Hacker News Reader

Comment by blibble | Hacker News Reader

their hardware MFA functionality is worse than useless

it only permits a single hardware token to be registered to an account

so good luck if you misplace or break your hardware token

When setting up the token you can scan the QR with multiple devices. E.g YubiKey and Authenticator App. This at least allows for a backup in case one goes missing. I agree it is kind of incredible that multiple tokens are not supported.

Don't token limits reduce attack surface?

You actually can't mix hardware tokens and OTP apps. You're only option is to scan the code twice and skip hardware tokens entirely (which is quite reasonable, as the recovery for an app would be easier than for a failed/lost hardware token).

Note, though, that the new SSO login actually supports MFA in a normal way.

You create several users with admin privileges each with separate MFA.

I did not like that limitation either and get around it by using the Yubico Authenticator app with three separate hardware tokens configured with the same shared TOTP seed. There's also path to reset your root account access, btw.

The point is to block unauthorized access. It is not less than useless. It absolutely does that. You really think if your lost your token Amazon would lock you out forever? Wrong assumption

Besides, just use AUTHY if that's your concern

FWIW, at a workplace I'm familiar with, the hardware MFA devices for a group 'disappeared' from the office during COVID and despite the company having an active relationship and contracts with AWS, it was taking over a year to get access to the root accounts in question reset. It is not an easy process.

That said, I have to imagine this is the wrong procedure and there's some way to duplicate hardware MFA devices to have redundancy for such a case...

That's bad and annoying but it is not at all worse than useless. A hardware token is a very worthwhile investment.

Reply on news.ycombinator.com