Multi-factor authentication on TfL journey history portal

[Edvid]

TfL have updated their Oyster/contactless portal to work with authenticator apps during the login process.

Anyone who logs in now will get an SMS as usual then on entering the code have the option to use an authenticator app for MFA, after which it becomes the default method.

 

[Adam Williams]

Excellent, only 15 years after TOTP was standardised.

Can we expect U2F/Passkey support in 2037 based on TfL's attitudes and approach towards information security?

 

[Blaine]

Let's hope they get rid of the extra screen they load up and make you acknowledge that says you've passed security - just take me to my account!

 

[MikeWh]

Let's hope they get rid of the extra screen they load up and make you acknowledge that says you've passed security - just take me to my account!

They have already.

 

[edwin_m]

What's the level of risk here? There are other operators where accessing journey history only requires a simple login or just entering the card details.

 

[davews]

TFL now sending out emails to notify us about the change. I tend not to like these two factor authentication schemes where it is left to you to choose which app to use without even recommending one. I assume it will remain optional and hopefully we won't be nagged every time we log in. Like edwin_m it seems very much over the top, even the existing two factor seems unnecessary for this sort of website.

 

[Hadders]

Like edwin_m it seems very much over the top, even the existing two factor seems unnecessary for this sort of website.

I'd like a website that stores your personal details like name, address, date of birth and your bank card details, and was subjected to a massive cyber attack a couple of years ago to have a high level of security.

 

[Richardr]

T

I tend not to like these two factor authentication schemes where it is left to you to choose which app to use without even recommending one.

Why on earth would they recommend one? They all work the same. I use one that is part of the password manager I use (Proton Pass).

 

[Haywain]

I'd like a website that stores your personal details like name, address, date of birth and your bank card details, and was subjected to a massive cyber attack a couple of years ago to have a high level of security.

There are many such websites that are easier to get into than TfL's, and haven't suffered cyber attack meltdowns.