[ncc-services-wg] RIPE NCC Security Update

Dear Aleksi, Peter, and all,

Thank you for your emails, currently our efforts are focused on the first phase of deploying mandatory two-factor authentication (2FA). This first phase will include functionality to migrate 2FA to a new device.
The second phase is scheduled for the following quarters, and this is where we will look at expanding the authentication choices for 2FA. We will definitely consider your suggestions as we evaluate the possible options we can provide. 


Regards,
Eleonora,
Chief Information Security Officer
RIPE NCC




> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Wed, 20 Mar 2024 19:09:23 +0200
> From: Aleksi Suhonen <ripe-ml-2024 at ssd.axu.tm>
> To: ncc-services-wg at ripe.net
> Subject: Re: [ncc-services-wg] RIPE NCC Security Update
> Message-ID: <9a980621-f64d-4d42-bac4-6a4e3109cf0e at ssd.axu.tm>
> Content-Type: text/plain; charset=UTF-8; format=flowed
> 
> Hi colleagues,
> 
> On 3/19/24 9:59 AM, Eleonora Petridou wrote:
>> We have also strengthened password requirements and added a reminder
>> to enable 2FA when users log in to their RIPE NCC Access accounts.
>> This is an interim measure until mandatory 2FA is rolled out. Our
>> roadmaps have been updated to expedite the rollout of mandatory
>> two-factor authentication:
> 
> The current policy does not allow for having the same OTP code on two 
> different mobile phones at the same time, so the only way to migrate to 
> a new phone is to turn off 2FA completely and then turn it back on again 
> to get a QR code for the new phone.
> 
> When 2FA becomes mandatory, it cannot be turned off, am I right?
> 
> What is the plan to enable the moving to a new phone or other 
> authenticator device?
> 
> Best Regards,
> 
> -- 
>         Aleksi Suhonen / Axu TM Oy
>         Internetworking Consulting
> 
> 
> 
> ------------------------------
> 
> Message: 2
> Date: Wed, 20 Mar 2024 14:03:39 -0400
> From: Peter Potvin <peter at accuris.ca>
> To: Aleksi Suhonen <ripe-ml-2024 at ssd.axu.tm>
> Cc: ncc-services-wg at ripe.net
> Subject: Re: [ncc-services-wg] RIPE NCC Security Update
> Message-ID:
> 	<CAC0MiJpKwc6Bh+L-kLf+QjwBvDN9W-yhifsweYkgV6R03bUUUQ at mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
> 
> This is a very good point, and I can see where the issue would occur when
> the OTP application used doesn't support migration to a new device (which
> some don;t in my experience). Another thing I (among other network
> operators) would like to see is the implementation of support for WebAuthn
> and multiple hardware keys. It's not solely sufficient in my opinion to
> have only a single method of 2FA possible, so the support of different
> types of 2FA would be great to have implemented prior to 2FA becoming
> mandatory.
> 
> Kind regards,
> Peter Potvin
> 
> 
> On Wed, Mar 20, 2024 at 1:09?PM Aleksi Suhonen <ripe-ml-2024 at ssd.axu.tm>
> wrote:
> 
>> Hi colleagues,
>> 
>> On 3/19/24 9:59 AM, Eleonora Petridou wrote:
>>> We have also strengthened password requirements and added a reminder
>>> to enable 2FA when users log in to their RIPE NCC Access accounts.
>>> This is an interim measure until mandatory 2FA is rolled out. Our
>>> roadmaps have been updated to expedite the rollout of mandatory
>>> two-factor authentication:
>> 
>> The current policy does not allow for having the same OTP code on two
>> different mobile phones at the same time, so the only way to migrate to
>> a new phone is to turn off 2FA completely and then turn it back on again
>> to get a QR code for the new phone.
>> 
>> When 2FA becomes mandatory, it cannot be turned off, am I right?
>> 
>> What is the plan to enable the moving to a new phone or other
>> authenticator device?
>> 
>> Best Regards,
>> 
>> --
>>         Aleksi Suhonen / Axu TM Oy
>>         Internetworking Consulting
>> 
>> --
>> 
>> To unsubscribe from this mailing list, get a password reminder, or change
>> your subscription options, please visit:
>> https://mailman.ripe.net/
>> 
> 
> ***********************************************

-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/ncc-services-wg/attachments/20240325/b1471811/attachment.html>