<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br><div><br><blockquote type="cite"><div>On Jan 24, 2023, at 12:36 PM, Adam Thompson <athompso@athompso.net> wrote:</div><br class="Apple-interchange-newline"><div>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<div>
<div dir="auto"><br></div>
<div dir="auto" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
Which is more important: keeping bad actors out, or letting authorized users in?</div>
<div dir="auto" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<br>
</div>
<div dir="auto" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
All I'm hearing during this discussion is protecting accounts against hypothetical compromise (with IIRC no evidence this has ever happened, or any negative outcome has occurred previously) with no consideration of people who have unusual needs.</div>
<div dir="auto" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<br>
</div>
<div dir="auto" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
(Some of those needs, definitely not all, are referred to in American law as "disabilities", btw. I hope someone at ARIN has thought about how the proposed 2FA scheme complies with the ADA?)</div>
<div dir="auto" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<br>
</div>
<div dir="auto" style="color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
-Adam </div>
<div><br>
</div>
</div></div></blockquote><br></div><div>Hence my recommendation that if a limit is set, it should not be a hard limit, and allow for the limit to be raised upon request (presumably after a manual authentication of the request by ARIN staff). </div><div><br></div><div>-C</div><br></body></html>