Account Security

[walkerx]

why does the ee system make it so hard for someone to update passkeys, after being enforced on your account and passkeys not being synced across devices causing problems

What is the point of forcing this if they are just going to send code via sms anyway to do what you want

SMS is insecure, so is email for sending codes, so why not allow users to fallback to password and use a 2FA app.

[Northerner]

Hi @walkerx 

Passkey works fine on my device. I use my phone to log in. 

You only tend to receive a text if you're using a VPN from my experience or abroad.

Thanks 

[walkerx]

It's absolutely rubbish if you use multiple systems

ie: I've just logged in my computer using my passkey, it then wants to send me a passcode via sms which is valid for 20 minutes.

This is a poor implementation of the system. I've used my passkey I shouldn't then need to have my mobile with me to receive a passcode just to then finally login to the website, it defeats the object of using passkeys.

EE have made it more convoluted than what it should be

Not only that both SMS and EMAIL are not secure ways of getting 2FA that is why it is recommended to use passkeys as it emliminates the use of these. Even Microsoft no longer use SMS for authenication if passkeys are setup. So why is EE using passkeys with insecure methods for account security

[Chris_B]

I sometimes only have to use the passkey and others it’s the passkey and then the text.   Yes texts are not secure, but you’re using the passkey first so even without using the passkey you ain’t gonna get the text so it’s still secure as you have to passkey first.    
I notice it does improve until I wipe out my IP addresses via my account profile on here then it’s passkey and text for a while then it’s just the passkey.