<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
Given that I'd never seen that page before, and I thought I'd read every page on the ARIN website at least once, I repeat my earlier assertion that an education campaign will be necessary if 2FA becomes mandatory.</div>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
<br>
</div>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
I'm also concerned about language on that page that says the Recovery Code is the *only* way to regain access to the account. That is unacceptable in at least a couple of trivial scenarios (fired, died, fire, disaster, corrupted TOTP software, etc.).</div>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
<br>
</div>
<div style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);" dir="auto">
-Adam</div>
<div dir="auto" style="" id="ms-outlook-mobile-signature">
<div><br>
</div>
Get <a href="https://aka.ms/AAb9ysg">Outlook for Android</a></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> ARIN-consult <arin-consult-bounces@arin.net> on behalf of John Curran <jcurran@arin.net><br>
<b>Sent:</b> Wednesday, May 25, 2022 10:44:39 AM<br>
<b>To:</b> Scott Leibrand <scottleibrand@gmail.com><br>
<b>Cc:</b> ARIN-consult <arin-consult@arin.net><br>
<b>Subject:</b> Re: [ARIN-consult] increasing 2FA take-up</font>
<div> </div>
</div>
<div class="" style="word-wrap:break-word; line-break:after-white-space"><br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 25 May 2022, at 11:40 AM, Scott Leibrand <<a href="mailto:scottleibrand@gmail.com" class="">scottleibrand@gmail.com</a>> wrote:</div>
<br class="x_Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="">Putting TOTP in 1Password makes login far more convenient than SMS 2FA, and almost as convenient as password-only, even for shared accounts.</div>
<div class=""><br class="">
</div>
ARIN should probably provide instructions for how to add your TOTP to 1Password (and any other password managers that support that workflow), because it's not a very intuitive enrollment experience.</div>
</div>
</blockquote>
<div><br class="">
</div>
Scott - </div>
<div><br class="">
</div>
<div>Instructions for adding 2FA via TOTP are available here (this is what all of the ARIN 2FA documentation points to) – <a href="https://www.arin.net/reference/materials/security/twofactor/" class="">https://www.arin.net/reference/materials/security/twofactor/</a></div>
<div><br class="">
</div>
<div>Do you have any suggestions for improvement?</div>
<div><br class="">
</div>
<div>Thanks!</div>
<div>/John</div>
<div><br class="">
</div>
<div>
<div>John Curran</div>
<div>President and CEO</div>
<div>American Registry for Internet Numbers</div>
</div>
<div><br class="">
</div>
<div><br class="">
</div>
<div><br class="">
</div>
</div>
</body>
</html>