Las contraseñas se filtran. Se reutilizan en otro sitio que sufre un robo, se apuntan donde no deben, se adivinan. Si la contraseña de quien gestiona tus servidores basta para pararlos o borrar sus copias, el problema no es si pasará, sino cuándo. AWS lo sabe y recomienda MFA en la consola; lo que no cubre es a las personas de tu equipo que no tienen cuenta de AWS y a las que les has dado acceso de otra forma.
En Simplio el doble factor es un código de seis cifras que genera una aplicación en tu móvil (Google Authenticator, Microsoft Authenticator o cualquiera compatible). Se pide para entrar y, además, en cada acción delicada: detener o reiniciar una máquina, borrar ficheros, instantáneas o copias, subir código a una función Lambda, quitar un registro DNS, abrir una terminal, usar la llave de repuesto. Una contraseña robada, sola, no sirve para tocar nada.
How it works
Each user enables it from their profile
Scan a QR code with the phone app and confirm with the first code. From that moment, signing in asks for the code.
Sensitive actions always ask for it
Stop, restart, delete, upload code, open terminal, rescue a machine. Even if you've just signed in. Even if you're an administrator.
Without becoming a chore
After a correct code, Simplio doesn't ask for it again for ten minutes; from the third one in the same session, for two hours. That trust lives only in your session: it ends when you sign out, if it expires through inactivity, if your IP address changes or if someone types an incorrect code. Deleting cloud objects still requires typing their name. If you leave your computer, lock it.
If you lose your phone, you don't lose the account
When you enable it you receive eight single-use recovery codes to keep somewhere safe: any of them signs you in instead of the phone code, and from your profile you set up the new phone. If you don't have those either, an administrator of your company can remove your two-factor, or you request it yourself with your password and a code from your email: in that case there is a two-day wait with notice to all administrators, who can cancel it. None of this happens instantly or by email alone.
Whoever manages the users sees who has it
The user list shows who has two-factor enabled and who doesn't, so you can chase whoever is missing.
How secure it is
No exceptions for administrators
Sensitive actions ask everyone for the code. The more someone can do, the more it matters.
Single-use codes
Each code works once and for a few seconds. One seen over your shoulder is useless a minute later.
Email never replaces the phone
Recovering the password by email still asks for the phone code if you have it enabled. Whoever reads your mailbox doesn't get in that way.
Activations and deactivations are logged
In the activity log, with who and when. Deactivating someone's two-factor doesn't go unnoticed.
The same task, in AWS and in Simplio
| On your own in AWS | In Simplio | |
|---|---|---|
| Protect whoever handles the machines | MFA in IAM, user by user, if each one has an IAM user | Enable it in the profile, with a QR |
| Ask for a code before stopping a machine | It doesn't exist: with a session open, the console stops it without asking | Always, on every sensitive action |
| Know who has it enabled | IAM credential report | User list |
Frequently asked questions
Which app do I need?
Any TOTP code app: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden… It's the same mechanism used by banks and Google.
And if I lose my phone?
Whoever manages the users can remove your two-factor so you can set it up again on the new phone. That deactivation is recorded in the activity log.