2-Step Verification Required

[forest]

I just tried to log in to Member Tools, and was blocked by a 2-Step Verification Required message.

Using 2FA doesn't bother me, but geez, Sonic... couldn't you have announced this requirement in advance? That would have allowed me to set it up before I needed it.

Instead, this was imposed as a surprise, and now I find myself needing to manage my account but can't until I get to a phone and reach a support agent. Not a very nice surprise.

[ngufra]

I called 611, gave my name and service address, was sent a code by email that i read to them.
provided my cell phone number, then logged in and specified to send me a code on that cell number.
Would have been nice to send me the code to the email and avoid having to call but it worked.

Then in account settings/security i could enroll an authenticator app.
Total time about 5 minutes.

[brandonc]

I just tried to log in to Member Tools, and was blocked by a 2-Step Verification Required message.

Using 2FA doesn't bother me, but geez, Sonic... couldn't you have announced this requirement in advance? That would have allowed me to set it up before I needed it.

Instead, this was imposed as a surprise, and now I find myself needing to manage my account but can't until I get to a phone and reach a support agent. Not a very nice surprise.

I apologize for the lack of notice regarding this change. Ideally, we would have sent out a notification with plenty of advance notice. However, In this case, we were forced to move quickly because we encountered a run of domain theft from international IPs, in which the attackers compromised a number of customer accounts, registered a slew of domains, and immediately started using them for phishing operations. Thankfully, this appears to have stopped the attackers, but there has been some collateral damage.

[forest]

Thanks for explaining, Brandon.

BTW, after getting to a place where I could phone in, and going through the verification steps to set up my accounts, I was pleased to find that Member Tools offers standard TOTP as an option for the second factor. Good choice. :)

[superd]

How do we opt-out of this?

[sonic.boom]

Due to security concerns, the 2-factor authentication is now required to access Member Tools so there's no option to opt out. If you need assistance with setting up your 2FA, please contact our Technical Support team at (855)394-0100. If there are wait times, you can also go to https://www.sonic.com/support_cba_request and request a call back.

[mball]

I HAD a few minutes to change an alias.
Now the only person who cannot is me.

What irks me about 2FA is that I'm required to pay a telecom company in order to get service from a [theoretically unrelated] company who I also pay.

[ngufra]

What irks me about 2FA is that I'm required to pay a telecom company in order to get service from a [theoretically unrelated] company who I also pay.

Only the first time.
Then you can use google authenticator for example instead of a SMS.

[superd]

I called 611, gave my name and service address, was sent a code by email that i read to them.
provided my cell phone number, then logged in and specified to send me a code on that cell number.

So, they used a compromised email address to send a verification code? Sounds legit.

Anyways, I'm probably done with Sonic. Apple has been trying to force me into 2FA for about two years, but at least they give me the OPTION to refuse something I neither want or need. Between this, the internet line that is slowly getting worse every year, forced equipment rental charge, and the insane amount I pay ($81 for a barely 5mbs connection that seems to randomly cut out), I'm out. I've been a customer for over 20 years, but my Xfinity connection is now better and cheaper.

[ngufra]

I called 611, gave my name and service address, was sent a code by email that i read to them.
provided my cell phone number, then logged in and specified to send me a code on that cell number.

So, they used a compromised email address to send a verification code? Sounds legit.

I called 611, so i was calling from within sonic network. They emailed at the registered email address. Maybe the workflow is different if calling from an unknown number.

I think the point was to force a manual registration to handle the issue "because we encountered a run of domain theft from international IPs, in which the attackers compromised a number of customer accounts, registered a slew of domains, and immediately started using them for phishing operations."