<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 25 May 2022, at 11:13 AM, Matt Harris <<a href="mailto:matt@netfire.net" class="">matt@netfire.net</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">I
do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring 2fa, only requiring it when resources
are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. </span></div>
</blockquote>
</div>
<br class="">
<div class="">Matt - </div>
<div class=""><br class="">
</div>
<div class="">Wouldn’t the “compromise approach” shown above leave ARIN with accounts that are still subject to brute-force login attacks, and therefore not address the other aspect raised in the consultation:</div>
<div class=""><br class="">
</div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class="">
<div class="">
<blockquote type="cite" class=""><i class="">However, we continue to see frequent attacks on our log-in systems, and ARIN staff continues to be heavily engaged in mitigating these attacks. Accounts not using 2FA are susceptible to these attacks. We recently
updated the community on this topic during ARIN 49 held in Nashville and online in April. You can review this information from the ARIN 49 Meeting Report (<a href="https://www.arin.net/participate/meetings/ARIN49/" class="">https://www.arin.net/participate/meetings/ARIN49/</a>)
by looking for the presentation titled “Brute Force Login Attacks”. </i></blockquote>
<br class="">
</div>
<div class=""><br class="">
</div>
</blockquote>
Thoughts?
<div class="">/John</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">John Curran</div>
<div class="">President and CEO</div>
<div class="">American Registry for Internet Numbers</div>
</div>
<div class=""><br class="">
</div>
</body>
</html>