3 ms·

> That last part is important because AWS has a huge barrier: the number of MFA devices you get is one, which means you either need insecure things like synced

> That last part is important because AWS has a huge barrier: the number of MFA devices you get is one, which means you either need insecure things like synced TOTP seeds or you have to be comfortable never losing your Yubikey. I have been asking our TAM to prioritize fixing that for years so backups can be a real thing. Actually, can we mark AWS as insecure? Seriously, it was a bother at the time it was rolled out but now I could say that Amazon is insecure. If they could not bother with this, there are definitely more security holes intentionally hidden from the general public.

acdha 4y ago
No – the problem here is really the reverse: they limit the number of devices which can gate access to your account, on the theory that you'll handle a breach by contacting them. That's theoretically more secure but slower. (Non-root MFA can be reset by another admin or root so this is most of a concern for the root account)
- vinay_ys 4y ago
  Slowing things down is the right approach when resetting/reissuing/rebinding auth devices.
  - acdha 4y ago
    When removing MFA, yes. What I'd like would be changing n=1 to n=2 so you could have a backup against a single failure.
- marcosdumay 4y ago
  > That's theoretically more secure I fail to see how that can be true. How will they validate that it is you on the phone?
  - acdha 4y ago
    If you haven't dealt with this before, it's not calling support and social-engineering someone into hitting the reset button. The last time I knew someone who had to reset an AWS root account password (broken Yubikey), it required multiple phone calls AWS initiated to the billing & technical contacts (which can only be set by root so an attacker can't easily change them) to confirm intention and then they had to sign a form in front of a notary who checked photo ID. I classed that as more secure since you can't do it remotely and the in-person portion further increases the difficulty.
    - breser 4y ago
      You do not have to even talk to AWS to remove the MFA from the root account. You simply need access to the phone number on the account (though there are ways around the phone number, see below) and the email address for the root account. It's been a little over a year since I've done it but as I recall this is how it goes. You receive an email with a link that takes you to a site that starts a verification process via the phone. You get a number from the site that you are prompted to enter when they call you on the phone. Once that's done you can log into the account with the MFA device and then even remove the MFA device entirely. The email address I believe can only be changed by AWS (and at least the last time this was an issue for me can't ever be reused for a new AWS account). The phone number can be changed by anyone with aws-portal:ModifyAccount, which probably means someone with admin access. It is NOT restricted to being modified by the root account. So if you have a working access to an account with that permission and access to the email you can change the phone number to one you have access to and go through the whole process. Meaning if you have the above permission you really only need access to the email. Link to the documentation for this flow: https://aws.amazon.com/blogs/security/reset-your-aws-root-accounts-lost-mfa-device-faster-by-using-the-aws-management-console/ https://aws.amazon.com/blogs/security/reset-your-aws-root-ac...
      - marcosdumay 4y ago
        Ok, that's not trivial to hack, but it's in no way more secure than accepting a few more backup tokens. Both email and phone numbers have widely known and exploited vulnerabilities that won't ever be fixed (worse if the phone part is only SMS). Requiring both at the same time is OKish, but not any exemplary security.

acdha 4y ago

No – the problem here is really the reverse: they limit the number of devices which can gate access to your account, on the theory that you'll handle a breach by contacting them. That's theoretically more secure but slower. (Non-root MFA can be reset by another admin or root so this is most of a concern for the root account)

vinay_ys 4y ago
Slowing things down is the right approach when resetting/reissuing/rebinding auth devices.
- acdha 4y ago
  When removing MFA, yes. What I'd like would be changing n=1 to n=2 so you could have a backup against a single failure.
marcosdumay 4y ago
> That's theoretically more secure I fail to see how that can be true. How will they validate that it is you on the phone?
- acdha 4y ago
  If you haven't dealt with this before, it's not calling support and social-engineering someone into hitting the reset button. The last time I knew someone who had to reset an AWS root account password (broken Yubikey), it required multiple phone calls AWS initiated to the billing & technical contacts (which can only be set by root so an attacker can't easily change them) to confirm intention and then they had to sign a form in front of a notary who checked photo ID. I classed that as more secure since you can't do it remotely and the in-person portion further increases the difficulty.
  - breser 4y ago
    You do not have to even talk to AWS to remove the MFA from the root account. You simply need access to the phone number on the account (though there are ways around the phone number, see below) and the email address for the root account. It's been a little over a year since I've done it but as I recall this is how it goes. You receive an email with a link that takes you to a site that starts a verification process via the phone. You get a number from the site that you are prompted to enter when they call you on the phone. Once that's done you can log into the account with the MFA device and then even remove the MFA device entirely. The email address I believe can only be changed by AWS (and at least the last time this was an issue for me can't ever be reused for a new AWS account). The phone number can be changed by anyone with aws-portal:ModifyAccount, which probably means someone with admin access. It is NOT restricted to being modified by the root account. So if you have a working access to an account with that permission and access to the email you can change the phone number to one you have access to and go through the whole process. Meaning if you have the above permission you really only need access to the email. Link to the documentation for this flow: https://aws.amazon.com/blogs/security/reset-your-aws-root-accounts-lost-mfa-device-faster-by-using-the-aws-management-console/ https://aws.amazon.com/blogs/security/reset-your-aws-root-ac...
    - marcosdumay 4y ago
      Ok, that's not trivial to hack, but it's in no way more secure than accepting a few more backup tokens. Both email and phone numbers have widely known and exploited vulnerabilities that won't ever be fixed (worse if the phone part is only SMS). Requiring both at the same time is OKish, but not any exemplary security.