QFF Inaccessible from Overseas?

[bPeteb]

The reliance on SMS for 2FA demonstrates a lack of understanding of the technology. There is also the assumption that ALL users of their service have full time access to a mobile device capable of accepting SMS messages.

I have to laugh (sadly). I’ve been to more than one meeting where I’ve tried to explain that not everyone has a mobile when 2FA is being pushed as the security saviour of the universe... I may or may not work for a large company that should know that is not true at all

 

[moa999]

not everyone has a mobile when 2FA is being pushed as the security saviour

Remember however that the OP had failed the secret questions as well, this was just another option.
And for 99% of the population a SMS is easier than a token generator or scratch cards

 

[AustraliaPoochie]

If you have not setup security questions, and answers, it also won't work.

 

[calmelb]

If you have not setup security questions, and answers, it also won't work.

The security questions are set regardless of whether you choose or not. Date of Birth, Postcode, and membership join date are all known.

And for 99% of the population a SMS is easier than a token generator or scratch cards

Most of the population doesn't know what a token generator is

 

[AustraliaPoochie]

My 3 questions were:
A.pick a word
B.pick a word (another word)
C.first street you lived in as a child
None of them worked.
My first 3 tries had lag times before sms came through, so went out to dinner in AKL city.
4th try worked, and the coocoo tone was fast after request.
Because of the lag times, I missed my picked window seat on OLCI on the A330.

 

[calmelb]

My 3 questions were:
A.pick a word
B.pick a word (another word)
C.first street you lived in as a child
None of them worked.
My first 3 tries had lag times before sms came through, so went out to dinner in AKL city.
4th try worked, and the coocoo tone was fast after request.
Because of the lag times, I missed my picked window seat on OLCI on the A330.

For logging into QFFF? That's not how I've seen it for 3 separate accounts. Also if you need them changed just ring QF to fix that.

Also for OLCI you don't need to log in, just the booking reference, so could've worked around this issue.

 

[AustraliaPoochie]

If you are overseas and try to use Smart phone, you will come to a brick wall, no way to get into QFF except with sms 2fa or secret question.
Haven't set up properly security questions, and answers to them.
But pick words and home address when I was a child were definitely questions asked.
I don't take my laptop overseas.
Have 2 Android phones, take them both, one to get calls and sms, one to log into websites.
Always have done this, for 6 years since 2013.
Next time I travel o/seas, I will wait for QF sms 2fa, to log in, ((if I choose to fly QFi again)).

 

[calmelb]

If you are overseas and try to use Smart phone, you will come to a brick wall, no way to get into QFF except with sms 2fa or secret question.
Haven't set up properly security questions, and answers to them.
But pick words and home address when I was a child were definitely questions asked.
I don't take my laptop overseas.
Have 2 Android phones, take them both, one to get calls and sms, one to log into websites.
Always have done this, for 6 years since 2013.
Next time I travel o/seas, I will wait for QF sms 2fa, to log in, ((if I choose to fly QFi again)).

You can still go to Manage my Booking on mobile without having to log into your QFF account, and it seems strange that your secret questions are things like these (though maybe reset those so you can use them next time)

 

[Kiwi_Flyer]

2FA has recently been switched on for me. Until the last week I was able to log in with pin.

When I tried the non-SMS option it had a compulsory security question to which I hadn't set up any answer, in addition to date of joining, date of birth, and postcode.

Logged in with SMS option to set up answer for the compulsory security question and like AustralianPoochie the options for questions were somewhat odd and perhaps difficult to remember.

examples included:

pick a word
what is the surname of your favourite third grade teacher?
what is your grandmother's mother's maiden name?

 

[calmelb]

2FA has recently been switched on for me. Until the last week I was able to log in with pin.

When I tried the non-SMS option it had a compulsory security question to which I hadn't set up any answer, in addition to date of joining, date of birth, and postcode.

Logged in with SMS option to set up answer for the compulsory security question and like AustralianPoochie the options for questions were somewhat odd and perhaps difficult to remember.

examples included:

pick a word
what is the surname of your favourite third grade teacher?
what is your grandmother's mother's maiden name?

Hmm interesting. Maybe it was the date I joined that led to having the mother’s maiden name preset as a question. Who really knows with QF what is going on though

 

[AustraliaPoochie]

In a way though, come to think of it, if it makes it harder for scammers all the better.
Granted a lot don't like 2fa.

 

[Seat0B]

This thread has been making me nervous, as I also travel without access to my Australian phone no, so I just did an experiment. I logged in, got 2FA (randomly, I don't get it every time), selected "verify another way" even though they sent the code to my mobile phone.

This took me to the questions mentioned by many posters above: DOB, when you joined FF, mother's maiden name and postcode. I had not set these up before, so I filled in answers. From there I went to my profile, and clicked security questions, which I had also not previously set up. This is where the questions got ridiculous and were the ones mentioned above eg maternal grandmother's maiden name, name of your favourite 3rd grade teacher, full name of your oldest cousin etc. Now I feel even more confused as I am not sure why there are 2 sets of security questions and when each of them is to be used.

 

[calmelb]

This thread has been making me nervous, as I also travel without access to my Australian phone no, so I just did an experiment. I logged in, got 2FA (randomly, I don't get it every time), selected "verify another way" even though they sent the code to my mobile phone.

This took me to the questions mentioned by many posters above: DOB, when you joined FF, mother's maiden name and postcode. I had not set these up before, so I filled in answers. From there I went to my profile, and clicked security questions, which I had also not previously set up. This is where the questions got ridiculous and were the ones mentioned above eg maternal grandmother's maiden name, name of your favourite 3rd grade teacher, full name of your oldest cousin etc. Now I feel even more confused as I am not sure why there are 2 sets of security questions and when each of them is to be used.

I think those other security questions are designed to be more difficult to guess. Mother’s maiden name and dob are pretty easy to get. I think some of my friends could easily get that info

 

[Himeno]

Any company that insists on "security questions" should allow the user to enter their own questions and not require the use of limited preset questions, many of which often don't have any answer to provide.

 

[codash1099]

When I try to enter the security question answers, I see this in both Chrome and IE.:


I cannot see the full question, so I'm only guessing when I provide the answers.

 

[Kiwi_Flyer]

Any company that insists on "security questions" should allow the user to enter their own questions and not require the use of limited preset questions, many of which often don't have any answer to provide.

There is nothing stopping you providing something else as the answer. Just need to remember what you provided.

 

[AustraliaPoochie]

Have you tried "ctrl -" to make the wordings smaller?
Reminds me, I should also go into my QFF and do my "requirement deed".

 

[AustraliaPoochie]

In the past, I only needed QTMC 2fa, when I try to log in there.
Where I try to log into QFF, in the past just QFF #, surname, and pin code, now going into QFF also needs QF 2fa.
On the more modern phones, you can set up harassment filter, ie, numbers from our friends at the Aust NBN network, or the Indian car accident helpline
I must have activated harassment filter, as I tried to go into my QFF account, and no cuckoo noise, it was there yesterday, when I came back from Auckland.
Under 124356789, there are 3 horizontal lines, up comes, speed dial, call log, harassment filter, so if no sms, check and see if the harassment filter picks up it as a scam.
My 6 digit code was there.
Went to QFF, logged in, and changed the 3 questions, you can pick by using the mouse, there are 6 per each question, so a combo, 6x3 of 18 variables, that a scammer has to try.
You don't have to make any sense, so long as you have written down the question, and the answer you want.
It accepts all numerics for my answers.
Ok, so that is now done, for me.

 

[Seat0B]

When I try to enter the security question answers, I see this in both Chrome and IE.:

View attachment 200976
I cannot see the full question, so I'm only guessing when I provide the answers.

I hope I’m not telling you how to suck eggs here, but did you try clicking on the drop down arrow beside the question? That gave me the full text plus all the question options.

 

[codash1099]

I hope I’m not telling you how to suck eggs here, but did you try clicking on the drop down arrow beside the question? That gave me the full text plus all the question options.

I definitely know how to suck eggs.