oscarsclaws May 17
s0 Is Not A Sysadmin

My bank just emailed me to say that because I haven’t used my two factor auth recently (they only require it for specific actions), they’re disabling it on my account.

What kind of a batshit security posture is that?!!

May 14 at 7:38amWeb
Show threadMike [SEC=OFFICIAL]May 14
@s0 if it leads to fewer support calls, it's gotta be good
Show threadWoozle HypertwinMay 18

@mike @s0

So many decisionmakers don't seem to comprehend the existence of a "long term". -.-

Show threadBit RegurgitatorMay 14
@s0 (slow clap)
Show threadJPMay 14
@s0 amazing. I should send their CISO one of my Security Bandage stickers.
Show threadDeborah PickettMay 14

@s0 This is MyGov levels of Can’t Computer.

Edit: No, it isn't, because MyGov can at least do TOTP now.

Show threadNeko May 14
@futzle yeah but it's locked to their gods damned App
Show threadVirtualWolfMay 14
@neko @futzle Surprisingly they support passkeys now!
Show threadVirtualWolfMay 14

@neko @futzle I did this super-hacky thing ages ago to get the TOTP out of their shitty app and into 1Password.

...huh, that being said I just logged in and have a message under the "Security Actions" section:

The myGov Code Generator app is being retired, set up another sign in option.

And when you continue with that it actually gives you the option to use a bog-standard TOTP authenticator setup!

GitHub - abrasive/mygov-totp-enroll: Enroll a real TOTP client to access myGov

Enroll a real TOTP client to access myGov. Contribute to abrasive/mygov-totp-enroll development by creating an account on GitHub.

GitHub
Show threadVirtualWolfMay 14

@neko @futzle lol, they're still persisting with the "Change your password regularly" nonsense though:

Your password is over 2 years old. You need to change it to improve your account security.

Show threadNeko May 14

@virtualwolf

You probably have me to thank for that. Every gods-damn time I've needed to log in to The Australian Government System it's been a case of "Your medicare sign-in ID is now an australia.gov.au ID, go set one up here" "oh your australia.gov.au ID is now becoming my.gov.au", they are addicted to changing login methods up to annoy me, specifically

Show threadI love this, so IMay 14
@s0 lol that’s fucking amazing
Show threadghosts in the silicon ▒May 14
@s0 oh no.
Show threadAri SovijärviMay 14
@s0 This seems like the logic where they realised 2FA is a lost cause for an average non-technical person and they try to pre-emptively solve all the login issue tickets by applying a fix like this.
Show threadmatlagMay 17
@s0 And if you still don't do anything, they'll give access to your account to 13 random people?
Show threads0 Is Not A SysadminMay 17
@matlag only if they know my mother’s maiden name, of course (my mother never changed her name and is an easily googled public figure)
Show threadMike [SEC=OFFICIAL]May 17
@s0 @matlag for security reasons you should get a new mother every 90 days.
Show threadSyl (Sylvia Bun) :enby_inside: May 17
@s0 Sadly I've seen worse. Had an account that wouldn't let me log in without e-mail verification, despite acknowledging I had two factor authentication, because it couldn't verify that the two factor authentication was secure.

It's because they only "approved" of Google Auth and I used Ente Auth, so they treated my two factor auth as invalid.
Show threadyuki - queen of the snowMay 30
@thatgalsilver @s0 ah yes, insecure OTPs vs. Secure OTPs
…
bweh
Show threadgürkan �’ :catlong_head_left::catlong_h::catlong_end_right:May 17
@s0 was 2fa optional?

You know what.. I don't want to know, I'm not sure which answer is worse 
Show threadsockkeMay 17
@s0 I can't remember which bank it was, but i once couldn't change my online-banking password because changes to the profile were only allowed from 10:00 to 16:00
Show threadDeborah Preuss, pccMay 17
@s0 @JoBlakely bank-internal austerity theatre? "Look, we saved all those 2FA calls!" (that weren't being made, anyway) 😵‍💫 What?!
Show threadJo - pièce de résistanceMay 17
@deborahh @s0
I was thinking they collected everyone’s phone number, reduced people’s privacy in a theatre of enhancing it, got what they wanted then bailed. It was data collection, not data privacy, in the final analysis.
Show threads0 Is Not A SysadminMay 17
@JoBlakely @deborahh not this one. It’s TOTP 2FA. Which they’re paying way too much to Symantec for
Show threads0 Is Not A SysadminMay 17
@JoBlakely @deborahh and IMO my bank should have my phone number
Show threadI AM BANKSY ☕ / 🗑‍🔥May 17
@s0 weird. Our approach was "enable 2FA or we disable your account"
Show threadDane 🌎🖖✌️☮️⚛️☸️🕉️May 17
@s0 😐
Show threadSchroedingers_CatMay 17

@s0 Ridiculous. I think 2FA may well reduce the number of times you use those features that require it - which is a positive development. It makes you think twice. So I would consider that a significant reduction in use is a positive.

Removing it for any reason (without your say-so) is bonkers.

Show threadHubert FiguièreMay 17
@s0 mine decided to send me 2FA SMS without even asking if the number was still valid.
Show thread[Yaseenist] CauseOfBSODMay 30
@s0 your bank doesnt enforce 2fa?