> On 1/24/23 12:53, ARIN wrote: > 1. Would you support ARIN offering email as an additional 2FA method? No. As mentioned, if email can reset the password, then it's really only one factor. Even non-technical users should be able to use something else, like SMS. > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? While I could be persuaded otherwise, my gut feeling is "no". Saying "yes" feels like opening a can of worms. Is ARIN going to make some determination country-by-country as to whether their SMS security is good enough? I realize this does mean that people outside of the ARIN region are forced into using the more complicated methods. I'm guessing (but it is just a guess) that organizations with people administering resources outside of their local region are likely more sophisticated anyway. David Farmer mentioned "technology restrictions or embargos on the more secure FIDO or TOTP technologies". Is that actually a thing? I don't think that should be a consideration if it's only hypothetical. I would like to see 2FA required. (It's still optional today, I assume.) If I'm forced to choose between: A) Allow worldwide SMS. Require 2FA for everyone. B) Disallow worldwide SMS. Do not require 2FA for everyone. I might be more inclined to pick A. > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? Absolutely not less than two. You need two for rollover and may want two for backup. Three or four seems like a more reasonable minimum. Nine or ten seems like a reasonable maximum, such that ARIN's developers can at least occasionally test that scenario. -- Richard From ray at oneunified.net Tue Jan 24 20:25:49 2023 From: ray at oneunified.net (Raymond Burkholder) Date: Tue, 24 Jan 2023 18:25:49 -0700 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: <79ebc855-ef69-8696-8fec-aeccf4502539@oneunified.net> On 1/24/23 11:53, ARIN wrote: > On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: > > - Time-based One-time Password (TOTP) using an authenticator of your choice > - Short Message Service (SMS) for customers within the ARIN service region > - FIDO2/Passkey-enabled Security Key > > Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. > > Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: > > - Allowing email as an authentication method > - Enabling SMS support for customers who reside outside of the ARIN service region > - Allowing registration of multiple hardware security keys. > > We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: Flexibility is good.? I may or may not have a phone.? I may have left my key ring somewhere.?? I may not have access to email. > > 1. Would you support ARIN offering email as an additional 2FA method? It would be my preferred mechanism.? My email is hosted by my org so I classify it as rather safe, and less of a risk.? For those with email hosted on a public facility of some sort, perhaps the risk is higher. So... who gets to define the risk for any of the options provided? Is it a risk managed by the user on an individual basis, or is it a risk taken on by ARIN?? What does ARIN perceive as a risk?? Are they seeing any particular method as having more risk for account access than any other? Credit card companies and banks seem to accept email and SMS as suitable propositions. In addition, some will do a follow up with one or more personally identified question/answer exchanges for further verification. > > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? Are there extra costs for the widened availability of SMS?? If I happen to be roaming in a country away from my home base, it would be helpful to sometimes have SMS as an alternative to my email.? Or even a voice call interaction. > > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? maybe start implementation and see how the system is used or abused, and then establish from an evidence based scenario? > > The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. > > Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult > > This consultation will remain open through 5:00 PM ET on 7 February 2023. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > Helpful Resources: > > Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ > Two-Factor Authentication at ARIN: https://arin.net/2FA > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. > From farmer at umn.edu Tue Jan 24 21:40:54 2023 From: farmer at umn.edu (David Farmer) Date: Tue, 24 Jan 2023 20:40:54 -0600 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <7af788ef-3362-83bf-8a1a-87c8d022330f@wiktel.com> References: <02E3276A-9972-49D5-B061-73789BF10BAA@arin.net> <7af788ef-3362-83bf-8a1a-87c8d022330f@wiktel.com> Message-ID: On Tue, Jan 24, 2023 at 19:16 Richard Laager wrote: > > David Farmer mentioned "technology restrictions or embargos on the more > secure FIDO or TOTP technologies". Is that actually a thing? I don't > think that should be a consideration if it's only hypothetical. I don?t know that FIDO or TOTP are controlled technologies, but DUO a similar authentication technology is, see the following; https://help.duo.com/s/article/7544?language=en_US Furthermore, I don?t believe, ARIN can do business with entities from these countries anyway, so from a practical perspective it could be a non-issue. But these kinds of issues are more than just hypothetical, whether or not they apply to the FIDO or TOTP technologies today, they could at some future date. And I have no idea if some more totalitarian regimes even allow the use of FIDO or TOTP technologies, it wouldn?t be surprising if they didn?t. Thanks. > -- =============================================== David Farmer Email:farmer at umn.edu Networking & Telecommunication Services Office of Information Technology University of Minnesota 2218 University Ave SE Phone: 612-626-0815 Minneapolis, MN 55414-3029 Cell: 612-812-9952 =============================================== -------------- next part -------------- An HTML attachment was scrubbed... URL: From arin-consult at ve4.ca Wed Jan 25 06:45:20 2023 From: arin-consult at ve4.ca (Glen A. Pearce) Date: Wed, 25 Jan 2023 05:45:20 -0600 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: <395901ee-1b0d-4266-7b4e-8349d34fb8f9@ve4.ca> On 24/01/2023 12:53 p.m., ARIN wrote > We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: > > 1. Would you support ARIN offering email as an additional 2FA method? Yes, giving people more choices is better.? As I said in the previous consultation I would have preferred if 2FA hadn't been made mandatory but if it is anything that makes it easier should one of the other methods not work the better. When I had went to add SMS as my 2FA early this month neither of the numbers I submitted (each with different providers) got the test messages initially. When I submitted a ticket about the issue the initial response I got was an obvious boiler plate answer, it contained phrasing like "Please note that ARIN only supports SMS inside our region" but both numbers I tried were Canadian numbers.? (Being that Canada is the largest country in the ARIN region we should be hard to miss. ^_-) Since it looked like the problem was not going to be fixed based on that response, I sent a reply asking if new activations of the voice call authentication be available before the Feb. 1 deadline or if they are not will the deadline be extended until after it has been restored. 5 days later I finally got contacted back saying that you had some configuration issues at your end and to try SMS again.? Everything works now but having those issues sending SMS that close to a deadline I have no control of at my end was a bit concerning. Concerning enough that I ordered a Yubikey just in case it wasn't fixed (as it would take time to arrive here in the mail), that got shipped earlier the day ARIN replied to me so it was too late to cancel the order for it.? So now I've got a Yubikey that I really didn't have to order currently sitting in my "mail quarantine" area. At this point I'm not sure if I should at some point switch to using the Yubikey since I have it now anyway or if it should be put aside in case it's needed for something else at some point or if it should be sold. As for people hijacking SMS messages, I used a lesser known number out of my available choices so somebody wouldn't even know what number they need to hijack or from which provider. > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? If E-mail is allowed to be used for 2FA that might not be needed but if it is not I might encourage SMS coverage to be expanded to anywhere that it is feasible to do so. > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? Not sure what the hard limit should be but allowing multiple keys for those that choose that option would be a good idea as even very small organizations would probably want to have more that one locked up at more than one location for disaster recovery situations. > The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. > > Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult > > This consultation will remain open through 5:00 PM ET on 7 February 2023. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > Helpful Resources: > > Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ > Two-Factor Authentication at ARIN: https://arin.net/2FA > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. -- Glen A. Pearce gap at ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17 From arin-consult at ve4.ca Wed Jan 25 06:48:44 2023 From: arin-consult at ve4.ca (Glen A. Pearce) Date: Wed, 25 Jan 2023 05:48:44 -0600 Subject: [ARIN-consult] [General-members] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <02E3276A-9972-49D5-B061-73789BF10BAA@arin.net> Message-ID: <8991f67d-8384-d3b0-0606-ecc5c67a56bc@ve4.ca> On 24/01/2023 12:56 p.m., Adam Thompson wrote: > >> 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? > Functionally infinite. Why on earth would you set a hard-coded limit? It's not like an additional database table is expensive. If you have to set a limit, it should be something large like 2^32. I'm pretty sure budgetary limitations would kick in well before that point, even for fairly large organizations. ^_- -- Glen A. Pearce gap at ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17 From arin-consult at ve4.ca Wed Jan 25 06:55:19 2023 From: arin-consult at ve4.ca (Glen A. Pearce) Date: Wed, 25 Jan 2023 05:55:19 -0600 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> Message-ID: <101526d4-142a-a27c-e207-43fa2feb1b4a@ve4.ca> On 24/01/2023 1:16 p.m., Ross Tajvar wrote: > > 1. Would you support ARIN offering email as an additional 2FA method? > *No.*?Email can be used to reset one's password. If it's used for > one-time login codes as well, that's only one authentication factor. > An email compromise could therefore easily result in account takeover, > which defeats the purpose of 2FA. Perhaps allow it with a specification that the E-mail address used for 2FA be a different one than the E-mail address used for account recovery and an explanation so that people understand why it has to be a separate address.? Also include a suggestion that (like everything else) for this reason passwords should not be re-used. -- Glen A. Pearce gap at ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17 -------------- next part -------------- An HTML attachment was scrubbed... URL: From arin-consult at ve4.ca Wed Jan 25 07:14:25 2023 From: arin-consult at ve4.ca (Glen A. Pearce) Date: Wed, 25 Jan 2023 06:14:25 -0600 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <0F950928-53FC-4333-ADE2-1B47AE766CD5@semihuman.com> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <0F950928-53FC-4333-ADE2-1B47AE766CD5@semihuman.com> Message-ID: <4af6b072-f1e0-1ec1-ccec-a5d7a61a1d29@ve4.ca> On 24/01/2023 3:39 p.m., Chris Woodfield wrote: > Would requiring TOTP/FIDO (and not allowing SMS) be more palatable if > ARIN were able/willing to furnish yubikeys (or alternate > authenticators) to users free of charge? I don?t know what these cost > in bulk nowadays, but it?s probably right on the edge of reasonable > for this use case. When I recently bought a Yubikey the pricing per unit was the same whether 1 was purchased or 1000s.? There appears to be no "bulk" price. Ultimately ARIN providing them would just eventually get reflected in our fees so as ARIN members we'd still end up paying for them anyway, no advantage to even doing a group purchase. -- Glen A. Pearce gap at ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17 From arin-consult at ve4.ca Wed Jan 25 07:37:30 2023 From: arin-consult at ve4.ca (Glen A. Pearce) Date: Wed, 25 Jan 2023 06:37:30 -0600 Subject: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <7757cfe3-fe04-c0d6-39b8-f52e0d57ebda@wiktel.com> Message-ID: On 24/01/2023 3:40 p.m., Adam Thompson wrote: > > I DO NOT WANT SECURITY that presents any significant chance of denying > me access to my own accounts and resources.? SMS or email-based 2FA > schemes are a giant PITA, but both are fairly easily recoverable when > (not if) I lose access to them.? Are they good 2FA?? No.? Absolutely > not.? Are they better than nothing?? Yes. > > This entire discussion feels like https://xkcd.com/538/ to me.? If > someone wants access to my ARIN resources, one of the easier ways in > would be to physically threaten me or my family, and the best 2FA > implementations in the world do nothing (AFAIK) to protect against > that.? The specific technique or technology involved won?t make any > difference. > Pretty much my point in the previous consultation: https://lists.arin.net/pipermail/arin-consult/2022-May/001665.html Intruder traps or me carrying a firearm would probably do more to secure my ARIN account (as a side effect of securing myself and my premises) than any 2FA would.? Both of these measures pose...issues...under Canadian law though... Even the part from the mouse-over comment on that comic: >Actual actual reality: nobody cares about his secrets. Lines up with my comment: >That said although IP space is valuable I don't think we are anywhere >near people being kidnapped over it, especially a /24 that isn't eligible >for a specified transfer for another 3 years. -- Glen A. Pearce gap at ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17 -------------- next part -------------- An HTML attachment was scrubbed... URL: From arin-consult at ve4.ca Wed Jan 25 08:20:48 2023 From: arin-consult at ve4.ca (Glen A. Pearce) Date: Wed, 25 Jan 2023 07:20:48 -0600 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <4CAB265E-91BC-4864-A030-891036064A4B@arin.net> Message-ID: <5b9e6300-8e72-f12a-b8c7-4b63c79a136e@ve4.ca> On 24/01/2023 2:06 p.m., Adam Thompson wrote: > > P.S. Speaking of humans behaving suboptimally, Voicenetwork.ca ? > please do better.? Mailing lists should never feed directly into your > ticket system. > I suspect what happened there is: #1: Someone who worked at Voicenetwork.ca subscribed their work E-mail to this list ?????? thinking that they would be working there forever. #2: Their employment at Voicenetwork.ca ended on sufficiently short notice they were ?????? not able to to unsubscribe the work E-mail address from any lists it was on.? (Or ? ? ?? possibly they forgot to when they left the company.) #3: Voicenetworks.ca has a default policy of re-directing the E-mails of any former ? ? ? employees to a general address (that is attached to the ticketing system) to catch ????? E-mails from any customers that might try contacting said employee. A good preventative fix for this is for everyone to use a domain that you yourself own when subscribing to mailing lists rather than an employer controlled E-mail address that you could lose access to on short notice for reasons that can't be anticipated in advance.? (Other people's decisions can be unpredictable and arbitrary.) Of course this doesn't apply if you _own_ the associated business but for anyone else getting your own domain might spare mailing lists you are on from this problem. -- Glen A. Pearce gap at ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17 -------------- next part -------------- An HTML attachment was scrubbed... URL: From roman at intlos.org Wed Jan 25 11:31:45 2023 From: roman at intlos.org (Roman Tatarnikov) Date: Wed, 25 Jan 2023 08:31:45 -0800 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <4af6b072-f1e0-1ec1-ccec-a5d7a61a1d29@ve4.ca> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <0F950928-53FC-4333-ADE2-1B47AE766CD5@semihuman.com> <4af6b072-f1e0-1ec1-ccec-a5d7a61a1d29@ve4.ca> Message-ID: Seeing all this discussion about YubiKeys and who should cover the cost I suspect my yesterday's email got lost. Anyway, here it is (as well some additional comments at the end): > On Tue, Jan 24, 2023 at 01:39:21PM -0800, Chris Woodfield wrote: > > Would requiring TOTP/FIDO (and not allowing SMS) be more palatable if ARIN were able/willing to furnish yubikeys (or alternate authenticators) to users free of charge? I don?t know what these cost in bulk nowadays, but it?s probably right on the edge of reasonable for this use case. > > TOTP itself does not require hardware. It's always possible to use LastPass or some other password manager ( open source https://keepassxc.org/ is great). So it can be completely free or the organization can cover the cost of hardware keys. No need for ARIN to pick up the bill. > > > Looking at the emails in this thread, everyone says how insecure SMS and email options are. I agree completely, but what's important to keep in mind is why those options are provided by different providers. Google, MS, banks, etc - they are aimed for a wide audience that may not necessarily be tech-savvy. People who manage important and highly confidential information should have no problem using a password manager. Providing an SMS, email or other insecure options to people who manage such records (aka anyone with an ARIN account), just because they are "not tech savvy" is a poor excuse. Yes, we have to think of community, but holding back said community from advancement is a disservice to the very group we're talking about. > > I think TOTP, U2F and FIDO2 are great protocols for support of 2FA. What we need to do as a community is ensure that there are articles, manuals, and guides on how those can be used and why. This way, all members of our community, both those who are and are not familiar with these options, can advance. And we should also ensure to promote and educate those around us. YubiKey itself is a product provided by a single vendor. We should not talk about it as the only possible option at all. There are other vendors out there that support those standards: https://en.wikipedia.org/wiki/FIDO_Alliance Now, as for TOTP itself, it's another open standard that is available to everyone: https://en.wikipedia.org/wiki/Time-based_one-time_password You can use it with ``oathtool`` in Linux CLI, you can use it different password managers (LastPass, https://keepassxc.org/ , etc. Here's a list for example: https://www.wired.com/story/best-password-managers/ ). Installing a piece of software and saving a code in it should not be a problem. And if it is a problem and "we're forcing a business decision" (as I saw in one email yesterday), we should also keep in mind that we're talking about securing communication channels or access to their governing body. A very crucial fabric that our society relies on. So saying that we should allow SMS, email and other insecure options is like saying that the government is restricting people's use of transportation by making everyone wear a seatbelt. -- Roman V Tatarnikov | https://linkedin.com/in/rtatarnikov From doug at dougcamin.com Wed Jan 25 11:54:28 2023 From: doug at dougcamin.com (Douglas Camin) Date: Wed, 25 Jan 2023 16:54:28 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online In-Reply-To: <952B42B7-B299-46D2-BFD9-198CEB938212@semihuman.com> References: <348341BA-2812-466E-AB94-B59FB9D04648@arin.net> <952B42B7-B299-46D2-BFD9-198CEB938212@semihuman.com> Message-ID: My thoughts (some of which others have previously stated): 1. I agree with others that email as MFA that is also the recovery email significantly weakens the overall security of it. Using an alternative email that is not the recovery email for 2FA would ameliorate that, if that is an option. I would be in support of email as MFA in that scenario. 1. Others pointed out SMS is considered a weaker MFA path (true), but I think there is a problem with widespread adoption of alternatives in ARIN?s service area. The ?right? answer is to say FIDO\TOTP, but I don?t think we?re there from a practical standpoint yet and SMS use represents a practical reality for the time being. Restricting MFA to the ARIN region does seem like a continued reasonable middle ground, though I?m making that statement on the presumption that in theory those carriers are easier to assume reliability (or it is more difficult to compromise users on those services) that farther-flung international ones (which could be one of those myths I believe.) Definitely taking in the other comments and thinking about them. 1. I think there is a good reason to create some sort of upper bound on the number of keys registered. Unlimited disincentivizes users from actively managing the tokens registered and can create edge cases if someone takes advantage of that. 5-10 sounds superficially reasonable, though I?d be interested in other viewpoints detailing cases I may not be considering. Soft limits also seem good, if practical. Thanks ? Doug -- Douglas J. Camin doug at dougcamin.com From: ARIN-consult on behalf of Chris Woodfield Date: Tuesday, January 24, 2023 at 2:30 PM To: ARIN Cc: Subject: Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online On Jan 24, 2023, at 11:16 AM, Ross Tajvar wrote: > 1. Would you support ARIN offering email as an additional 2FA method? No. Email can be used to reset one's password. If it's used for one-time login codes as well, that's only one authentication factor. An email compromise could therefore easily result in account takeover, which defeats the purpose of 2FA. Agreed. The password-reset mechanism and standard 2FA login process should not both use the same auth path. > 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? I am against SMS 2FA being offered as an option at all, so I'm ambivalent about this. I?m not a fan of SMS as a 2FA for all the obvious reasons, but also recognize that requiring FIDO/TOTP as the *only* supported 2FA is a sure path to tepid adoption. I believe that we should highly encourage users to prefer those mechanisms over SMS but not prohibit SMS as an option. > 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? I can't see someone reasonably needing to register more than a handful, but I also don't think there's a good reason to set a low limit. I think 10 is a reasonable upper bound. The only reason I can see to limit the number of keys is to discourage the use of a single account by multiple employees in an organization. I think a good approach is to have a soft limit (say, 8) that can be increased on request to help combat this. There should also be a mechanism to delete no-longer-used 2FA keys instead of simply disabling them (Seems obvious, but I have accounts on sites that don?t allow this, leading to a ever-growing list of registered auth apps on various phones shown in my account) Separate question - is there a workflow for manually resettting/removing user 2FA when users lose their tokens/auth apps/phone numbers/etc? How would ARIN staff authenticate those requests? Please, please don?t make that process involve a notary (I?m looking at you, AWS). Thanks, -Chris On Tue, Jan 24, 2023 at 1:53 PM ARIN > wrote: On 1 November 2022, ARIN? announced?that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023.?ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts: - Time-based One-time Password (TOTP) using an authenticator of your choice - Short Message Service (SMS) for customers within the ARIN service region - FIDO2/Passkey-enabled Security Key Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts. Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including: - Allowing email as an authentication method - Enabling SMS support for customers who reside outside of the ARIN service region - Allowing registration of multiple hardware security keys. We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically: 1. Would you support ARIN offering email as an additional 2FA method? 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: https://lists.arin.net/mailman/listinfo/arin-consult This consultation will remain open through 5:00 PM ET on 7 February 2023. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) Helpful Resources: Consultation: https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/ Two-Factor Authentication at ARIN: https://arin.net/2FA _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. _______________________________________________ ARIN-Consult You are receiving this message because you are subscribed to the ARIN Consult Mailing List (ARIN-consult at arin.net). Unsubscribe or manage your mailing list subscription at: https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services Help Desk at info at arin.net if you experience any issues. -------------- next part -------------- An HTML attachment was scrubbed... URL: From Joey.White at bcbsks.com Wed Jan 25 13:46:13 2023 From: Joey.White at bcbsks.com (Joey White) Date: Wed, 25 Jan 2023 18:46:13 +0000 Subject: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online Message-ID: 1. Would you support ARIN offering email as an additional 2FA method? No. Email is an account you enable with 2FA, not the method of accomplishing 2FA. https://www.cisa.gov/mfa https://www.hsph.harvard.edu/information-technology/2022/10/03/october-is-cybersecurity-month-week-1/ 2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users? No, do not widen the availability of SMS. SMS is on a downward trend in the industry. https://www.cisa.gov/blog/2022/10/18/next-level-mfa-fido-authentication 3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered? Anything more than one. Two is sufficient, but do not set that as the max value. The expectation is the identity provider (IdP) product will define the max value. https://www.yubico.com/spare/ Thank you, Joey White Security Architect Blue Cross and Blue Shield of Kansas p: 785-291-6471 | w: bcbsks.com _______________________________________________ CONFIDENTIALITY NOTICE: This email message and any attachments are for the sole use of the intended recipient(s) and may contain proprietary, confidential, trade secret or privileged information. Any unauthorized review use, disclosure or distribution is prohibited and may be a violation of law. If you are not the intended recipient or a person responsible for delivering this message to an intended recipient, please contact the sender by reply email and destroy all copies of the original message. -------------- next part -------------- An HTML attachment was scrubbed... URL: