MFA

[BertieLuckyBird]

Good day

Maybe im just not looking hard enough but it seems to be that the only option for MFA at the moment is via an SMS message. I would like to use a FIDO2 security key or at least an authenticator app but I cannot seem to see an option to configure this. Im not comfortable with SMS being the only option as SMS messages aren’t encrypted.  Can someone confirm if I am simply not looking in the right place to en roll a different method of MFA?

Thanks

[Chris_B · Accepted solution]

@BertieLuckyBird  There is no option for those they why you cannot find it.    You can use passkeys though.    But you’ll need to setup first with SMS 

[BertieLuckyBird]

Thanks Chris_B for a quick response. Do you know if there is a method to suggest features to EE as I think SMS being the only option is a bit of a glaring risk in terms of security of customer accounts. I know having MFA is better than not having it but there should be stronger options available to customers.

I did start having a look at Passkeys and they work well with a password manager that can save passkeys. Just need to ensure that you turn off autofill/auto confirm or you'll miss the 'Sign in with Passkey' option. One thing that would be nice is native support for FIDO2 security keys to store your EE passkey. EE seems to leverage Windows Hello for this currently which obviously is not a feature on all devices you might use to access to EE portal.

[Northerner]

Hi @BertieLuckyBird 

I have suggested better security for 10 years and as @Chris_B has said EE only implemented this over the last 12/24 months which is better than nothing but still not that great. 

You cannot use an authenticator app so it is unlikely a FID02 key will be considered any time soon. 

Thanks 

[Chris_B]

@BertieLuckyBird  If you search these forums there’s a long thread about this.    It’s been awhile since I’ve seen anything added to it so it’ll be a search to find it.   The problem with an authenticator app is that you are then forcing people to install an app on their device to use it to login,  If you already use such app it’s not an issue, yes you don’t need to use one if you don’t want  even if the option becomes available but everyone wants security but not at the expense of being required to install a 3rd party app.

There’s a few security issues I want to see addressed like the option to switch off PAC porting.    To many people not just on EE but all networks have had fraudulent sim swap happen and this then becomes a huge problem as it can effect you financially until the issue is resolved.   

[BertieLuckyBird]

Thanks both for the responses. Sounds like it may be a waiting game then. I definitely think there should at least be an option to use an authenticator app. If people want to use SMS, they still can. Fraudulent SIM Swaps are a massive problem and I keep hearing more and more about it. I hope EE will not be 10 years behind on starting to tackle that.

Anyways, I got an answer to my question so thank you very much.