4 ms·

It goes both ways. I keep telling the IT people at my hospital to stop using SMS 2-factor and they blow me off and treat me like an idiot. Anyway, ‘Doctors’ ar

by Gatsky 7y ago

It goes both ways. I keep telling the IT people at my hospital to stop using SMS 2-factor and they blow me off and treat me like an idiot. Anyway, ‘Doctors’ are a pretty diverse bunch, and most of them aren’t arrogant porn-fiends.

dvtrn 7y ago
From experience, users who come to IT and simply demand we do something because 'reasons' usually aren't prioritized for follow up. Managers who come to IT and demand we do something and show us how it affects their work/department and perhaps the rest of the business and offer to be part of the solution making process often get first class attention. Could it be IT is blowing you off because of how you're delivering your complaint about SMS 2FA without regard for their existing workload? They likely have more than enough on their plates as it is to simply do something because someone from a department said something about it, and IT doesn't exactly pivot on lithium battery, especially in hospitals. That doesn't mean they don't care about your issue or request, but like every other department they have objectives and goals that were likely set well before your 2FA conversation even began.
- Gatsky 7y ago
  You realise what you just did there right, without a hint of irony?
txcwpalpha 7y ago
I hear you and I’m sure it’s frustrating, but I’d be curious to know if the security team has any reasons for sticking with SMS 2FA. I’d be willing to bet money that the reason they blow you off is because it’s a sore spot for them. They probably have tried to implement other MFA methods but were reprimanded by the medical staff because anything other than SMS is too complicated (I’m harping on doctors a lot, but I legitimately do cringe at the thought of even asking a typical MD to download an MFA app or carry around a physical token).
- Gatsky 7y ago
  No, this is not the case. Anyway, it would be good just to have the option to not use SMS, they don’t need to migrate everyone off SMS at once.
fencepost 7y ago
SMS for 2FA isn't good, but it's still better than no 2FA at all. Depending on how many systems they have it integrated with that could end up being a huge undertaking for them and they've probably been cut to the point where another huge undertaking may not be in the cards right now. If they're like a lot of large enterprises they may also still be trying to get rid of Windows 7 and Server 2008R2. Edit: for example, are you full on Microsoft 365 Enterprise with Azure AD? I believe that has ties in with Microsoft's Authenticator app. If you're strictly onsite traditional AD I think you'd need to look at Duo for 2fa that integrates nicely with AD, then also see what else you need to integrate it with that uses its own separate non - SSO authentication. And while it's not huge, the question of "who's paying for the $3/6/9 monthly per user charges (contact sales if you have > 500 users)?" will come up, particularly if there are hundreds or thousands of external medical office users able to sign in through a portal system as well. (this is based on pricing from the Duo website)
- Gatsky 7y ago
  Yes, I’m sure they have their reasons and their own priorities and constraints. Just like the doctors who decline to use basic authentication. See my point? Hospitals are notorious for passing the buck around. As it happens there is a single web property for accessing a remote desktop, not multiple systems, and the hospital down the road funded by the same entity has implemented TOTP authentication.
  - endothrowho333 7y ago
    Curious, why would a doctor decline to use basic password auth?
    - kjs3 7y ago
      I have had a doctor tell me that his time was too important to waste it typing passwords. I had another one tell me, quite dramatically, "someone could die" while he was typing in a password. It's a profession where many have an "interesting" perspective on information protection. I have tons of tragicomic security stories from dealing with health care providers.
wolco 7y ago
Porn fiends? Doctors don't have the time. But you must admit that the profession brings out some very arrogant traits. They usually express the pointof view that they learned everything they needed to at med school and any new outside information is suspect and not important including IT security.
- hhas01 7y ago
  “But you must admit that the profession brings out some very arrogant traits.” Which one? You know we’re also talking about programmers, right?
- egocodedinsol 7y ago
  In my experience, you are way off base. Doctors can be very arrogant but I've never met someone from another profession who could point me to research articles regarding their proposed plan of action. Doctors at major hospitals are often either a) residents who are in their nth year of leaning post med school, or b) expected to publish at least case study papers regularly or communicate with those that do.
- Gatsky 7y ago
  I'm not sure how to reply to your comment. I know a lot of doctors personally, and less than 1% are what I would describe as very arrogant. Some specialties probably enrich for arrogant people, particularly cardiothoracics, cardiology or neurosurgery at large prestigious institutions, and some countries have a system which tends to permit arrogance (eg the USA).
ryanlol 7y ago
> I keep telling the IT people at my hospital to stop using SMS 2-factor and they blow me off and treat me like an idiot. Well... yeah. Nobody is sim swapping hospital staff. It’s not great, but this isn’t a real threat they’re facing.
- Gatsky 7y ago
  There are clearly targeted phishing attempts, I wouldn’t rule it out. Edit: I should add, I was very surprised when I got a phishing email sent by the obviously compromised email account of a colleague, and when I emailed them to say their email was hacked, the person who hacked them replied telling me everything was OK, and to open the attachment.
- ethbro 7y ago
  You'd be surprised how much money flows through the medical system. And how much of that flows through automated systems. And how little of the total is actually audited on a detailed level.
  - ryanlol 7y ago
    >You'd be surprised how much money flows through the medical system I wouldn’t, I just know that the crowd targeting hospitals for wire fraud is very different from the sim swappers. It’s possible that this may change at some point, but that hasn’t happened yet and probably isn’t going to. Phishing is so easy and successful that SIM swapping just doesn’t make sense for these targets.

by Gatsky 7y ago

dvtrn 7y ago

From experience, users who come to IT and simply demand we do something because 'reasons' usually aren't prioritized for follow up. Managers who come to IT and demand we do something and show us how it affects their work/department and perhaps the rest of the business and offer to be part of the solution making process often get first class attention. Could it be IT is blowing you off because of how you're delivering your complaint about SMS 2FA without regard for their existing workload? They likely have more than enough on their plates as it is to simply do something because someone from a department said something about it, and IT doesn't exactly pivot on lithium battery, especially in hospitals. That doesn't mean they don't care about your issue or request, but like every other department they have objectives and goals that were likely set well before your 2FA conversation even began.

Gatsky 7y ago
You realise what you just did there right, without a hint of irony?

txcwpalpha 7y ago

I hear you and I’m sure it’s frustrating, but I’d be curious to know if the security team has any reasons for sticking with SMS 2FA. I’d be willing to bet money that the reason they blow you off is because it’s a sore spot for them. They probably have tried to implement other MFA methods but were reprimanded by the medical staff because anything other than SMS is too complicated (I’m harping on doctors a lot, but I legitimately do cringe at the thought of even asking a typical MD to download an MFA app or carry around a physical token).

Gatsky 7y ago
No, this is not the case. Anyway, it would be good just to have the option to not use SMS, they don’t need to migrate everyone off SMS at once.

fencepost 7y ago

SMS for 2FA isn't good, but it's still better than no 2FA at all. Depending on how many systems they have it integrated with that could end up being a huge undertaking for them and they've probably been cut to the point where another huge undertaking may not be in the cards right now. If they're like a lot of large enterprises they may also still be trying to get rid of Windows 7 and Server 2008R2. Edit: for example, are you full on Microsoft 365 Enterprise with Azure AD? I believe that has ties in with Microsoft's Authenticator app. If you're strictly onsite traditional AD I think you'd need to look at Duo for 2fa that integrates nicely with AD, then also see what else you need to integrate it with that uses its own separate non - SSO authentication. And while it's not huge, the question of "who's paying for the $3/6/9 monthly per user charges (contact sales if you have > 500 users)?" will come up, particularly if there are hundreds or thousands of external medical office users able to sign in through a portal system as well. (this is based on pricing from the Duo website)

Gatsky 7y ago
Yes, I’m sure they have their reasons and their own priorities and constraints. Just like the doctors who decline to use basic authentication. See my point? Hospitals are notorious for passing the buck around. As it happens there is a single web property for accessing a remote desktop, not multiple systems, and the hospital down the road funded by the same entity has implemented TOTP authentication.
- endothrowho333 7y ago
  Curious, why would a doctor decline to use basic password auth?
  - kjs3 7y ago
    I have had a doctor tell me that his time was too important to waste it typing passwords. I had another one tell me, quite dramatically, "someone could die" while he was typing in a password. It's a profession where many have an "interesting" perspective on information protection. I have tons of tragicomic security stories from dealing with health care providers.

wolco 7y ago

Porn fiends? Doctors don't have the time. But you must admit that the profession brings out some very arrogant traits. They usually express the pointof view that they learned everything they needed to at med school and any new outside information is suspect and not important including IT security.

hhas01 7y ago
“But you must admit that the profession brings out some very arrogant traits.” Which one? You know we’re also talking about programmers, right?
egocodedinsol 7y ago
In my experience, you are way off base. Doctors can be very arrogant but I've never met someone from another profession who could point me to research articles regarding their proposed plan of action. Doctors at major hospitals are often either a) residents who are in their nth year of leaning post med school, or b) expected to publish at least case study papers regularly or communicate with those that do.
Gatsky 7y ago
I'm not sure how to reply to your comment. I know a lot of doctors personally, and less than 1% are what I would describe as very arrogant. Some specialties probably enrich for arrogant people, particularly cardiothoracics, cardiology or neurosurgery at large prestigious institutions, and some countries have a system which tends to permit arrogance (eg the USA).

ryanlol 7y ago

> I keep telling the IT people at my hospital to stop using SMS 2-factor and they blow me off and treat me like an idiot. Well... yeah. Nobody is sim swapping hospital staff. It’s not great, but this isn’t a real threat they’re facing.

Gatsky 7y ago
There are clearly targeted phishing attempts, I wouldn’t rule it out. Edit: I should add, I was very surprised when I got a phishing email sent by the obviously compromised email account of a colleague, and when I emailed them to say their email was hacked, the person who hacked them replied telling me everything was OK, and to open the attachment.
ethbro 7y ago
You'd be surprised how much money flows through the medical system. And how much of that flows through automated systems. And how little of the total is actually audited on a detailed level.
- ryanlol 7y ago
  >You'd be surprised how much money flows through the medical system I wouldn’t, I just know that the crowd targeting hospitals for wire fraud is very different from the sim swappers. It’s possible that this may change at some point, but that hasn’t happened yet and probably isn’t going to. Phishing is so easy and successful that SIM swapping just doesn’t make sense for these targets.