2 Factor Authentication issues

dosh37

dosh37 said:

I have been experiencing similar problems with Lloyds two factor authentication when using a DECT phone over a landline.

On my landline, keying in the 4 digit code provided on screen often fails to work. I know the key presses are being registered as the phone gives an audible beep on each key press. I also know that the code entered is correct as the digits show up on the handset.

The alternative speech recognition system that supposedly allows you to say the 4 digits does not work well on noisy lines. That also fails.

I have had this problem several times over the last few weeks. If I use a smartphone then I don't have the same issue.

In theory, using a landline should be more secure than a mobile since they are not subject to SIM swapping scams.

I have only found this a problem with Lloyds. The systems on other online banks I use work fine.

A number of other banks / building societies operate two factor authentication the other way round. They send a code via voice or text that you then enter on the PC being used for online banking. That seems much more reliable than displaying an authentication code on the PC and getting the user to enter that on the phone.

I tried to call Lloyds to complain but was unable to get through their awful automated customer service system to speak to anyone.

This is a follow up to my issue with Lloyds two factor authentication:-

I had the same problem this morning. Entering the code presented on a PC screen fails when using a DECT phone with Vonage VOIP. If I use a mobile phone, then it works as expected.

I called Lloyds and explained the problem to two different advisors. They were both clueless.

Then I discovered this article on how the DTMF tones generated when you press keys on a DECT phone are transmitted over VOIP:-

https://www.voipmechanic.com/dtmf-issues.htm

====

VoIP & Issues with DTMF

DTMF (Dual Tone Multi-frequency) are signals/tones that are sent when you press a telephone's touch keys.  These tones (or data signals) are used to access voicemail (passwords) and navigate IVRs or attendants for large companies like banks.  At times you may find that the far end will not recognize or react correctly to the input you made from your phone.  These problems are typically DTMF issues.

There are several ways these tones are sent and depending on your connection may vary between one or another.  Typically with VoIP DMTF tones are delivered either in-band (as a beep) or out-of-band via SIP or RTP signaling messages.  Some  types of delivery options are:

• Inband-  With Inband digits are passed along just like the rest of your voice as normal audio tones with no special coding or markers using the same codec as your voice does and are generated by your phone. 
• rfc2833-  (Preferred setting in most cases)  Is a standards based way to define signaling for various events including DTMF tones, fax-related tones and country-specific subscriber line tones.
• Info-  SIP signaling will negotiate preferences with the other end to help establish the call's parameters.  The choices can then be set for what to send (outbound) and what want to receive (inbound).  Only available with SIP channels and is transmitted through a SIP message.
• Auto-  Uses rfc2833 by default, but will switch to inband DTMF tones if the remote side does not indicate support of rfc2833.

====

The use of out-of-band signalling for transmitting the DTMF tones from the keypad could acount for the problem.

I have emailed Vonage to ask how their system is configured. Watch this space.