Re: Three steps we could take to make supply chain attacks a bit harder

[Carlos Rodriguez-Fernandez]

Yes that works too. By the time I was setting up MFA everywhere, and doing the code printing, I recall not all systems giving me that option, and finding the paper thing not very good as recovery mechanism for me, so I went with Yubikeys and my own backup-in-the-cloud mechanism. I was just sharing an option just in case it could serve someone that is hesitating by giving some ideas :).

On 4/12/24 09:47, Adam Williamson wrote:

On Thu, 2024-04-11 at 19:52 -0700, Carlos Rodriguez-Fernandez wrote:

I was hesitant to have MFA for a while. Imagine losing a phone with tons
of tokens. What a hassle to recover from that. I found it less than
ideal for practical reasons.

This is one reason most systems provide a sheet of one-time backup
codes that you're meant to print out and keep in a safe place, for
recovery from exactly that scenario.

Alternatively, if you have an old phone or tablet lying around, just
install an MFA app on that and enrol it too, lock it in a cabinet, then
if you ever lose your primary phone, use it to recover.

Also, these days, most authenticator apps support some kind of backup
mechanism. FreeOTP lets you back up to a file (which you should, of
course, keep somewhere safe and ideally encrypted). Google
Authenticator can backup To The Cloud.

OpenPGP_signature.asc
Description: OpenPGP digital signature

--
_______________________________________________
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue