Slashdot Mirror
Australian Government Tells Citizens To Turn Off Two-factor Authentication (arstechnica.com)
An anonymous reader writes with this news from Ars Technica: The Australian government has repeatedly called for citizens to turn off two-factor authentication (2FA) at its main digital government portal, myGov. The portal's Twitter account has recently been updated several times with cute pictures encouraging holidaymakers to "turn off your myGov security codes" so that "you can spend more time doing the important things."
The portal is the place where Australian citizens can use and manage a number of governmental services, including health insurance, tax payments, and child support. In case of myGov, two-factor authentication is implemented by sending users text messages that contain one-time codes to complement their usual passwords.
The portal is the place where Australian citizens can use and manage a number of governmental services, including health insurance, tax payments, and child support. In case of myGov, two-factor authentication is implemented by sending users text messages that contain one-time codes to complement their usual passwords.
Was it hacked or has someone been drinking too much fosters?
...we're the government!
Just found out I got some tainted love!
Happy Birthday, Jesus! Don't be a stranger!
The reasoning behind myGov's suggestion is understandable: some tourists will swap their Australian SIM cards to local ones while on holiday. Once this is done, they won't be able to receive myGov security codes without reinstalling their Australian SIMs, which is a hassle.
it seems to me this is probably the result of many support calls/emails because people don't realize when they switched their card that they couldn't authenticate. perhaps instead of turning off two factor authentication in a situation when it's needed most, that they should add a "vacation mode" that let's you temporarily pick a new destination for the text messages.
Anons need not reply. Questions end with a question mark.
So the problem is that people swap their Australian SIMs when they go abroad, and don't get alerts. Okay, well why not just send an email saying "you have an alert, log in to see it out replace your Australian SIM and pay $$$ to get the text message"?
That's what the lottery in the UK does. You get a message saying you have good news, log in to see it. Then you find out you won £2.37 and it was barely worth the effort.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
myGov has to be one of the worst executions of a good idea I've come across. Basicallly its a single sign on portal to other government services that appears to be designed by a committee of very user unfriendly elderly people. You dont get to have a username, you get a user number. The system insists on a *very* strict password, and if you get it wrong three times, your account is locked for the day, even if your on a welfare payment that requires you to log in that day by law. It also asks you to answer various questions ("What is your mothers maiden name" type things, and its anal about input to the point of paranoia. Capitals wrong? One day account lock!). I get that they are worried about security , but how about letting us have a user name we can remember, and setting that auth question to case insensitive!
Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
If you get a new phone number they have to completely delete your account and you have to link everything again from scratch. Takes a couple of months. Well designed portal...
Every-time I log-in, I get a nag screen demanding I turn two-factor authentication on; every time. This is precisely the reason I won't: no phone, no access.
> For less that 2 MB using the Sosh price, I could have bought a month with Free just to visit the US. I'm wondering why my carrier still has clients.
You ARE the client who still keeps them. Why tf are you still with them?
we're the government!
But in order to turn it off I need to log in. I can't log in because I'm living abroad without my Australian number. I can't change the system to use my new number because I can't log in.
I hope implement a sensible workaround before tax time.
"The Australian government has repeatedly called for citizens to turn off two-factor authentication (2FA)" .. so as they can more easily spy on you.
Tell me again, why they are in the government?
I'm an Australian with a MyGov account, and I refuse to give them my phone number. Every time I log in it asks for one, and tells me how much more secure I would be if I used 2FA. You can decline each time, but there's no way to tell the system "no, not now, not ever, don't ask me again". I even sent feedback to the webmaster asking how I could tell it that I DO NOT HAVE A MOBILE PHONE so it will stop asking me, and got no response.
And now they're urging people to turn it off!
Bizarre.
(I always knew that the reason they wanted a phone number had nothing to do with protecting my security.)
Simon Pegg's crapterpiece. Foster on tap at each and every dive. And he's Australian. Should be. After that movie he is a criminal most assuredly deserving a one-way ticket down-under.
The article is difficult to understand. The quote "so you can do more important things" makes no sense whatsoever and confuses readers. Someome please moderate this article down.
2-factor auth by mobile phone (or tablet) is fucking cretinous. mobile phones aren't in the least bit secure, they're even worse than Microsoft Windows - and that includes both Android and Apple.
Anyone who trusts their phone for anything where security is important - like banking, or as a credit card substitute or other payment system, or even just to login to a web site - is a fucking moron.
they are inherently compromised by spyware and malware - even if you're extremely careful about the apps you install (99.99% of which are crap that exist solely to spy on you in one way or another), the OS itself spies on you on behalf of their REAL owners, Apple and Google.
Have gnu, will travel.
From the article: "The reasoning behind myGov's suggestion is understandable: some tourists will swap their Australian SIM cards to local ones while on holiday. Once this is done, they won't be able to receive myGov security codes without reinstalling their Australian SIMs, which is a hassle." Why aren't they using a Yubikey or an authenticator app, such as Google Authenticator, Authy or one of the many others that are available? If the argument is that "SIM dependent" authentication is more secure that is definitely undermined by the fact they are telling people it's inconvenient to use, so turn it off. They need to fix this to be usable in real world situations, not some theoretical construct.
It's not sim dependant, it's phone number dependant.
If you can't get the sms, you can't get the security code.
We drink VB and don't ever do what myGov says we should do, in fact who the fcuk uses myGov anyway, it's been haxored many times.
You don't have a phone, but you have an Internet connection and are geek enough to access slash dot? Lol.
You think slashdot is for geeks? Slashdot articles are clearly targeted at conspiracy theorists, student politicians, culture warriors and wannabe executives these days. You know... redpill types. There is very little of interest to engineers following FOSS anymore.
Deploying yubikey to 24 million people? That's not even half-smart.
Or maybe it means that the .AU government know that their security is fatally flawed, and this message comes from the thieves.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"