3 ms·

Australian government tells citizens to turn off two-factor authentication

11 points by Jerry2 11y ago

therealunreal 11y ago
> The reasoning behind myGov's suggestion is understandable: some tourists will swap their Australian SIM cards to local ones while on holiday. Once this is done, they won't be able to receive myGov security codes without reinstalling their Australian SIMs, which is a hassle.
sdiq 11y ago
As someone who started using 2fa only yesterday, I was wondering whether it would have been possible for the Australian government to have an app-based token as an alternative? How is that compared to hassles of text-based tokens when someone if out of the country? Edit: grammar.
- akerro 11y ago
  It doesn't matter if it's a text message or OTA application like FreeOTP. Both require physical access to device you authenticated before. Personally I prefer OTP, just because I don't want to provide my phone number everywhere.
  - jacalata 11y ago
    It does matter, because the apparent rationale is that they know users change SIM while travelling - so they have access to the device but not to the phone number used for SMS.
- icebraining 11y ago
  It could, and they're also safer, since they can't be intercepted like SMSs. There's a question of device support, but considering there are J2ME apps that implement TOTP, it shouldn't be a problem.
jacalata 11y ago
Well that's a contender for overblown fear mongering headline of the week. Let's try again, headlining it "Australian government website encourages users to downgrade their account security by turning off TFA". I know, I'll generate less outrage, but on the bright side it's factually accurate, which is a lot more than you can say for the original (for a start, you don't need to be an Australian citizen to use a mygov account).
- serge2k 11y ago
  I think the rule is you have to use the original page headline. avoids editorializing.
  - jacalata 11y ago
    Yes, sorry - I was criticizing the article, not the poster.
oliyoung 11y ago
Also relevant http://www.smh.com.au/digital-life/consumer-security/taxpayer-records-exposed-by-serious-ato-mygov-security-flaw-20151117-gl1kex.html http://www.smh.com.au/digital-life/consumer-security/taxpaye... Security isn't a strong point with these people, which is amazing for a portal that has literally every relationship you have with the Aus government …

11 points by Jerry2 11y ago

> The reasoning behind myGov's suggestion is understandable: some tourists will swap their Australian SIM cards to local ones while on holiday. Once this is done, they won't be able to receive myGov security codes without reinstalling their Australian SIMs, which is a hassle.

sdiq 11y ago

As someone who started using 2fa only yesterday, I was wondering whether it would have been possible for the Australian government to have an app-based token as an alternative? How is that compared to hassles of text-based tokens when someone if out of the country? Edit: grammar.

akerro 11y ago
It doesn't matter if it's a text message or OTA application like FreeOTP. Both require physical access to device you authenticated before. Personally I prefer OTP, just because I don't want to provide my phone number everywhere.
- jacalata 11y ago
  It does matter, because the apparent rationale is that they know users change SIM while travelling - so they have access to the device but not to the phone number used for SMS.
icebraining 11y ago
It could, and they're also safer, since they can't be intercepted like SMSs. There's a question of device support, but considering there are J2ME apps that implement TOTP, it shouldn't be a problem.

jacalata 11y ago

Well that's a contender for overblown fear mongering headline of the week. Let's try again, headlining it "Australian government website encourages users to downgrade their account security by turning off TFA". I know, I'll generate less outrage, but on the bright side it's factually accurate, which is a lot more than you can say for the original (for a start, you don't need to be an Australian citizen to use a mygov account).

serge2k 11y ago
I think the rule is you have to use the original page headline. avoids editorializing.
- jacalata 11y ago
  Yes, sorry - I was criticizing the article, not the poster.

oliyoung 11y ago

Also relevant http://www.smh.com.au/digital-life/consumer-security/taxpayer-records-exposed-by-serious-ato-mygov-security-flaw-20151117-gl1kex.html http://www.smh.com.au/digital-life/consumer-security/taxpaye... Security isn't a strong point with these people, which is amazing for a portal that has literally every relationship you have with the Aus government …