3 ms·

Can you have more than one YubiKey associated with an AWS account? Or also setup TOTP, or have a set of backup codes in case you lost your hardware device? Seem

by barryp 8y ago

Can you have more than one YubiKey associated with an AWS account? Or also setup TOTP, or have a set of backup codes in case you lost your hardware device? Seems kind of dangerous if you can only have one MFA method setup

robbiet480 8y ago
No. But you also couldn't have a TOTP + Hardware token previously to U2F introduction [1]. AWS has also never had backup codes to my knowledge, other than saving the secret key used to generate TOTP codes. The "backup" has always been maintaining access to the root account to allow that to reset 2FA as needed. 1: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_u2f.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti... ("You can enable one MFA device (of any kind) per root user or IAM user.")
- chiefalchemist 8y ago
  That can't last (i.e., not more than one). The main reason being you can lose a key, forget it, have it stolen, break it, etc. Without a second you'll be living on the edge. They're gonna have to support more than one. I have a Yubikey for my LastPass. I lived with a single key for over a year. I finally got two more. I'm not sure why I made myself so nervous / stressed those 12+ months.
  - robbiet480 8y ago
    I can't be sure without reading the docs, and I don't care to at the moment TBQH, but it may be possible to remove MFA via API keys for the account.
pentestercrab 8y ago
The Trezor [1] hardware device supports backing up (at initialization) and restoring of the secret seed which is quite useful. It can also be used as a password manager [2]. [1] https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2f-e940fd5a60af https://blog.trezor.io/secure-two-factor-authentication-with... [2] https://trezor.io/passwords/ https://trezor.io/passwords/

3 ms·

Can you have more than one YubiKey associated with an AWS account? Or also setup TOTP, or have a set of backup codes in case you lost your hardware device? Seem

by barryp 8y ago

robbiet480 8y ago
No. But you also couldn't have a TOTP + Hardware token previously to U2F introduction [1]. AWS has also never had backup codes to my knowledge, other than saving the secret key used to generate TOTP codes. The "backup" has always been maintaining access to the root account to allow that to reset 2FA as needed. 1: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_u2f.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti... ("You can enable one MFA device (of any kind) per root user or IAM user.")
- chiefalchemist 8y ago
  That can't last (i.e., not more than one). The main reason being you can lose a key, forget it, have it stolen, break it, etc. Without a second you'll be living on the edge. They're gonna have to support more than one. I have a Yubikey for my LastPass. I lived with a single key for over a year. I finally got two more. I'm not sure why I made myself so nervous / stressed those 12+ months.
  - robbiet480 8y ago
    I can't be sure without reading the docs, and I don't care to at the moment TBQH, but it may be possible to remove MFA via API keys for the account.
pentestercrab 8y ago
The Trezor [1] hardware device supports backing up (at initialization) and restoring of the secret seed which is quite useful. It can also be used as a password manager [2]. [1] https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2f-e940fd5a60af https://blog.trezor.io/secure-two-factor-authentication-with... [2] https://trezor.io/passwords/ https://trezor.io/passwords/