<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Would requiring TOTP/FIDO (and not allowing SMS) be more palatable if ARIN were able/willing to furnish yubikeys (or alternate authenticators) to users free of charge? I don’t know what these cost in bulk nowadays, but it’s probably right on the edge of reasonable for this use case.<div><br></div><div>Thanks,</div><div><br></div><div>-Chris<br><div><br><div><blockquote type="cite"><div>On Jan 24, 2023, at 1:31 PM, David Farmer via ARIN-consult <arin-consult@arin.net> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 24, 2023 at 12:53 PM ARIN <<a href="mailto:info@arin.net" target="_blank">info@arin.net</a>> wrote:</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
1. Would you support ARIN offering email as an additional 2FA method?<br></blockquote><div>As mentioned, email is used for password changes; also, allowing it for 2FA is a bad idea.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs of these users?<br></blockquote><div>As SMS has several weaknesses, I prefer SMS was not allowed at all. Nevertheless, if SMS is allowed, I don't see the point in restricting it to the ARIN service region. Furthermore, it could be more important for those outside the ARIN service region in case of technology restrictions or embargos on the more secure FIDO or TOTP technologies.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered?<br></blockquote><div>10 is a reasonable limit. </div><div><br></div></div>-- <br><div dir="ltr">===============================================<br>David Farmer <a href="mailto:Email%3Afarmer@umn.edu" target="_blank">Email:farmer@umn.edu</a><br>Networking & Telecommunication Services<br>Office of Information Technology<br>University of Minnesota <br>2218 University Ave SE Phone: 612-626-0815<br>Minneapolis, MN 55414-3029 Cell: 612-812-9952<br>=============================================== </div></div>
_______________________________________________<br>ARIN-Consult<br>You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>List (ARIN-consult@arin.net).<br>Unsubscribe or manage your mailing list subscription at:<br>https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services<br>Help Desk at info@arin.net if you experience any issues.<br></div></blockquote></div><br></div></div></body></html>