3 ms·
AWS at least lets you sign in using alternative methods if you get locked out: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broke
by burntsushi 7y ago
AWS at least lets you sign in using alternative methods if you get locked out: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...
- stingraycharles 7y agoWhich in itself is a problem: it means the MFA device is not required, if only they have access to my email + phone.
- burntsushi 7y agoSure, I know. Just pointing out that, at least for AWS, you do not need recovery codes or a second device for MFA. For me personally, phone+email is good enough for my threat model.
- mschout 7y agoYes, AWS MFA is very poorly implemented.