2-Step Verification Required

[kgc]

I think the point was to force a manual registration to handle the issue "because we encountered a run of domain theft from international IPs, in which the attackers compromised a number of customer accounts, registered a slew of domains, and immediately started using them for phishing operations."

That's mostly correct although I'm surprised it was shared with you. MFA had, however, been on our roadmap for a while anyway and we felt that it had reached a point of general acceptance that allowed us to just go ahead and flip the switch to turn it on. There has been very little negative feedback and few related customer support issues with thousands of unique customers a day just adapting to the change.

[ngufra]

That's mostly correct although I'm surprised it was shared with you.

Talk to Brandon.

[sia]

What I would expect from Sonic would be an email notification of the new 2-Step verification requirement.

Even if there was no time to provide a phased roll-out, proactive email notification would allow customers to establish 2FA at their convenience, and hopefully avoid situations when access is attempted after hours, when support is unavailable to setup 2FA.

When you first learn that you're locked out when you need to do something does not provide for a great experience; worse if you cannot resolve it quickly.

Finally, in many cases, using email as a last resort/single use fallback 2FA mechanism is not a bad option (if it's handled elsewhere, i.e. not at Sonic with same password). Curiously I found a number of phishing emails with links attempting to impersonate Sonic Member Tools site in my @sonic.net mailbox.

In general I do enjoy Sonic's support; this felt more like Comcast or AT&T at least hold time was short and 2FA reset procedure smooth.