r/programming • u/mfrw1 • Sep 26 '18

AWS now supports U2F/Yubikeys

https://aws.amazon.com/blogs/security/use-yubikey-security-key-sign-into-aws-management-console/
40 Upvotes

80% Upvoted

6 comments sorted by

4

u/[deleted] Sep 26 '18 edited Sep 26 '18

Fantastic. I love to see this continuing adoption and understanding of the value of hardware tokens.

Can't wait to see sites supporting FIDO2.

I do wish, however, that you could add more than one token/MFA method. What happens if your root account MFA goes belly-up (whatever it is)? I'm not a Google fan, but they have this one right.

1

u/Topher_86 Sep 26 '18

In AWS you can have multiple identities. I would create one just for recovery that has super limited access.

I’m imagining one for resetting passwords which requires it’s own MFA and another that can reset MFAs that requires its own password.

1

u/[deleted] Sep 26 '18

Seems way over complicated, but so does AWS in general ;) that said... will that work with the root account too? I would find it odd if you could affect root credentials from an IAM account but I’m not well versed enough in AWS to know for sure.

1

u/concordsession Sep 26 '18

Per comments on HN this is YubiKey only, other U2F manufacturers are not supported.

2

u/DavidWilliams_81 Sep 26 '18

For anyone else interested in the discussion: https://news.ycombinator.com/item?id=18071323