8 ms·
While this is a great step forward for U2F adoption, AWS made the same mistake several other online services have made by only allowing a single key per account
by pg_bot 8y ago
While this is a great step forward for U2F adoption, AWS made the same mistake several other online services have made by only allowing a single key per account. The typical U2F user carries at least two keys. (one on their person and one stored securely for backup) I hope they decide to change this because it will cause a ton of customer support problems in their future.
- cmurf 8y agoWhen I had 2FA enabled, using Google Authenticator, and had to reset my phone, I was locked out of AWS. No backup codes. No texting. Nothing. Had to send in a ticket and get a callback.
- bdcravens 8y agoFWIW, Authy does let you store and recover TOTP accounts via password.
- lrvick 8y agoAnd this is also what makes Authy a terrible 2FA tool no one should use ever. It stores your secrets in plain text on the phone without any secure enclave. If your backup password is sniffed or there is a flaw in Authy or your mobile OS sandboxing fails you are toast.
- bluesign 8y agoIf your mobile os sandboxing fails, you are toast in any scenario. I think every authenticator app is toast as long as mobile sandbox is comprised.
- foobarbazetc 8y ago1Password can store/generate TOTP codes.
- movedx 8y agoAnd copy them to the clipboard automatically when it detects you'll need it. I'm slowly moving my TOTPs codes over.
- e28eta 8y agoStoring password + TOTP together does leave you vulnerable if your vault is stolen/broken into, but I've gone all-in on storing them in 1Password because that's a trade off I'm willing to make.
- bmurphy1976 8y agoNot me. I had the TOTP factors in my password manager for a while, and boy was it nice, but eventually I decided that was a risk I wasn't willing to take. I feel safer knowing that they have to beak into at least two different apps. I use Authy to manage my 2FA codes, but I rarely ever use the desktop app. I stick to my phone to keep a physical separation between my logins and my 2FA app. I also started storing my backup codes as a base64 encoded gpg password encrypted text file in my password manager. If I ever lose my 2FA codes I can still get into my accounts in a emergency while also protecting myself from a password manager hack. It's annoying, but as I said, I'm not willing to take the risk.
- movedx 8y ago> It's annoying, but as I said, I'm not willing to take the risk. Convenience is the enemy of security. I think you're making a good choice though. It's a minor inconvenience for increased security and peace of mind.
- EduardoBautista 8y agoI used to do this. Then I realized I stored the backup codes in 1Password anyways which are as good as using a TOTP. So instead of investing in another safe place to store the backup codes I decided just to go all in with TOTP in 1Password. If my 1Password vault is breached, I am pretty much in a world of trouble as it is.
- chrsstrm 8y agoAre you sure about that? My AWS 2FA authenticator code has been out of sync for a while and they offer multiple options to get around it. I've been receiving SMS codes easily, in fact I just did this a couple days ago. IIRC they also offered to call me. Did you flip some bit somewhere to disallow this? Do you have a phone number set up?
- cmurf 8y agoYep, it was a couple years ago. They ask questions, then disabled 2FA so I could just get in with a password, and re-enable 2FA. No options around it. So possibly they've improved the process since then.
- Zombieball 8y agoCan confirm it’s still similar. Went through the same process 2 months ago.
- juriansluiman 8y agoUse the Yubico Authenticator app. The main difference is the (secured) storaged of the shared secret. With Google Authenticator, your keys are stored on the phone. With Yubico's authenticator, you store the secrets ontp your Yubikey. This means you can reset your phone and still be able to use the same TOTP shared secrets. Or if that matters, ask a friend to install the app and use your Yubikeys to get the TOTP.
- TheDong 8y agofwiw, one way to do this with aws is to create two IAM users in the same groups and have a yubikey associated with each one. You now have a backup login, it just has a different username too.
- Johnny555 8y agoThe typical U2F user carries at least two keys Maybe techie personal users have more than one, but I only carry one device (a yubikey) for work, someone at work can reset my MFA if I lose it. I'd be surprised if "most" people have a backup device/codes.
- mattnewton 8y agoBut that person does have to if you have another key, you can. Fix the situation yourself. It’s also helpful when you use a key that lives in a machine to not have to remove it. If you lose the machine, use another key to sign in and disavow the lost key.
- Johnny555 8y agoMy company's security policy doesn't allow us to have more than one key. If I have one key and someone takes it, I know it immediately. If I have 2 keys and someone steals my spare, then I might not realize it for quite some time.
- iends 8y agoYes, but other people at your company have keys and they can reset your key. In many situations when you're using keys yourself, there is not trusted person that can verify your identity in person and reset your key.
- Buge 8y agoMaybe this AWS feature is designed for companies, not individual users.
- deleted 8y ago[deleted]
- baq 8y agodoes your company also disallow having backup keys to your office or company cars? you're supposed to have multiple keys so you're not effed if you lose one.
- mjibson 8y agoYes. I won't use U2F on services that don't allow multiple keys because of this. I have two keys in different places so it's easy to use.
- xur17 8y agoHow do you handle adding both keys if you store them in different locations? Right now I do something similar, but I have to keep a list of which accounts I need to add to key 2, and the key is offsite, so I have a several week period during which an account only has one key associated with it.
- mjibson 8y agoI have one key permanently plugged in to my desktop at home. I have another on my keychain that I can use at work or if I'm travelling or whatever. This allows quick access to a yubikey anywhere I am. My previous problem (when I owned only 1) was that my keys were always in another room when I was home, and getting up to get them was too annoying when logging in to things. Now I have a backup if either is lost and I'm more-or-less guaranteed to have a yubikey within reach anytime it's needed.
- guitarbill 8y agoyou don't necessarily need two security keys. written down backup codes or an authenticator app are also good second factors.
- borplk 8y agoIf you can just fall back to authenticator app by saying "oops don't have yubikey now" then you get no extra security for using a yubikey.
- tialaramex 8y agoYou may consider that the authenticator offers enough security but a Security Key is more convenient. I hate typing 6-digit codes into things, touching the little contact or pressing the button on my Security Keys is much more tolerable. Now, personally I wouldn't want the phishable Authenticator as fallback, but it's definitely better than SMS for example.
- sneak 8y agoWorkaround: a separate IAM user for each machine you leave your Yubikey Nano inserted into.
- em0ney 8y agoAWS often releases features very early, to satisfy the first tranches of early adopters before rounding out the feature with feedback from these passionate users. AWS EKS is a good example for anyone who has had a play already.
- verletx64 8y agoWhat's the latest with EKS? What's missing still?
- foxylion 8y agoNearly everything. Old k8s version. No upgrade possible. Odd deployment process (not fully automated). Support is unable to help in a timely manner. First deployed cluster was directly broken (no DNS resolution). We eyed on switching from kops to EKS. But immediately stepped down after experiencing so many issues.
- deleted 8y ago[deleted]
- sigi45 8y agoThere are a few others who only allow one key.... Why?!?! :( LastPass for example
- bskap 8y agoLastPass doesn't support U2F at all. They only support the Yubikeys in the less-secure one-time-password mode.
- lrvick 8y agoLastpass 2FA is just used for account management and sync anyway. It has no role in the secret crypto. If your attacker phishes the master password your synced passwords are all compromised.
- bskap 8y agoWouldn't they also need access to a device that already synced your passwords? That essentially switches your computer to be the second factor, albeit one that's more easily compromised with malware. And if they already have malware on your computer, you're probably hosed anyway since the passwords have to be decrypted at some point. If all they managed to do was trick me into entering my master password on a dummy login page, the sort of phish that U2F is designed to protect against, U2F would still keep me protected while OTP wouldn't.
- chaz6 8y agoYikes! This is a non-starter for me. I have 4 keys (3 stored in safe places - yes this is inconvenient when setting up a new account, but this is the trade-off for security). What a strange decision.
- type0 8y agoIs there some workaround for this? Could I create a second and third accounts(that share their resources) to add other u2f keys?