Re:Multi-factor authentication isn't necessarily strong
by tzs on Friday December 27, 2019 @01:25PM
(#21893136)
> The nice thing about U2F is that many providers support having multiple U2F tokens. For example Google, Github, and Gitlab do. Though others do not, for example AWS (last time I checked).
Note that in the case of AWS it is not as bad as it seems, if you use your AWS account they way Amazon recommends. When you initially create your account, the credentials you make (email and password) have full privileges on the account. This is called the "root" user.
The root user can create other users on the account, and delegate to them most of the privileges of root (but not all). Amazon recommends that you make one or more admin user accounts to wield all the privileges that can be delegated, and then no longer use the root account except for those few tasks that can only be done with root.
Use the admin user(s) to create regular user accounts for everything else.
If you have N U2F tokens, make N admin users and associate each with a different token. Associate each regular user account with one of the tokens you carry on your key chain.
If you lose a token, use one of the remaining tokens with the admin account it is associated with to reset the accounts that were using the lost token and then associate them with one of the remaining tokens.
If you use U2F with the root account and lose its token you can do a reset of your 2FA setup via email and phone. You should only rarely need to use the root account, so its token should probably be one of the ones you keep in some safe spot like in your fireproof safe, not one you carry around on your key chain.
Note that in the case of AWS it is not as bad as it seems, if you use your AWS account they way Amazon recommends. When you initially create your account, the credentials you make (email and password) have full privileges on the account. This is called the "root" user.
The root user can create other users on the account, and delegate to them most of the privileges of root (but not all). Amazon recommends that you make one or more admin user accounts to wield all the privileges that can be delegated, and then no longer use the root account except for those few tasks that can only be done with root.
Use the admin user(s) to create regular user accounts for everything else.
If you have N U2F tokens, make N admin users and associate each with a different token. Associate each regular user account with one of the tokens you carry on your key chain.
If you lose a token, use one of the remaining tokens with the admin account it is associated with to reset the accounts that were using the lost token and then associate them with one of the remaining tokens.
If you use U2F with the root account and lose its token you can do a reset of your 2FA setup via email and phone. You should only rarely need to use the root account, so its token should probably be one of the ones you keep in some safe spot like in your fireproof safe, not one you carry around on your key chain.