<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 16, 2020, at 3:13 PM, William Herrin <<a href="mailto:bill@herrin.us" class="">bill@herrin.us</a>> wrote:</div></blockquote><blockquote type="cite" class=""><div class=""><div class=""><br class=""><blockquote type="cite" class=""> * 2019.14: Implement FIDO2 (WebAuthn) for ARIN Online:<br class=""><a href="https://www.arin.net/participate/community/acsp/suggestions/2019-14/" class="">https://www.arin.net/participate/community/acsp/suggestions/2019-14/</a><br class=""></blockquote><br class="">This is flavor-of-the-month. There will be something better next year.<br class="">And the year after that. Is it a good one? Enough better than what<br class="">you're doing now to be worthwhile? I don't know. But it's very<br class="">flavor-of-the-month.<br class=""></div></div></blockquote></div><br class=""><div class="">Respectfully disagree on all counts. FIDO has been around since 2013.</div><div class=""><br class=""></div><div class="">The reason it feels like “flavor of the month” to you is the recent mindset tipping point which has resulted in more or less universal browser support (made it into Safari including mobile with iOS 13.3; Chrome and Firefox have supported it for much longer) and OpenSSH 8.2. At least two of the big public clouds support it. <a href="http://login.gov" class="">login.gov</a> has been supporting it since September 2018 - <a href="https://fidoalliance.org/webinar-deployment-case-study-login-gov-fido2/" class="">https://fidoalliance.org/webinar-deployment-case-study-login-gov-fido2/</a></div><div class=""><br class=""></div><div class="">As was noted elsewhere in this thread, ARIN already supports RFC 6238 (TOTP) MFA. which is coming up 9 years since its informational RFC was published. Not to take away from TOTP, which is far better than no second factor, but there are multiple technological advantages to FIDO2 by comparison, chief among them being hard token reusability across multiple services.</div><div class=""><br class=""></div><div class="">Expanding the supported list of supported MFA schemes to include FIDO2, and sunsetting the creation of new SMS-as-second-factor accounts (while continuing to support it and perhaps laying in an EOL date) is precisely the kind of evolution-to-suit-the-times thing that we should do periodically.</div><div class=""><br class=""></div><div class="">-r</div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>