5 ms·
The yubikeys are designed to be non-clonable, so it is two factors: something you have and something you are. Not all factors are created equal, and in the past
by loosescrews 5y ago
The yubikeys are designed to be non-clonable, so it is two factors: something you have and something you are. Not all factors are created equal, and in the past there have been issues with biometrics not really being a reliable indicator of something you are.
- eh4545b4 5y agoWhat do you do if the hardware fails, or gets melted in a fire?
- xxpor 5y agoYou keep a spare somewhere. Everything that does U2F IME allows you to register at least 2 tokens.
- bsder 5y agoExcept AWS, no?
- ecnahc515 5y agoCorrect, but for AWS, you can use SSO and delegate the MFA to your SSO provider.
- Spivak 5y agoIn AWS you must delegate your MFA to the SSO provider. Having an SSO provider but AWS managed MFA isn’t even possible because SSO users map to roles instead of IAM users.
- arianvanp 5y agoIt actually is. AWS SSO itself (so not on the IAM users level) supports user management too without an external SSO provider and actually _does_ allow multiple MFA devices unlike IAM. It's a giant hack but works!
- staticassertion 5y agoYep, super annoying, AWS doesn't allow you to register more than one MFA device.
- bilalq 5y agoBank of America doesn't.
- jiveturkey 5y agoIt's actually the opposite. Most U2F services allow at most 1 registration.
- tialaramex 5y ago> Most U2F services allow at most 1 registration. We debunk this often several times per week on HN Yes, AWS doesn't allow you to enroll more than one FIDO authenticator. No, AWS isn't "most" services, in the same way that Jeff Bezos isn't "most" people. When you mean "AWS" just say "AWS" not "Most services". I have multiple Security Keys enrolled with, among others, Dropbox, Facebook, Google, and GitHub.