<html><head></head><body><div dir="ltr"><div dir="ltr"><div dir="ltr" style="mso-line-height-rule:exactly;-webkit-text-size-adjust:100%;direction:ltr;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:20px 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="center" style="vertical-align:middle;"><img src="cid:image444934.png@903AD5B6.E9E8D2FB" height="50" border="0" alt="" style="height:50px;min-height:50px;max-height:50px;font-size:0;" /></td><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:8px 0 0 16px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:0 0 2px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#000001;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;">Matt Harris<span style="font-family:remialcxesans;font-size:1px;color:#FFFFFF;line-height:1px;"></span></td><td align="left" style="vertical-align:top;font-size:0;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#000001;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="padding:0 6px;vertical-align:top;font-family:Calibri,Arial,sans-serif;">|</td></tr></table></td><td align="left" style="vertical-align:top;color:#6B33C2;font-family:Calibri,Arial,sans-serif;">VP of Infrastructure</td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="padding:0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:2px 0 0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#000001;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;">816‑256‑5446</td><td align="left" style="vertical-align:top;font-size:0;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#000001;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="padding:0 6px;vertical-align:top;font-family:Calibri,Arial,sans-serif;">|</td></tr></table></td><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;">Direct</td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#000001;font-style:normal;font-weight:700;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="padding:0;vertical-align:top;font-family:Calibri,Arial,sans-serif;">Looking for help?</td></tr><tr style="font-size:0;"><td align="left" style="padding:0;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:4px 0 24px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#201C6F;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;"><span style="text-decoration:underline;"><a href="https://help.netfire.net/" target="_blank" id="LPlnk689713" title="Submit a ticket to our helpdesk!" style="text-decoration:underline;color:#201C6F;"><strong style="font-weight:400;">Helpdesk</strong></a></span></td><td align="left" style="vertical-align:top;font-size:0;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#000001;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="padding:0 6px;vertical-align:top;font-family:Calibri,Arial,sans-serif;">|</td></tr></table></td><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;"><span style="text-decoration:underline;"><a href="mailto:help@netfire.net" target="_blank" id="LPlnk689713" title="Send us an email!" style="text-decoration:underline;color:#201C6F;"><strong style="font-weight:400;">Email Support</strong></a></span></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="left" style="padding:0 0 16px;vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0;vertical-align:top;"><img src="https://netfire.net/Flag-United-States-of-America.jpg" height="24" border="0" alt="" style="height:24px;min-height:24px;max-height:24px;font-size:0;" /></td><td align="center" style="padding:0;vertical-align:middle;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;"><tr style="font-size:0;"><td align="center" style="padding:0 0 0 16px;vertical-align:middle;"><table cellpadding="0" cellspacing="0" border="0" style="white-space:nowrap;color:#000001;font-size:14.67px;font-family:Calibri,Arial,sans-serif;font-weight:400;font-style:normal;text-align:left;"><tr style="font-size:14.67px;"><td style="font-family:Calibri,Arial,sans-serif;">We build customized end‑to‑end technology solutions powered by NetFire Cloud.</td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></div>On Tue, May 24, 2022 at 2:52 PM Ross Tajvar <<a href="mailto:ross@tajvar.io">ross@tajvar.io</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">I strongly agree with Larry. I have had money stolen from accounts protected with SMS 2FA because it is not secure. I do not support enablement of SMS 2FA at all, even as a second option. I *do* support mandatory enforcement of TOTP or FIDO 2FA for all users, new or not.<div><br></div><div>-Ross<br><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><pre style="white-space:pre-wrap;color:rgb(0,0,0)">In answer to the consult:
Once SMS-based two-factor authentication (2FA) is available for ARIN
Online, do you believe ARIN *should not* proceed with requiring 2FA
authentication (SMS-based or TOTP) for all ARIN Online accounts? If so,
why?
SMS 2FA is subject to security flaws, interception, sim-card theft, etc.
I don't believe SMS 2FA is appropriate at all.
TOTP or FIDO should be the only methods, IMO.</pre></blockquote></div></div></blockquote><div><br></div><div>I agree, as well. I believe that any perceived difficulty inherent in utilizing totp 2fa is simply a mis-perception. Indeed, if you have a device capable of receiving SMS, you likely have a device capable of running a totp app. On the other hand, a device capable of running a totp app - or, alternatively as Ross mentioned, performing FIDO auth - is far less expensive than a device capable of receiving SMS and the associated subscriptions required in order to do so. For example, there are a number of free totp apps (I use google authenticator) for both android and ios. If you have access to neither, and FIDO were implemented, a simple FIDO device such as a yubikey can likely be had for $25 USD if not less. </div><div><br></div><div>ARIN should proceed with requiring 2fa for at least all accounts which are holders of resources such as ASNs and address resources. This should not be dependent on implementing SMS 2fa, and FIDO support should be considered as a superior secondary option for those who do not wish to utilize totp. This will offer the greatest added security while additionally providing for the lowest possible cost of participation, as a FIDO (blue) yubikey is widely available for $25 USD, a one-time charge unlike the subscription required to receive SMS at a distinct DID or shortcode. </div><div><br></div><div>- mdh</div><div><br></div></div></div>
</body></html>