Geeks2U Promise
We guarantee you'll love our fast, friendly service - or we'll refund your money.  
133,572 Happy Customers & Counting
Need tech support?
1300 769 448
Extended hours, 7 days a week
Home  /  geekspeak  /  Telstra outage shows a weakness in two factor authentication

Telstra outage shows a weakness in two factor authentication

Telstra recently suffered an outage in its network thanks to an unexpected fire in one of its exchanges located in Chatswood, New South Wales. For a couple of hours, and mostly (but not exclusively) if you were in NSW and on Telstra’s network, you may have had limited access to calls, mobile data and texts.

That’s annoying, but to pour a little salt into the wound, the erratic status of the network also meant that some text messages, rather than sitting around waiting to be delivered to their intended recipients, went to the wrong numbers entirely. Social media comedy ensued, and Telstra halted texts across the network to sort matters out. Eventually, normality returned to its mobile network.

One of the odd side effects of the outage could have hit you, as it did me, if you were trying to log into any service that requires two factor authentication.

As a quick refresher, two factor authentication logins require two elements for verification for a given online service. The idea is that even if you’ve used a common password, or for that matter inadvertently given your password away, your accounts will still be secure because that second factor acts as an effective second lock for your data, whether that’s an online storage service for your private photos or the contents of your bank account.

Quite commonly, because access to them is near universal, services that require two factor authentication will do so by getting you to log into a service, and then verify your identity by way of a one-time code delivered as an SMS.

In my case, I was setting up a password manager whose vault was stored in an encrypted fashion on a cloud service. For that kind of data, which controls access to all sorts of services I use on a daily basis, the inclusion of two factor authentication is generally a big plus, because I’d rather have that secondary lock.

Except, of course, when the second lock doesn’t actually have a key. To my benefit, the way the SMS key was sent through gave no indication as to what service it was for or any of my own details, so if it was mis-sent to somebody else, it would be merely baffling rather than a way into my accounts. That should be standard for any decent two factor authentication service.

So what can you do in a circumstance where a second factor such as an SMS can’t be procured? It depends on the service. Some will allow other factors to be enrolled, such as biometric fingerprint or iris recognition services, or a message sent to a specific email address, but typically those services do have to be set up in advance.

Most will allow you to tell the service that you can’t access the preferred authentication factor — because, say, you’ve lost your phone or similar — but this typically involves a slower authentication verification process. Again, that’s actually sensible policy, because the last thing you’d want is a miscreant who had conned you out of a password being able to rapidly change the two factor authentication method in use to a method they could easily access. If that happens, the locks that are meant to keep them out could easily keep you out instead.

In my case, while it was less than vital, I made do with accessing my password manager on another device that was already authorised and just painstakingly copying passwords across character by character. Less than ideal, but after a couple of hours wait, with the network back up again, the relevant verification codes came flooding in, and I had access again. Sometimes a little patience can be the best solution.


Recent News

Apple typically holds a launch event in September for its new model iPhones. Whenever those new phones launch is when the new versions of its mobile operating systems launch as well. They all used to be called “iOS”, but this now encompasses iPadOS, watchOS, and tvOS. iOS itself covers phones and iPod Touch only. Usually,

Chromebooks are laptops that use Google’s Chrome browser as the basis for their operating system. We’ve discussed them before but to date most of the models sold in Australia have tended to be low cost models pitched at the education market. As a much more controlled computer there’s less that can go wrong with a

When Apple announced recently that it was going to shift from producing computers using Intel processors to its own “Apple Silicon” it also said that it would still produce some Macs with Intel inside over the next couple of years. That’s just what’s happened with the very first Mac Apple’s released since dropping its Apple

We live in an age where it’s absolutely assumed that the vast majority of your interactions with computers will be with visual interfaces – strictly speaking Graphical User Interfaces if you want to get on the jargon bandwagon – but it certainly wasn’t always that way. To get to the touch, voice and mouse-activated interfaces

Coronavirus (COVID-19) Update

Learn about the precautions we are taking and our new contactless pick-up and remote service options. Read More
Get help setting up your home office or homework area today. Learn More