Constant need to "verify" devices

[Amethyst]

Oh, dear. That is not a happy song!

For some reason Lucky Man by ELP popped into my head.

 

[Amethyst]

Intuitively, that sounds like it could be the problem. You are so darned smart.

Are you able to use the laptop twice in a row if you don't use the smartphone in between? It may be that these sites are storing device info on the server side as well as on your devices and they can only handle one authenticated device per user, so that when you switch to the smartphone you're erasing the stored info about the laptop. I am not having these types of problems, but I generally use apps on my phone rather than accessing an institution's website via a browser.

 

[target2019]

My first thought was, "Surrender, Amethyst!"


Many of us develop magical thinking as we're navigating with browsers and apps. We make a lot of guesses while we're adapting, and to our amazement some of our "fixes" work. But our lucky guesses can lead lead to errant assumptions (some IT call this magical thinking), like putting E-R authentication and Vanguard authentication into the same knowledge slot in our minds. Of course they're both authentication, but what happens is much more complex than the simplified picture in our mind.

Cookies are a part of session security, explained here: https://beaglesecurity.com/blog/article/session-security.html

My first guess is that something indeed has changed with session security in general. It always evolves. You've mentioned several devices, OS versions, browsers, and apps, possibly. This is just me, but I would find it necessary to focus on one experience, and learn more about that case to hopefully understand the big mess.

I know that my experience is just like yours, and it sounds like most have the same "problem." There are many variables, settings and security layers here and there that can impact the authentication. Ultimately the session can be destroyed by "them" in all cases and then we have to authenticate each time.

I will be very interested to hear how this is solved.

 

[mpeirce]

If you are referring to E-R.org, be sure to check the "Remember me" box when logging in.

Thanks, that did the trick.

 

[Aerides]

I find some sites do this more than others, but few are an issue. In particular, I've been logging into Florida BCBS frequently lately and have no issues with Chrome, but I was getting a lot of stupid "how many traffic lights" captchas lately, in Edge That seems to have stopped.

Fidelity CC asks Auth q's too often for my liking, and won't "remember" but Fidelity investments never asks me for anything besides to log in.

I do Remember most everywhere on my home PC, and rarely go to anything secure or detailed on a mobile-anything.

 

[marko]

However, I also double and triple check that all faucets are off, that the toilet valve has shut-off completely after refilling the tank, the toilet lid is closed (I have a cat and have a fear she will get stuck in the toilet and be unable to get out), all windows are closed, and my cat is breathing and OK, every time I leave the house.

It's best to be sure

OMG I thought I was alone. How many times have I turned around at the end of the street to come back, make sure the stove is off (one time it WAS left on!!), that I've indeed locked the doors and the garage door is closed. Oh, and the electric blanket is off.

I've even sent a neighbor over from time to time to do the same sometimes when I wonder 2 or 3 hours later and I'm 40 miles away.

 

[Amethyst]

I got very like this when I moved out on my own, and still get this way with any major change, such as a move, or things that cause anxiety, such as a major medical/dental procedure.

I hate this, and got so fed up with myself, that I developed a mental checklist to run through before leaving the house. Figured that if Blind people can memorize an entire house and everything in it, the grocery store, etc. (I worked with a Blind lady whose memory was amazing), I can ask myself to memorize the things that need to be turned off, closed, etc. when leaving the house.

OMG I thought I was alone. How many times have I turned around at the end of the street to come back, make sure the stove is off (one time it WAS left on!!), that I've indeed locked the doors and the garage door is closed. Oh, and the electric blanket is off.

I've even sent a neighbor over from time to time to do the same sometimes when I wonder 2 or 3 hours later and I'm 40 miles away.

 

[Gumby]

We have a written checklist for when we leave on vacation - it reminds us to do things like stop the mail, arrange for plant watering and cat care, etc., then addresses the last minute stuff like packing passports, tickets, maps, guides etc., turning everything off and locking up. We have a separate one for going to the cottage in Maine every summer, so we remember what to bring with us. I have a good memory, but a written checklist prevents mistakes. It's a practice I learned as a submariner.

 

[Time2]

I never verify a device. I act as if my personal devices are public ones, and go through the whole verification process each time. However, I also double and triple check that all faucets are off, that the toilet valve has shut-off completely after refilling the tank, the toilet lid is closed (I have a cat and have a fear she will get stuck in the toilet and be unable to get out), all windows are closed, and my cat is breathing and OK, every time I leave the house.

It's best to be sure

Did you remember to burp the goldfish?

 

[Sunset]

We have a written checklist for when we leave on vacation - it reminds us to do things like stop the mail, arrange for plant watering and cat care, etc., then addresses the last minute stuff like packing passports, tickets, maps, guides etc., turning everything off and locking up. We have a separate one for going to the cottage in Maine every summer, so we remember what to bring with us. I have a good memory, but a written checklist prevents mistakes. It's a practice I learned as a submariner.

I also use a written checklist when leaving for vacation.

Every since I went on a 2 week vacation and left the front door OPEN, and even made a snide remark to my wife how a neighbor had left his garage door open as we drove by...

Lucky for me, neighbors after 2 days went into the house as a group, expecting to see dead bodies, and closed the door on their way out.

 

[cathy63]

I also use a written checklist when leaving for vacation.

Every since I went on a 2 week vacation and left the front door OPEN, and even made a snide remark to my wife how a neighbor had left his garage door open as we drove by...

Lucky for me, neighbors after 2 days went into the house as a group, expecting to see dead bodies, and closed the door on their way out.

LOL! Our checklist was developed after we drove 9 hrs to MIL's house, planning to pick her up and set off on a 3-week road trip that would take us to BIL's house in Canada. We realized about an hour before we got to MIL's that we had never even thought to pack our passports. The last minute airline ticket for me to fly home and then back the next morning was an expensive lesson on the value of written checklists, so we have one now.

 

[Major Tom]

OMG I thought I was alone. How many times have I turned around at the end of the street to come back, make sure the stove is off (one time it WAS left on!!), that I've indeed locked the doors and the garage door is closed. Oh, and the electric blanket is off.

I've even sent a neighbor over from time to time to do the same sometimes when I wonder 2 or 3 hours later and I'm 40 miles away.

Sometimes, I wonder if my behavior is becoming problematic. I don't think it qualifies as clinically OCD though. Sometimes, I'll be about to check something for a 3rd time. I'll stop myself, pause, remember what it looked like when I checked it last, and decide to trust my memory, which is always correct. At the level that you and I are at, I think we can contain our behavior by exercising some mental discipline. If not, then we're both in trouble

Did you remember to burp the goldfish?

I don't have a goldfish but now you mention it, I wonder if it's possible to burp a cat?

With apologies to Amethyst, as I know my first post in this thread didn't address her concern, and represented a thread drift. Like we've never done that sort of thing here before

 

[MichaelB]

Sometimes, I wonder if my behavior is becoming problematic. I don't think it qualifies as clinically OCD though. Sometimes, I'll be about to check something for a 3rd time. I'll stop myself, pause, remember what it looked like when I checked it last, and decide to trust my memory, which is always correct. At the level that you and I are at, I think we can contain our behavior by exercising some mental discipline. If not, then we're both in trouble



I don't have a goldfish but now you mention it, I wonder if it's possible to burp a cat?

With apologies to Amethyst, as I know my first post in this thread didn't address her concern, and represented a thread drift. Like we've never done that sort of thing here before

Don’t worry, OCD and posting off topic causing thread drift are not compatible. It’s one or the other

 

[jollystomper]

I manage my browser (Firefox) cookies for desired websites so I rarely run into this. We access our financial accounts from just 2 computers (95% desktop, 5% laptop) that are on 24x7, so the verification sticks (or for as long as the server side authentication period). I only have to re-verify if I reboot the system.

 

[target2019]

A browser update can also upset the trust which exists in a cookie or other token.

 

[frayne]

I only log on to financial websites from my home desktop computer and never on a public or any of my mobile devices, call it paranoia or whatever you like. I do think double and triple checking items is not only indicative of OCD and/or being a bit anal retentive but an affliction most engineering types suffer from. How many of you have left home and got a block away and then turned around and drive by to double check they shut the garage door ? I do this at least once a month.

 

[John Galt III]

One of the websites I go to sends a 'security code' to my mobile phone, and wants me to enter it, to log on. It asks me if I want to have the security code remembered for 90 days. Does that mean I have to write the security code down and keep it with me so I don't have to get another text message for 90 days? Use the same security code for 90 days?

 

[jollystomper]

One of the websites I go to sends a 'security code' to my mobile phone, and wants me to enter it, to log on. It asks me if I want to have the security code remembered for 90 days. Does that mean I have to write the security code down and keep it with me so I don't have to get another text message for 90 days? Use the same security code for 90 days?

This has happened to me. In my case I have been able to log in from my browser without requiring a security code to be sent for 90 days - the code is "saved" in a browser cookie. After 90 days has passed (or it I choose to delete the cookies from that website) it will send a new security code that I will have to use to login.

 

[PatrickA5]

My local bank has a "secret word" that I have to find from a list each time I log in. Below the list is a box to check for the word picked to be "remembered" on this device. I call it the "idiot box" because every time I click on it I feel like an idiot for believing it will actually work.

 

[tb001]

Sometimes, I wonder if my behavior is becoming problematic. I don't think it qualifies as clinically OCD though. Sometimes, I'll be about to check something for a 3rd time. I'll stop myself, pause, remember what it looked like when I checked it last, and decide to trust my memory, which is always correct. At the level that you and I are at, I think we can contain our behavior by exercising some mental discipline. If not, then we're both in trouble



I don't have a goldfish but now you mention it, I wonder if it's possible to burp a cat?

With apologies to Amethyst, as I know my first post in this thread didn't address her concern, and represented a thread drift. Like we've never done that sort of thing here before

Fwiw, and even more off topic, technology can address most of those things. Automatic shut offs, leak detection, etc…

 

[Amethyst]

Pilots have checklists (nobody likes it when they turn the plane around to make sure the technicians didn't leave the gas cap open).

I have a checklist.

Why wouldn't engineers have checklists?

I only log on to financial websites from my home desktop computer and never on a public or any of my mobile devices, call it paranoia or whatever you like. I do think double and triple checking items is not only indicative of OCD and/or being a bit anal retentive but an affliction most engineering types suffer from. How many of you have left home and got a block away and then turned around and drive by to double check they shut the garage door ? I do this at least once a month.

 

[Lsbcal]

Recently Vanguard has been requiring me to put in the SMS code every time I login via my PC. This happens even if I choose "Yes, I plan to log in from this device in the future" and even though I have security required only if from another device. If I logout and then immediately login, no SMS code required.

I have an email into Vanguard to ask about the sudden SMS requirement but no response so far.

But if I use the Vanguard app on my iPhone it uses FaceID without the SMS requirement.

 

[RobbieB]

For some reason Lucky Man by ELP popped into my head.

I don't.

My BofA doesn't ask me, Fidelity doesn't ask me and I have to call the guy at Merrill Lynch.

I dunno. Maybe you sign on from many different devices?

 

[Car-Guy]

Trouble is, the verification doesn't stick. When the site says "Your device is verified for the next three months," it's a lie.

It has gotten to where I am answering the phone or checking email (particularly annoying on the smartphone) for these sites every day - even when I just verified the device the previous day.

Am I the only one?

It's certainly happening more often these days but only with some sites/accounts... Most sites I never see the extra verification step, some I get challenged about once a month, others I get challenged every time I log on... I'll usually use email verification since my email is always open in another window. No big deal, IMO....

Examples:
My primary brokerage account NEVER ask for the extra step
My primary bank wants the extra verification step once a month
My 401k institution requires the extra step every time I log on, even when I click the box to remember this PC.

Another general change in the authentication process that I've noticed, I seldom get the notice to change my password anymore.... In the past it seemed like I'd get that message about every 6 months for many accounts... Now, never..

 

[Amethyst]

Extra verification doesn't bother me; I know it's necessary these days.

It does bother me when a web site says "Your device is verified for the next four months" and it isn't even good for one day.

I don't consider this a user flaw. I consider it a design flaw on the part of whoever designed that web site. Now, if I were using some unusual device-browser-firewall combo, then I wouldn't blame the designers if their security protocol wasn't compatible. But I'm using up-to-date vanilla stuff.