Security

Make login by passkeys possible for project dashboards. Current two-step authentication by SMS is not safe.

I think it is great that Digital Ocean rolled out it's beta testing to provide custom scopes for personal access tokens shown here: https://docs.digitalocean.com/reference/api/create-personal-access-token-with-custom-scopes/ However, I think it is missing one hugely beneficial feature that could dramatically increase security in the event of a compromised token. There should also be an option to allow tokens to only be used by authorized IP addresses and/or IP ranges. This way, attackers cannot use a compromised token to destroy resources regardless of customized granularity. It's a secondary protection layer to provide much stronger security. Default setting should of course be to allow all IP ranges, but if a token grantor wishes to have greater security, allow them the option to limit it only to authorized IP addresses (ie. the IPs of their droplets or other resources from where they anticipate making the API calls). The token-creator should be able to customize that IP list and/or IP range(s) accordingly.

Any plans to offer a SecretsManager as a service?

test110

The interface shouldn't force what permissions we use. Twice I've been forced to add scopes that my process didn't use. We should be able to bypass this. The error message seem to be sufficient for those who are missing permissions as I discovered when droplet:create permissions didn't force me to create ssh_key:read .

Teams should be able to enable and disable per-user access for individual projects. This would be in line with best practices, following the principle of least privilege and maintaining a consistent level of separation between project staff.

As people join and leave our teams, we find our list of keys grows to unmanageable levels. Need a way to clear out the unused keys or keys uploaded by members no longer with the team.

Hello, someone is trying to ban my website, using your services. Please delete this page: https://mcbgugel.sgp1.cdn.digitaloceanspaces.com/durusala.html

Hey guys. I am Yuriy. An engineer from FIDO Alliance. You probably heard about us. We are the organisation behind U2F protocol that Google reported killed employee phishing: https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing . Our organisation have developed secure, seamless, phishing proof, passwordless authentication standard called FIDO2. Or some people may call it WebAuthn. WebAuthn is the JS API part in the browsers of the FIDO2, and it is supported by Chrome, Edge and Firefox. I was happy customer of yours for many years and I felt like you guys so great and innovative, that adding FIDO2 support to your multifactor authentication instead of TOTP would be a great idea, since TOTP is succeptable to phishing. We have a tutorial https://slides.com/fidoalliance/jan-2018-fido-seminar-webauthn-tutorial I wrote blog posts on attestation and assertion verification: https://medium.com/@herrjemand/verifying-fido2-responses-4691288c8770 We have a stories a good deployment stories: https://engineering.linecorp.com/en/blog/fido-at-line/ And we have a helpful and friendly community that will be able to help you if you stuck *) Regards. Yuriy

Other competitors offer "Escrow as a service" to give access to cloud resources to clients or other stakeholders in the event of a disaster. Can we expect such a feature? Or in the marketplace?