<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On May 24, 2022, at 1:40 PM, William Herrin <<a href="mailto:bill@herrin.us" class="">bill@herrin.us</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">While it's use should be encouraged, It</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">is my opinion that 2FA should NEVER be required. Let customers</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">identify the access process which fits THEIR use of ARIN Online.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote></div><br class=""><div class="">Disagree strongly. Requiring a second factor, even a crummy one like SMS (colloquially "1.2FA-not-2FA") reduces risk substantially. We can expect some increased workload for ARIN help desk staff who will face incrementally more work dealing with credential issues due to increased complexity, lost second factor tokens, changed, phone numbers, etc. I believe the trade-off is worth it.</div><div class=""><br class=""></div><div class="">I applaud having FIDO2 on the roadmap and concur that requirement of a second factor should not be delayed to wait for it. I would support guidance to customerrs to only use SMS if they have no other option.</div><div class=""><br class=""></div><div class="">Based on hallway discussion at ARIN 49, I want to make sure to make it clear I am advocating for evolving to an underlying identity platform that supports multiple flavors of MFA and can be extended to support new ones. This is important for lifecycle management. No doubt the day will come that FIDO2 looks as old and crufty as TOTP or as inadvisable as SMS. In other words, it is the capability and the ability to implement the second factor using technology that will evolve over time that matters.</div><div class=""><br class=""></div><div class="">Speaking for myself, all the usual disclaimers,</div><div class=""><br class=""></div><div class="">-r</div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>