5 ms·
FWIW this is why it's a good idea to have two MFA mechanisms. If you can afford it I recommend getting 2 hardware tokens, and storing them separately (you can l
by staticassertion 6y ago
FWIW this is why it's a good idea to have two MFA mechanisms. If you can afford it I recommend getting 2 hardware tokens, and storing them separately (you can leave one in your computer, hard to lose).
- x0x0 6y agoThat's a great plan, but AWS notably doesn't support multiple hardware u2f devices. They've been sitting on the ask for about 7 years https://forums.aws.amazon.com/thread.jspa?threadID=137055 https://forums.aws.amazon.com/thread.jspa?threadID=137055
- staticassertion 6y agoDamn, that sucks. I use GSuite to SSO to AWS though.
- mrguyorama 6y agoCan you not manually set the two tokens to the same "seed"?
- chipsa 6y agoThat works for TOTP 2FA on your phone. But most hardware tokens have an internal seed that's immutable.
- mimimi31 6y agoIsn't that just the enterprise ones? I've been using personal hardware TOTP tokens[1][2] like this for years, where you can set the seed yourself using NFC. [1] https://www.token2.com/shop/category/programmable-tokens https://www.token2.com/shop/category/programmable-tokens [2] https://www.protectimus.com/protectimus-slim-mini https://www.protectimus.com/protectimus-slim-mini
- antoinealb 6y agoI think they meant hardware in the sense of U2F tokens like Yubikeys, not TOTP based ones.
- x0x0 6y agoThe problem with totp is it's really just a second password. It eg doesn't protect you from phishing in the way that a yubikey does.
- dathinab 6y agoDon't they have 2FA recovery codes? This had become somewhat of the standard for 2FA in recent years.