<div dir="ltr">On the topic of hypothetical compromise - my ARIN account hasn't been compromised, but other accounts protected with SMS 2FA have been. I have had money stolen via that vector. So it's a real concern for me. Maybe <i>my</i> ARIN account isn't valuable enough to hack, but my employer's is.<div><br></div><div>I don't think we should disregard real attack vectors that definitely do happen in the real world just because they're uncommon and the mitigations are inconvenient to some people. I also acknowledge the importance of disability accommodation; however, I doubt that disallowing email (or SMS) 2FA would be an issue there (though I welcome a correction if I'm wrong).</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 24, 2023 at 3:36 PM Adam Thompson <<a href="mailto:athompso@athompso.net">athompso@athompso.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div dir="auto">Since I have a nearly magical ability to damage every authentication device I've ever been issued (including my phone - this one has lasted over a year, which I think is av record), I'm highly doubtful of any scheme that *assumes* any authenticator
is durable. I would like a *minimum* of 3 active - one in my pocket, one in a locked drawer at work, one in a secure spot at home or in my car or somewhere else.</div>
<div dir="auto"><br>
</div>
<div dir="auto">Double + 1 that number to account for rollover, and I'll already want to have up to 7 registered at times, for any account that's super-critical.</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
<br>
</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
Yes, that's about how many copies of physical keys for locks that I like to get made, because I lose those, too.</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
<br>
</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
Could I live with a limit of 10? Yeah, probably.</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
<br>
</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
Which is more important: keeping bad actors out, or letting authorized users in?</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
<br>
</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
All I'm hearing during this discussion is protecting accounts against hypothetical compromise (with IIRC no evidence this has ever happened, or any negative outcome has occurred previously) with no consideration of people who have unusual needs.</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
<br>
</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
(Some of those needs, definitely not all, are referred to in American law as "disabilities", btw. I hope someone at ARIN has thought about how the proposed 2FA scheme complies with the ADA?)</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
<br>
</div>
<div dir="auto" style="color:rgb(33,33,33);background-color:rgb(255,255,255)">
-Adam </div>
<div><br>
</div>
<div id="m_-2918915987570826000ms-outlook-mobile-signature" dir="auto">Get <a href="https://aka.ms/AAb9ysg" target="_blank">
Outlook for Android</a></div>
<hr style="display:inline-block;width:98%">
<div id="m_-2918915987570826000divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> ARIN-consult <<a href="mailto:arin-consult-bounces@arin.net" target="_blank">arin-consult-bounces@arin.net</a>> on behalf of Richard Laager <<a href="mailto:rlaager@wiktel.com" target="_blank">rlaager@wiktel.com</a>><br>
<b>Sent:</b> Tuesday, January 24, 2023 2:22:43 PM<br>
<b>To:</b> <a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a> <<a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a>><br>
<b>Subject:</b> Re: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online</font>
<div> </div>
</div>
<div>
<div>
<div>On 1/24/23 12:56, Adam Thompson wrote:<br>
</div>
<blockquote type="cite">
<pre>Why on earth would you set a hard-coded limit? It's not like an additional database table is expensive.</pre>
</blockquote>
</div>
<div>While, in general, I understand this sentiment (real world cardinality is usually: 1, 2, or many), I do see two counterpoints. Even speaking in general, it is sometimes useful to define a limit for testing purposes. If you say,
"We support 5", then you are hopefully actually testing 5.</div>
<div><br>
</div>
<div>In this particular situation, I think the following argument is even more relevant:<br>
</div>
<div><br>
</div>
<div>On 1/24/23 14:02, Tim Lyons via ARIN-consult wrote:<br>
</div>
<blockquote type="cite">In terms of allowing the registration of multiple hardware security keys, I suggest allowing a maximum of 3 keys to be registered. This provides backup options in case a user loses or misplaces their primary key but encourages users
to be cognizant of deleting old keys that have been lots or become non-functional.</blockquote>
<pre cols="72">--
Richard</pre>
</div>
</div>
_______________________________________________<br>
ARIN-Consult<br>
You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>
List (<a href="mailto:ARIN-consult@arin.net" target="_blank">ARIN-consult@arin.net</a>).<br>
Unsubscribe or manage your mailing list subscription at:<br>
<a href="https://lists.arin.net/mailman/listinfo/arin-consult" rel="noreferrer" target="_blank">https://lists.arin.net/mailman/listinfo/arin-consult</a> Please contact the ARIN Member Services<br>
Help Desk at <a href="mailto:info@arin.net" target="_blank">info@arin.net</a> if you experience any issues.<br>
</blockquote></div>