<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On May 25, 2022, at 08:40, Scott Leibrand <<a href="mailto:scottleibrand@gmail.com" class="">scottleibrand@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">Putting TOTP in 1Password makes login far more convenient than SMS 2FA, and almost as convenient as password-only, even for shared accounts.</div><div class=""><br class=""></div>ARIN should probably provide instructions for how to add your TOTP to 1Password (and any other password managers that support that workflow), because it's not a very intuitive enrollment experience.<div class=""><br class=""></div><div class="">We could also make 2FA only mandatory for activities that change resource control (outbound transfers, reassignments, etc.)...<br class=""></div></div></div></blockquote><div><br class=""></div>I would support this.</div><div><br class=""></div><div>I’m fine if I have to 2FA to do something potentially harmful, but to have to 2FA every time I log in to check the status of a ticket would be less than ideal.</div><div><br class=""></div><div>Owen</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><div class=""><br class=""></div><div class="">-Scott</div></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, May 25, 2022 at 8:21 AM Richard Laager <<a href="mailto:rlaager@wiktel.com" class="">rlaager@wiktel.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto" class="">You can put your TOTP in something like 1Password.<br class=""><br class=""><div dir="ltr" class="">-- <div class="">Richard</div></div><div dir="ltr" class=""><br class=""><blockquote type="cite" class="">On May 25, 2022, at 09:46, Adam Thompson <<a href="mailto:athompso@athompso.net" target="_blank" class="">athompso@athompso.net</a>> wrote:<br class=""><br class=""></blockquote></div><blockquote type="cite" class=""><div dir="ltr" class="">
<div style="color:rgb(33,33,33);background-color:rgb(255,255,255)" dir="auto" class="">
I have not enabled 2FA.</div>
<div style="color:rgb(33,33,33);background-color:rgb(255,255,255)" dir="auto" class="">
<br class="">
</div>
<div style="color:rgb(33,33,33);background-color:rgb(255,255,255)" dir="auto" class="">
TOTP lies at the unfortunate confluence of vendor misfeatures and organizational policies that render it not durable or resilient in the face of mobile device failure (which seems to happen to me a LOT more often than normal). <span style="font-size:12pt" class="">Possibly
I don't know something about our approved authenticator apps that might solve the problem, but last time I checked, it was a no-go for me.</span></div>
<div style="color:rgb(33,33,33);background-color:rgb(255,255,255)" dir="auto" class="">
<br class="">
</div>
<div style="color:rgb(33,33,33);background-color:rgb(255,255,255)" dir="auto" class="">
I've instead opted to use a long, randomly-generated password that I can store in ways that are both secure and durable/resilient.</div>
<div style="color:rgb(33,33,33);background-color:rgb(255,255,255)" dir="auto" class="">
<br class="">
</div>
<div style="color:rgb(33,33,33);background-color:rgb(255,255,255)" dir="auto" class="">
-Adam</div>
<div id="gmail-m_1184286891853405411ms-outlook-mobile-signature" dir="auto" class="">
<div class=""><br class="">
</div>
Get <a href="https://aka.ms/AAb9ysg" target="_blank" class="">Outlook for Android</a></div>
<hr style="display:inline-block;width:98%" class="">
<div id="gmail-m_1184286891853405411divRplyFwdMsg" dir="ltr" class=""><font face="Calibri, sans-serif" style="font-size:11pt" class=""><b class="">From:</b> ARIN-consult <<a href="mailto:arin-consult-bounces@arin.net" target="_blank" class="">arin-consult-bounces@arin.net</a>> on behalf of Bram Abramson <<a href="mailto:bda@bazu.org" target="_blank" class="">bda@bazu.org</a>><br class="">
<b class="">Sent:</b> Wednesday, May 25, 2022 9:26:59 AM<br class="">
<b class="">To:</b> ARIN-consult <<a href="mailto:arin-consult@arin.net" target="_blank" class="">arin-consult@arin.net</a>><br class="">
<b class="">Subject:</b> [ARIN-consult] increasing 2FA take-up</font>
<div class=""> </div>
</div>
<div class="">
<div style="font-family:sans-serif" class="">
<div style="white-space:normal" class=""><p dir="auto" class="">All,</p><p dir="auto" class="">The current consultation is about rendering SMS a 2FA option, then making 2FA mandatory. But it also notes that TOTP 2FA has been available since 2015 with a 3.2 percent take-up.</p><p dir="auto" class="">Optional 2FA is perhaps inevitably doomed to low take-up, but I it’s likely worth documenting any learnings from the implementation thus far, on the way to that 3.2 percent take-up:</p>
<ul class="">
<li class=""><p dir="auto" class="">Have most folks involved in this discussion already activated 2FA (are we preaching to the converted)? If not — why has it made sense for you not to?</p>
</li><li class=""><p dir="auto" class="">Do we think most of the broader community is aware of the 2FA opportunity — and are there thoughts, UX or otherwise, on why the crushing majority of folks haven’t availed themselves of it?</p>
</li></ul><p dir="auto" class="">Thanks, and cheers,</p>
<hr style="border:0px;height:1px;background:rgb(51,51,51)" class=""><p dir="auto" class="">Bram Abramson<br class="">
<a href="mailto:bda@bazu.org" style="color:rgb(57,131,196)" target="_blank" class="">bda@bazu.org</a> / @bramabramson</p>
</div>
</div>
</div>
<span class="">_______________________________________________</span><br class=""><span class="">ARIN-Consult</span><br class=""><span class="">You are receiving this message because you are subscribed to the ARIN Consult Mailing</span><br class=""><span class="">List (<a href="mailto:ARIN-consult@arin.net" target="_blank" class="">ARIN-consult@arin.net</a>).</span><br class=""><span class="">Unsubscribe or manage your mailing list subscription at:</span><br class=""><span class=""><a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank" class="">https://lists.arin.net/mailman/listinfo/arin-consult</a> Please contact the ARIN Member Services</span><br class=""><span class="">Help Desk at <a href="mailto:info@arin.net" target="_blank" class="">info@arin.net</a> if you experience any issues.</span><br class=""></div></blockquote></div>_______________________________________________<br class="">
ARIN-Consult<br class="">
You are receiving this message because you are subscribed to the ARIN Consult Mailing<br class="">
List (<a href="mailto:ARIN-consult@arin.net" target="_blank" class="">ARIN-consult@arin.net</a>).<br class="">
Unsubscribe or manage your mailing list subscription at:<br class="">
<a href="https://lists.arin.net/mailman/listinfo/arin-consult" rel="noreferrer" target="_blank" class="">https://lists.arin.net/mailman/listinfo/arin-consult</a> Please contact the ARIN Member Services<br class="">
Help Desk at <a href="mailto:info@arin.net" target="_blank" class="">info@arin.net</a> if you experience any issues.<br class="">
</blockquote></div>
_______________________________________________<br class="">ARIN-Consult<br class="">You are receiving this message because you are subscribed to the ARIN Consult Mailing<br class="">List (<a href="mailto:ARIN-consult@arin.net" class="">ARIN-consult@arin.net</a>).<br class="">Unsubscribe or manage your mailing list subscription at:<br class=""><a href="https://lists.arin.net/mailman/listinfo/arin-consult" class="">https://lists.arin.net/mailman/listinfo/arin-consult</a> Please contact the ARIN Member Services<br class="">Help Desk at <a href="mailto:info@arin.net" class="">info@arin.net</a> if you experience any issues.<br class=""></div></blockquote></div><br class=""></body></html>