<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
I don't recommend expanding the use of SMS for 2FA as it poses a significant security risk. SMS messages can be intercepted or redirected by attackers, potentially giving them access to a user's account. Therefore, I propose removing SMS as a factor altogether
and focusing on more secure options such as Time-based One-time Password (TOTP) using an authenticator of your choice or FIDO2/Passkey-enabled Security Key.
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">E-mail as an additional 2FA method is also not ideal as email accounts can be compromised if not properly secured, but it is still a somewhat better option than SMS.
<br>
</div>
<div><br class="ContentPasted0">
</div>
In terms of allowing the registration of multiple hardware security keys, I suggest allowing a maximum of 3 keys to be registered. This provides backup options in case a user loses or misplaces their primary key but encourages users to be cognizant of deleting
old keys that have been lots or become non-functional.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
Regards,<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
Tim<br>
</div>
<br>
<div id="appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> ARIN-announce <arin-announce-bounces@arin.net> on behalf of ARIN <info@arin.net><br>
<b>Sent:</b> Tuesday, January 24, 2023 13:52<br>
<b>To:</b> arin-announce@arin.net <arin-announce@arin.net><br>
<b>Subject:</b> [arin-announce] Consultation on Expanding 2FA Options for ARIN Online</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText elementToProof">Caution: EXTERNAL EMAIL<br>
<br>
<br>
Caution: This is an external email and has a suspicious subject or content. Please take care when clicking links or opening attachments. When in doubt, DON'T CLICK!<br>
<br>
<br>
On 1 November 2022, ARIN announced that we will require two-factor authentication (2FA) on all ARIN Online accounts beginning 1 February 2023. ARIN currently has three options for customers to set up 2FA on their ARIN Online accounts:<br>
<br>
- Time-based One-time Password (TOTP) using an authenticator of your choice<br>
- Short Message Service (SMS) for customers within the ARIN service region<br>
- FIDO2/Passkey-enabled Security Key<br>
<br>
Please note: Voice 2FA is not currently available for new 2FA activations; it is still available to those customers who already have that method set up on their accounts.<br>
<br>
Following the announcement of the planned enforcement date of 1 February 2023, we received several suggestions for further expansion of our authentication offerings, including:<br>
<br>
- Allowing email as an authentication method<br>
- Enabling SMS support for customers who reside outside of the ARIN service region<br>
- Allowing registration of multiple hardware security keys.<br>
<br>
We are seeking community feedback on these suggestions as well as additional input on our 2FA options. Specifically:<br>
<br>
1. Would you support ARIN offering email as an additional 2FA method?<br>
<br>
2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users?<br>
<br>
3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered?<br>
<br>
The feedback you provide during this consultation will help us decide the path forward regarding our 2FA options for ARIN Online. Thank you for your participation in the ARIN Consultation and Suggestion Process.<br>
<br>
Please provide comments to arin-consult@arin.net. You can subscribe to this mailing list at:
<a href="https://lists.arin.net/mailman/listinfo/arin-consult" data-auth="NotApplicable">
https://lists.arin.net/mailman/listinfo/arin-consult</a><br>
<br>
This consultation will remain open through 5:00 PM ET on 7 February 2023.<br>
<br>
Regards,<br>
<br>
John Curran<br>
President and CEO<br>
American Registry for Internet Numbers (ARIN)<br>
<br>
Helpful Resources:<br>
<br>
Consultation: <a href="https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/" data-auth="NotApplicable">
https://www.arin.net/participate/community/acsp/consultations/2023/2023-1/</a><br>
Two-Factor Authentication at ARIN: <a href="https://arin.net/2FA" data-auth="NotApplicable">
https://arin.net/2FA</a><br>
<br>
<br>
_______________________________________________<br>
ARIN-Announce<br>
You are receiving this message because you are subscribed to<br>
the ARIN Announce Mailing List (ARIN-announce@arin.net).<br>
Unsubscribe or manage your mailing list subscription at:<br>
<a href="https://lists.arin.net/mailman/listinfo/arin-announce" data-auth="NotApplicable">https://lists.arin.net/mailman/listinfo/arin-announce</a><br>
Please contact info@arin.net if you experience any issues.<br>
</div>
</span></font></div>
</body>
</html>