SMS Login Verification - Argh

[JohnPhelan]

And of course the MyGov website works off SMS as the 2FA for everything to do with tax and government benefits.

 

[Chicken]

The problem with QF Money is that it's actually Citibank. Not sure how well the QF and Citi systems would link.......

Quite integrated.

When you go to Qantas Money, you log in with your QF member number + last name + PIN , which are exactly same as QF home page.

Once you are in, it tells you how much point you have in your QF account (not your QF credit card)

If you click on point section, it gives you your QF account activity list, including points you used or earned from flying.

Single password sign on is not hard. Salesforce and SAP already have existing APIs which allow single sign on.

Now that we are talking about this, Qantas Money had always needed SMS just to log in, so Qantas is probably just rolling this SMS log in module from Qantas Money to Qantas home page.

 

[JohnK]

Yes very annoying.

Going off topic but work has introduced password recovery for our work accounts. You need to register and download an app on your personal phone. Seriously? No. Who dreams up these brilliant ideas and implements them?

 

[Flying mermaid]

Ok, so I'm trying to work out what all the fuss here is. Out of curiosity, I clicked the button that said 'verify another way' (or similar) and was presented with the following:

View attachment 177219

Now if you can't answer:
- the DOB of the person
- the postcode per the users details
- date of joining (it's found on your FF card)
- the security question (which can be updated in your profile: My Account > Personal Information > Security Questions)

Then I daresay that you shouldn't be accessing said person's account. Don't get me wrong, it's certainly not user friendly, but there is an alternative way to access without needing to receive an SMS.

Oh that’s easier than changing phone numbers. I just need to coordinate with ankle biters to make sure they have set up their security questions and I know what they are

 

[Berlin]

Yes very annoying.

Going off topic but work has introduced password recovery for our work accounts. You need to register and download an app on your personal phone. Seriously? No. Who dreams up these brilliant ideas and implements them?

Oh- I can think of entire departments doing nothing else but coming up with total c$%p like this

 

[trippin_the_rift]

Incorrect.

As said many time earlier in this thread, it costs nothing to receive SMS while you are roaming overseas.

So much fake news ......

Both my Hong Kong and Malaysian accounts are charged to receive SMS while outside the country.

Qantas has more than just Australian mobile numbers.

SMS may work for Australia, but it's an extinct communication channel in Asia.

 

[Pushka]

SMS doesn't use the Mobile data on your phone.. services like iMessage do, but SMS doesn't.

Then why don’t I receive them when I’m os and only on wifi. I connect to 3G and receive several at once.

 

[cwd]

And of course the MyGov website works off SMS as the 2FA for everything to do with tax and government benefits.

They have an app you can use to generate codes. Not quite as nice as using TOTP so you can use your choice of app, but they certainly don't require the use of SMS.

Ideally Qantas would allow the use of something like a Yubikey, but I can just imagine the complaints here if they insisted on something other than SMS. You'd think they could add a code generator to the Qantas mobile apps though.

 

[Berlin]

You'd think they could add a code generator to the Qantas mobile apps though.

Now THAT is a really good idea!

 

[cwd]

Then why don’t I receive them when I’m os and only on wifi. I connect to 3G and receive several at once.

Are you sure they're standard SMS messages, and not an MMS?

Also, are you turning the entire cellular part of your phone off, or just the mobile data part? There's no need to do the former, and it would explain why you're not receiving SMS. I have two phones here next to me that are roaming, and both receive SMSs with no issues, with no perceptible delay.

MMS does require cellular/mobile data, so if someone's sending you photos etc. you wouldn't be able to receive them.

 

[Chicken]

Both my Hong Kong and Malaysian accounts are charged to receive SMS while outside the country.
Qantas has more than just Australian mobile numbers.

That's due to different charging regime.

In Australia, calls are paid for by A party. In Hong Kong, calls are paid for by B party. (A party is caller, B party in receiver)

However, if you are using a Hong Kong SIM, you would get so many SMS (and minutes) included that it would not matter.

SMS may work for Australia, but it's an extinct communication channel in Asia.

Which is why SQ asks if you want your messages via SMS or WhatsApp.

Now, back to the question on QF. Do you think QF is capable of implementing WhatsApp like SQ is able to?

 

[trippin_the_rift]

Which is why SQ asks if you want your messages via SMS or WhatsApp.

Now, back to the question on QF. Do you think QF is capable of implementing WhatsApp like SQ is able to?

SQ have SMS to cater for international audiences. Same with MH, AK and...well - the majority of ASEAN airlines which use Whatsapp.

Qantas simply failed to consider non-Australian based members.

Can QF implement alternatives? Yes
Will they? 2 years of trials and members providing negative feedback on the trial, AND QF acknowledging the negative experience - send a loud and clear message that Qantas don't give a cough about feedback, OR, QF are too lazy to come up with an alternative.

 

[Chicken]

SQ have SMS to cater for international audiences. Same with MH, AK and...well - the majority of ASEAN airlines which use Whatsapp.

Which brings us back to square one: Having to receive a message, and having to ask the original account holder to check their message when you try to log into their account.

Aren't we back to square one?

Can QF implement alternatives? Yes
Will they? 2 years of trials and members providing negative feedback on the trial, AND QF acknowledging the negative experience - send a loud and clear message that Qantas don't give a **** about feedback, OR, QF are too lazy to come up with an alternative.

Maybe QF picked the easier option to tie over for now? Who knows?

Looks, if people want to have a rant, over some SMS, sure, have a go.

However, there is only so much resources they have (and I am sure most of you do understand this point if you have done any project).

I know I would rather they buy this SMS off the shelf product, tie them over for a few years, and work on things which are more important, like displaying award availability properly when searching for a flight.

I know that, if you ask the general public what they want, spend 2 years working on some new evolutionary ID check, or spend 2 years building a new way of displaying award availability, the public would pick the really obvious one.

 

[Pushka]

Rubbis

Ok, so I'm trying to work out what all the fuss here is. Out of curiosity, I clicked the button that said 'verify another way' (or similar) and was presented with the following:

View attachment 177219

Now if you can't answer:
- the DOB of the person
- the postcode per the users details
- date of joining (it's found on your FF card)
- the security question (which can be updated in your profile: My Account > Personal Information > Security Questions)

Then I daresay that you shouldn't be accessing said person's account. Don't get me wrong, it's certainly not user friendly, but there is an alternative way to access without needing to receive an SMS.

why should an EA know dob of their boss?

 

[Chicken]

Rubbis

why should an EA know dob of their boss?

Actually, they generally do, because they need to fill in visa applications and book plane tickets and rental cars, all require DOB.

I used to sit next to a bunch of EAs. The amount of personal things they have are funny, passports, licences, tickets of all sorts, credit cards, just all over their desks. I sometimes think, they know their bosses better than the partners of those bosses.

 

[Pushka]

Actually, they generally do, because they need to fill in visa applications and book plane tickets and rental cars, all require DOB.

Not ours. Plane tickets domestic only. And check in.

 

[Chicken]

Not ours. Plane tickets domestic only. And check in.

So the bosses have to book their own rental cars, and do their own visa applications? Then those bosses aren't very important then

 

[Fergo747]

Rubbis

why should an EA know dob of their boss?

Fair enough they might not know it now, but my point was that it's not that hard to access the account without needing to receive an SMS on the registered mobile. Given these EA's (and others) now know the information required, they can get what is necessary to be able to access the account. Simples.

 

[odysseus]

Exactly- the technology works tremendously well and has done for quite sometime.

IF you always carry a phone with you AND only have one phone (or carry all of them).

For many use cases it doesn't.

 

[cwd]

Given that sharing your PIN with someone else is against the T&C of the program, I'm not sure what the issue is. Your DOB is at least something you're not forbidden from sharing. I'm surprised there are so many people here openly admitting to giving away information they've agreed not to.

I'm also not sure why you'd want to give someone else access to your QFF account. Would you give an EA access to your bank account too? Surely your QFF number is sufficient for these purposes? Personally, I wouldn't give my employer access to my account.