<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style>
<!--
@font-face
{font-family:Wingdings}
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:remialcxesans}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
span.EmailStyle19
{font-family:"Calibri",sans-serif;
color:windowtext}
.MsoChpDefault
{font-family:"Calibri",sans-serif}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.WordSection1
{}
ol
{margin-bottom:0in}
ul
{margin-bottom:0in}
-->
</style>
</head>
<body lang="EN-CA" link="blue" vlink="purple" style="word-wrap:break-word">
<div id="nine_body_n180fd4-87b02" class="nine_body" dir="auto" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12.0pt; line-height:1.3; color:#1F497D">
<div class="nine-pg" dir="auto">Adam,</div>
<div class="nine-pg" dir="auto"><br>
</div>
<div class="nine-pg" dir="auto">You can enroll multiple devices with TOTP today. When you register and use the QR code, do it on multiple devices. You can also copy the manual secret and put that in to a device anytime. </div>
<div class="nine-pg blank sign" dir="auto"><br>
</div>
<div id="nine-sign-n180fd4-87b02" class="nine_signature nine-pg" dir="auto">
<div class="nine-pg" dir="auto">Kevin</div>
</div>
</div>
<div class="quoted_output_body">
<div id="quoted_header_n180fd4-87b02" class="quoted_header_editor fold" dir="auto">
<hr style="border:none; height:1px; color:#E1E1E1; background-color:#E1E1E1">
<div dir="auto" style="border:none; padding:3.0pt 0cm 0cm 0cm"><span style="font-size:11.0pt; font-family:Calibri,Arial,Helvetica,sans-serif"><b>From:</b> Adam Thompson <athompson@merlin.mb.ca><br>
<b>Sent:</b> Wednesday, May 25, 2022 5:33 p.m.<br>
<b>To:</b> <arin-consult@arin.net><br>
<b>Subject:</b> Re: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (2FA) for ARIN Online Accounts<br>
</span></div>
</div>
<br type="attribution">
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="">The problem I have with MFA boils down to this:</span></p>
<ul type="disc" style="margin-top:0in">
<li class="MsoListParagraph" style="margin-left:0in"><span style="">Everyone has a reasonably convenient “forgot my password” feature/link/process that takes minutes, not hours.</span></li><li class="MsoListParagraph" style="margin-left:0in"><span style="">Almost no-one has a reasonably convenient “lost my token” feature/link/process (…yet). Those that do can take many hours or days.</span></li></ul>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><span style="">I’ve seen arguments along the lines of “well, just don’t lose your authenticator/token/key/thingy”, but I’ve been locked out of MFA-secured accounts and had to go through onerous, time-consuming processes to regain access,
I think 4 times? within my memory. One of those times was not my fault in any way, created a very large problem with significant lasting consequences, and was utterly irresoluble until the token situation was manually<i>
</i>resolved by someone else literally inventing a new process in real-time.</span></p>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><span style="">Hardware tokens fail: misplacing it, irretrievable loss (e.g. down a sewer grate, into a fire, etc.), physical damage (car tire, in one case), electrostatic damage, premature battery or component failure, clock skew, I’ve
seen them all.</span></p>
<p class="MsoNormal"><span style="">Software authenticators fail: uninstalling the app inadvertently (or deliberately), corrupting the app (usually inadvertent), new app update causes it to crash (but only for 2 or 3 people, making diagnosis impossible), forgetting
the master password to the app, losing (or losing access to) the device containing the app, I’ve seen all of those, too.</span></p>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><span style="">Any MFA system that does not permit multiple simultaneous enrolled modes of authentication – which today seems to be the vast majority of them – causes more problems that it solves.</span></p>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><span style="">I do NOT dispute the need to move away from simple userid/password authentication, but please, please, please, at least let users protect themselves from themselves. Allow enrolment of multiple keys, multiple TOTP authenticators,
multiple phone#s or emails to receive one-time codes, multiple FIDO keys, etc.</span></p>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><span style="">I’m going to keep harping on this as long as I keep losing/damaging/destroying/corrupting MFA tokens, both hard and soft. Right now, my employer applies MFA via a very-large-company’s-authenticator; to mitigate what I see
as an enormous risk, I have the authenticator loaded on a backup phone that’s reasonably accessible so I’m never 100% dead in the water. Relatively few authenticators let me do this, in my experience. I can’t share TOTP keys between phones with this particular
software, for some reason, using a corporate account. I’ve already had to use that backup phone once, while responding to a customer-down event – not a time when I want to be locked out of my systems.</span></p>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><span style="">MFA/MFA mitigates one set of risks but introduces another. If those new risks aren’t managed/addressed/mitigated, we’ll just exchange one set of problems for a different set of problems. They’re not that difficult to mitigate,
as long as it’s included in the design.</span></p>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><span style="">-Adam</span></p>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><b><span lang="FR-CA" style="color:#1F5587">Adam Thompson</span></b></p>
<p class="MsoNormal"><span lang="FR-CA" style="font-size:9.0pt; color:#1F5587">Consultant, Infrastructure Services</span></p>
<p class="MsoNormal"><span style="font-size:9.0pt; color:#1F497D"><img width="220" height="67" id="Picture_x0020_3" src="cid:image001.png@01D87051.47981240" alt="MERLIN" style="width:2.2916in; height:.7in"></span><span lang="EN-US" style="font-size:9.0pt; color:black"></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt; color:#1F5587">100 - 135 Innovation Drive</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt; color:#1F5587">Winnipeg, MB R3T 6A8</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt; color:#1F5587">(204) 977-6824 or 1-800-430-6404 (MB only)</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt; color:#1F5587"><a href="https://www.merlin.mb.ca/"><span style="color:#1F5587">https://www.merlin.mb.ca</span></a></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt; color:black"><img border="0" width="16" height="16" id="Picture_x0020_2" src="cid:image002.png@01D87051.47981240" style="width:.1666in; height:.1666in"></span><span lang="EN-US" style="font-size:9.0pt; color:#1F5587"><a href="https://teams.microsoft.com/l/chat/0/0?users=athompson@merlin.mb.ca"><span style="color:#1F5587">Chat
with me on Teams</span></a></span></p>
<p class="MsoNormal"><span style=""> </span></p>
<div style="border:none; border-left:solid blue 1.5pt; padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> ARIN-consult <arin-consult-bounces@arin.net>
<b>On Behalf Of </b>Ross Tajvar<br>
<b>Sent:</b> Wednesday, May 25, 2022 10:41 AM<br>
<b>To:</b> Owen DeLong <owen@delong.com><br>
<b>Cc:</b> <arin-consult@arin.net> <arin-consult@arin.net><br>
<b>Subject:</b> Re: [ARIN-consult] Consultation on Requiring Two-Factor Authentication (MFA) for ARIN Online Accounts</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0in 0in 0in 6.0pt; margin-left:4.8pt; margin-right:0in">
<p class="MsoNormal">I remain unconvinced that inflicting MFA on me solves a real problem that actually exists.</p>
</blockquote>
<div>
<p class="MsoNormal">I'm not sure why you (and others) seem to think MFA is so incredibly inconvenient. In my experience, it only takes a few extra seconds, or a few extra clicks/taps depending on how it's set up. The added overhead really is very small.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0in 0in 0in 6.0pt; margin-left:4.8pt; margin-right:0in">
<p class="MsoNormal">Perhaps requiring better (non-dictionary) passwords on accounts that don’t have MFA would be a solution more targeted at the actual problem.</p>
</blockquote>
<div>
<p class="MsoNormal"> How would ARIN judge the complexity of a password? As far as I'm aware, checking if it uses dictionary words is non-trivial. And even then, a sufficiently long passphrase using dictionary words is pretty secure (vs a short one) - I don't
think it makes sense to penalize users for that.</p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<div>
<p class="MsoNormal">On Wed, May 25, 2022 at 11:35 AM Owen DeLong via ARIN-consult <<a href="mailto:arin-consult@arin.net">arin-consult@arin.net</a>> wrote:</p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0in 0in 0in 6.0pt; margin-left:4.8pt; margin-right:0in">
<div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal"><br>
<br>
</p>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On May 25, 2022, at 08:13 , Matt Harris <<a href="mailto:matt@netfire.net" target="_blank">matt@netfire.net</a>> wrote:</p>
</div>
<p class="MsoNormal"> </p>
<div>
<div>
<div>
<div>
<div>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:15.0pt 0in 15.0pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:1.0pt"><image541905.png></span></p>
</td>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:6.0pt 0in 0in 12.0pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 1.5pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="color:#000001">Matt Harris</span><span style="font-size:1.0pt; font-family:"remialcxesans",serif; color:white"></span><span style="color:#000001"></span></p>
</td>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 4.5pt 0in 4.5pt">
<p class="MsoNormal"><span style="color:#000001">|</span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="color:#6B33C2">VP of Infrastructure</span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:1.5pt 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="color:#000001">816‑256‑5446</span></p>
</td>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 4.5pt 0in 4.5pt">
<p class="MsoNormal"><span style="color:#000001">|</span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="color:#000001">Direct</span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:#000001">Looking for help?</span></b></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:3.0pt 0in .25in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><u><span style="color:#201C6F"><a href="https://help.netfire.net/" target="_blank" title="Submit a ticket to our helpdesk!"><strong><span style="font-family:"Calibri",sans-serif; color:#201C6F; font-weight:normal">Helpdesk</span></strong></a></span></u><span style="color:#201C6F"></span></p>
</td>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 4.5pt 0in 4.5pt">
<p class="MsoNormal"><span style="color:#000001">|</span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><u><span style="color:#201C6F"><a href="mailto:help@netfire.net" target="_blank" title="Send us an email!"><strong><span style="font-family:"Calibri",sans-serif; color:#201C6F; font-weight:normal">Email Support</span></strong></a></span></u><span style="color:#201C6F"></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 12.0pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:1.0pt"><img border="0" width="46" height="24" id="_x0000_i1025" src="https://netfire.net/Flag-United-States-of-America.jpg" style="width:.4833in; height:.25in"></span><span style="font-size:1.0pt"></span></p>
</td>
<td style="padding:0in 0in 0in 0in">
<div align="center">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 0in 0in 12.0pt">
<div align="center">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="color:#000001">We build customized end‑to‑end technology solutions powered by NetFire Cloud.</span></p>
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal">On Wed, May 25, 2022 at 2:13 AM Owen DeLong via ARIN-consult <<a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a>> wrote:</p>
</div>
<div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0in 0in 0in 6.0pt; margin-left:4.8pt; margin-right:0in">
<p class="MsoNormal">I’m not in favor of requiring MFA. I agree that SMS MFA is pretty awful, but all forms of MFA come with a variety of inconveniences.<br>
<br>
With an account that goes back to the beginnings of ARIN online, I’ve never had a security problem with my ARIN online account, so I think that MFA is a solution looking for a problem here.<br>
<br>
I know that’s not a popular view among the more security conscious, but the reality is that security should be commensurate with what is being protected. Let users who think their account warrants such additional measures opt in. Let those of use who feel that
our passwords are adequate continue in that manner.<br>
<br>
Owen</p>
</blockquote>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Owen,</p>
</div>
<div>
<p class="MsoNormal">The problem is that compromised ARIN accounts can result in issues that don't just impact the owner of the account that held those resources. Compromised ARIN accounts with resources can potentially adversely impact us all in terms of upticks
in spam and the resulting management burdens, at the very least, and potentially in other (perhaps even thus far unforeseen) ways as well. </p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> </p>
</div>
<p class="MsoNormal">I disagree… If my ARIN account is compromised, I’m going to get notified of any changes made. (So far, that hasn’t happened). I know exactly where to go to get those changes reverted quickly.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">My account is associated with resources, but I remain unconvinced that inflicting MFA on me solves a real problem that actually exists.</p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
</p>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">I do agree with your statement "security should be commensurate with what is being protected." Thus, I would consider that we perhaps continue to allow accounts without control of any resources to continue without requiring MFA, only requiring
it when resources are allocated. An ARIN account with control of nothing, or perhaps just contact records for SWIP'd space, etc, is not one that is a huge hazard to the community at large imho compared to one that controls ASNs or IPv4 and IPv6 resources. </p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> </p>
</div>
<p class="MsoNormal">Perhaps requiring better (non-dictionary) passwords on accounts that don’t have MFA would be a solution more targeted at the actual problem.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Owen</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
ARIN-Consult<br>
You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>
List (<a href="mailto:ARIN-consult@arin.net" target="_blank">ARIN-consult@arin.net</a>).<br>
Unsubscribe or manage your mailing list subscription at:<br>
<a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank">https://lists.arin.net/mailman/listinfo/arin-consult</a> Please contact the ARIN Member Services<br>
Help Desk at <a href="mailto:info@arin.net" target="_blank">info@arin.net</a> if you experience any issues.</p>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>