3 ms·
Sadly there’s another system that really should know better with terrible 2FA policies: Amazon AWS. The mechanism for protecting an AWS root account is not qui
by amluto 4y ago
Sadly there’s another system that really should know better with terrible 2FA policies: Amazon AWS. The mechanism for protecting an AWS root account is not quite as bad as PayPal, but it’s not much better.
AWS should offer the ability to enroll multiple second factor devices and to configure a policy for what subsets of them can log in. But they don’t even come close, and their actual capabilities are far worse than, say, Gmail or GitHub.
- insanitybit 4y agoThe thing is that the root account at least falls back to an email, not your phone. But yeah it's insane that they don't allow multiple 2FA tokens to be registered.
- amluto 4y agoThe email fallback is of rather dubious value if your email is hosted in AWS or uses Route53.
- insanitybit 4y agoI'm not sure I understand, can you elaborate?
- Aaron2222 4y agoIf the domain of the root account's email address has it's DNS or email handled under that AWS account, then any IAM user that has access to that could intercept the email and use that to gain access to the root account.
- insanitybit 4y agoSo you set up an AWS account with some email xyz@example.com and then you transferred that domain to be managed in that same account? That sounds like a niche and terrible idea tbh, why would you dot hat?