undefined | Better HN

0 pointsburntsushi7y ago0 comments

AWS at least lets you sign in using alternative methods if you get locked out: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...

0 comments

3 comments · 1 top-level

stingraycharles7y ago· 2 in thread

Which in itself is a problem: it means the MFA device is not required, if only they have access to my email + phone.

burntsushiOP7y ago

Sure, I know. Just pointing out that, at least for AWS, you do not need recovery codes or a second device for MFA. For me personally, phone+email is good enough for my threat model.

mschout7y ago

Yes, AWS MFA is very poorly implemented.

j / k navigate · click thread line to collapse