New U.S. Guidelines Could Halt Use of SMS for Two-Factor Authentication

[ardent73]

this just in:

"Starting in August 2016, Social Security is adding a new step to protect your privacy as a my Social Security user. This new requirement is the result of an executive order for federal agencies to provide more secure authentication for their online services. Any agency that provides online access to a customer’s personal information must use multifactor authentication.

When you sign in at ssa.gov/myaccount with your username and password, we will ask you to add your text-enabled cell phone number. The purpose of providing your cell phone number is that, each time you log in to your account with your username and password, we will send you a one-time security code you must also enter to log in successfully to your account.

If you do not have a text-enabled cell phone or you do not wish to provide your cell phone number, you will not be able to access your my Social Security account."

 

[drzow]

this just in:

"If you do not have a text-enabled cell phone or you do not wish to provide your cell phone number, you will not be able to access your my Social Security account."

Wow -- so that's actually exactly the sort of thing that this change will affect: a public facing service provided by the US Government. My guess is they'll have to do this by exception because a lot of people accessing their SSA account probably fall into the 1/3 of Americans without a smartphone (such as my grandparents). Probably a fair number who fall into the 9% of Americans without a cell phone as well, so not sure how they planned to handle those.