The 2FA the site supports is either SMS or time-based token. According to them SMS doesn't work outside Australia, and having access to the site might be useful

The 2FA the site supports is either SMS or time-based token. According to them SMS doesn't work outside Australia, and having access to the site might be useful outside the country, so the time-based token seems the better choice. Except they apparently decided that the standard TOTP apps like Google Authenticator weren't good enough for them. Moah bits better, or some such. Anyway, although it is a time-based token it isn't that time-based token and you have to install their app. OK, we'll do that then. Carefully navigating past the almost identically named app with a similar icon that is for proving your identity to them, and trying not to think about all the user reviews saying myGov Code Generator doesn't work, we get it on our iPhone. Now, it doesn't work like any other TOTP app and read a QR code or have you enter a number. Instead, you have to enter your username and password into the app. [1] At this point, for me it just hung with a white screen. Exactly the same behaviour is described in the top listed review, from 2020, in the App Store, with no response from the developer [2]. This was a little scary: am I now locked out of my account? They won't help you get back in; you have to create a new one. They also have you create a backup 2FA method (SMS) after you've logged in with the time-based token. This would be a little late if you got locked out after something went wrong on your first outing with the Code Generator app. The linked video seems to have been improved since I tangled with the app. I don't remember at the time knowing it was possible to have both the SMS and app enabled for 2FA. It seems it's still not possible to have two apps enabled, on two different phones, for example to replace your phone. Bear in mind that there are residences in Australia with no mobile reception at all. No doubt they had meetings in which they congratulated each other in devising a time-based one-time password scheme which is theoretically more secure than the usual TOTP. Never mind that both are adequate for the job, and the alternative is SMS. I wouldn't be surprised if someone got a conference paper out of it. I guess if the system is actually built by someone else, you can only get promotion and a pay rise by adding knobs to the specification. If the incentives valued robustness, they would have simply used the standard TOTP. I think the biggest failing is that this problem has been all over social media, and is mentioned in the App Store reviews, but nothing has been addressed. According to the revision history at the App Store, it last got bug fixes in December 2017, with only edits to help text since then. The developers were nowhere to be seen in the Whirlpool thread or at the App Store. In my opinion this crosses the line from incompetence to misconduct. [1] https://www.youtube.com/watch?v=m-gf448FDFA https://www.youtube.com/watch?v=m-gf448FDFA [2] https://apps.apple.com/au/app/mygov-code-generator/id1305497801 https://apps.apple.com/au/app/mygov-code-generator/id1305497...