Sometimes, a little knowledge can be a dangerous thing…as in not quite understanding the true meaning of situations, policies, or phrases.
This certainly can be a factor in war, higher education, foreign policy, and, most recently, on the presidential campaign trail. And it’s also, sometimes, an issue in Internet security.
In an industry dominated by high tech concepts and more than its fair share of acronyms, people sometimes become confused. And sometimes, you don’t even need acronyms.
This week, hot on the heels of a wildly unpopular change to their reward travel program – along with several other American carriers – United Airlines changed from a miles-based “frequent flyer” program to a dollar-based “loyalty” program, thus incensing frequent flyers who would now be getting dramatically fewer points per flight – United notified their MileagePlus members that the program will now be utilizing two-factor authentication (2FA) to “increase user’s security.”
Not a bad idea, at least in principle. Cybercrime is running rampant, breaches are a seemingly daily occurrence, and identity theft is skyrocketing. If a company can protect its customers from data and identity theft, well, sure, bring it on!
The airline said that members who contact them by phone from a non-recognized number would no longer be able to use their PIN and would instead be asked for their password or to answer two security questions.
Now two-factor authentication adds a second layer of authentication to the login process to, in essence, make extra sure that you are who you claim you are. Generally, the process uses two out of three types of data: something you know, as in a username, a password or a PIN (that’s one factor) along with an extra step (the second factor), either utilizing who you are – via a fingerprint reader, a face scan or a voice print, or something you have, like an ATM card, a smartphone, or a number-generating fob.
So what United is proposing isn’t two-factor authentication. It’s sort of pretending to be, but without any of the, well, extra security that comes with actual 2FA.
The @united twitter account lit up as savvy MileagePlus customers informed them, in large numbers and in no uncertain terms, that while 2FA is actually a very good idea, what they were doing was not, actually, 2FA at all. Customers rightly stated that providing a password over the phone is generally NOT a best practice and could very well undermine customer’s data security, NOT improve it.
Generally, they were rather more impolite.
We’ll share one tweet, because it’s quite cuttingly on point:
Perhaps the lesson here is next time, learn your security concepts (and security terms) before you change your program’s security policies…
