Hacker News Reader

Except AWS, no?

Yep, super annoying, AWS doesn't allow you to register more than one MFA device.

Correct, but for AWS, you can use SSO and delegate the MFA to your SSO provider.

In AWS you must delegate your MFA to the SSO provider. Having an SSO provider but AWS managed MFA isn’t even possible because SSO users map to roles instead of IAM users.

It actually is. AWS SSO itself (so not on the IAM users level) supports user management too without an external SSO provider and actually _does_ allow multiple MFA devices unlike IAM. It's a giant hack but works!

Bank of America doesn't.

It's actually the opposite. Most U2F services allow at most 1 registration.

> Most U2F services allow at most 1 registration.

We debunk this often several times per week on HN

Yes, AWS doesn't allow you to enroll more than one FIDO authenticator. No, AWS isn't "most" services, in the same way that Jeff Bezos isn't "most" people. When you mean "AWS" just say "AWS" not "Most services".

I have multiple Security Keys enrolled with, among others, Dropbox, Facebook, Google, and GitHub.