<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Helvetica Neue";
panose-1:2 0 5 3 0 0 0 2 0 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Heather Schiller <has@google.com><br>
<b>Date: </b>Tuesday, January 24, 2023 at 3:06 PM<br>
<b>To: </b>Ross Tajvar <ross@tajvar.io><br>
<b>Cc: </b>Adam Thompson <athompso@athompso.net>, John Sweeting <jsweeting@arin.net>, "arin-consult@arin.net" <arin-consult@arin.net><br>
<b>Subject: </b>Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">My inquiry about the number of human pocs, was to better understand the volume of risk due to a single user needing to recover their access in some way. 80% is not reassuring. eek.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Ok that is not what was provided, what was provided is the number of user accounts linked to a single POC and not a role POC. Let me get the information that you are actually asking for.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--h<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jan 24, 2023 at 3:00 PM Ross Tajvar <<a href="mailto:ross@tajvar.io">ross@tajvar.io</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Each account does its own 2FA. You don't need multiple hardware tokens on the same account unless you're sharing that account, which is unnecessary, because you can associate multiple accounts with one POC. I don't think limiting the number
of tokens will cause an issue for orgs with multiple human POCs. <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Maybe I'm misunderstanding your concern?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jan 24, 2023 at 2:58 PM Adam Thompson <<a href="mailto:athompso@athompso.net" target="_blank">athompso@athompso.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-CA">I *<b>don’t</b>* think we can nonchalantly apply the Pareto principle to authentication: how are those ~20% of accounts going to do 2FA with ARIN next month?
The only way I can see is to register multiple TOTP authenticators. Have I missed something?<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-CA">-Adam<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-CA"> <o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> ARIN-consult <<a href="mailto:arin-consult-bounces@arin.net" target="_blank">arin-consult-bounces@arin.net</a>>
<b>On Behalf Of </b>John Sweeting<br>
<b>Sent:</b> Tuesday, January 24, 2023 1:56 PM<br>
<b>To:</b> Heather Schiller <<a href="mailto:has@google.com" target="_blank">has@google.com</a>>; ARIN <<a href="mailto:info@arin.net" target="_blank">info@arin.net</a>><br>
<b>Cc:</b> <a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a><br>
<b>Subject:</b> Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online<span lang="EN-CA"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-CA"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks for your input Heather.
<span lang="EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Tangentially related, what percentage of accounts do you think have a single human poc?<span lang="EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Approximately 80% appear to have a single human poc<span lang="EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">ARIN-consult <<a href="mailto:arin-consult-bounces@arin.net" target="_blank">arin-consult-bounces@arin.net</a>> on behalf of Heather Schiller via ARIN-consult <<a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a>><br>
<b>Reply-To: </b>Heather Schiller <<a href="mailto:has@google.com" target="_blank">has@google.com</a>><br>
<b>Date: </b>Tuesday, January 24, 2023 at 2:16 PM<br>
<b>To: </b>ARIN <<a href="mailto:info@arin.net" target="_blank">info@arin.net</a>><br>
<b>Cc: </b>"<a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a>" <<a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a>><br>
<b>Subject: </b>Re: [ARIN-consult] Consultation on Expanding 2FA Options for ARIN Online</span><span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Can we add, authorization should expire in <24hrs? Per markk@ it expires in a week, which means anyone that gains access to that browser session will be able to effect changes.
Given that we've added more, not less, critical infrastructure impacting functionality to ARIN online, the security requirements should be stricter.
<span lang="EN-CA"><o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Historically, NIST explicitly recommended AGAINST using SMS as 2FA, going all the way back to 2016. <span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> "<i><span style="font-size:10.5pt;font-family:"Helvetica Neue";color:#454441">Due to the risk that SMS messages or voice calls may be intercepted or redirected, implementers of
new systems SHOULD carefully consider alternative authenticators. If the out-of-band verification is to be made using the public switched telephone network (PSTN), the verifier SHALL verify that the pre-registered telephone number being used is not associated
with a VoIP (or other software-based) service. It then sends the SMS or voice message to the pre-registered telephone number. Changing the pre-registered telephone number SHALL NOT be possible without two-factor authentication at the time of the change." </span></i><span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">SMS based 2FA hasn't really gotten any better over the years. I would not be in support of expanding the functionality of SMS 2FA. Similarly, I would not support the use of email
as 2FA either. <span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Tangentially related, what percentage of accounts do you think have a single human poc?<span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> --Heather<span lang="EN-CA"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span lang="EN-CA"><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Tue, Jan 24, 2023 at 1:54 PM ARIN <<a href="mailto:info@arin.net" target="_blank">info@arin.net</a>> wrote:<span lang="EN-CA"><o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On 1 November 2022, ARIN announced that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023. ARIN currently has three options
for customers to set up 2FA on their ARIN Online accounts:<br>
<br>
- Time-based One-time Password (TOTP) using an authenticator of your choice<br>
- Short Message Service (SMS) for customers within the ARIN service region<br>
- FIDO2/Passkey-enabled Security Key<br>
<br>
Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts.<br>
<br>
Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including:<br>
<br>
- Allowing email as an authentication method<br>
- Enabling SMS support for customers who reside outside of the ARIN service region<br>
- Allowing registration of multiple hardware security keys.<br>
<br>
We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically:<br>
<br>
1. Would you support ARIN offering email as an additional 2FA method?<br>
<br>
2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users?<br>
<br>
3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered?<br>
<br>
The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process.<br>
<br>
Please provide comments to <a href="mailto:arin-consult@arin.net" target="_blank">
arin-consult@arin.net</a>. You can subscribe to this mailing list at: <a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank">
https://lists.arin.net/mailman/listinfo/arin-consult</a><br>
<br>
This consultation will remain open through 5:00 PM ET on 7 February 2023.<br>
<br>
Regards,<br>
<br>
John Curran<br>
President and CEO<br>
American Registry for Internet Numbers (ARIN)<br>
<br>
Helpful Resources:<br>
<br>
Consultation: <a href="https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/Two-Factor" target="_blank">
https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/<br>
Two-Factor</a> Authentication at ARIN: <a href="https://arin.net/2FA" target="_blank">
https://arin.net/2FA</a><br>
<br>
<br>
_______________________________________________<br>
ARIN-Consult<br>
You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>
List (<a href="mailto:ARIN-consult@arin.net" target="_blank">ARIN-consult@arin.net</a>).<br>
Unsubscribe or manage your mailing list subscription at:<br>
<a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank">https://lists.arin.net/mailman/listinfo/arin-consult</a> Please contact the ARIN Member Services<br>
Help Desk at <a href="mailto:info@arin.net" target="_blank">info@arin.net</a> if you experience any issues.<span lang="EN-CA"><o:p></o:p></span></p>
</blockquote>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
ARIN-Consult<br>
You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>
List (<a href="mailto:ARIN-consult@arin.net" target="_blank">ARIN-consult@arin.net</a>).<br>
Unsubscribe or manage your mailing list subscription at:<br>
<a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank">https://lists.arin.net/mailman/listinfo/arin-consult</a> Please contact the ARIN Member Services<br>
Help Desk at <a href="mailto:info@arin.net" target="_blank">info@arin.net</a> if you experience any issues.<o:p></o:p></p>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
</body>
</html>