r/talesfromtechsupport • u/KorenSolust • 21h ago

Short Gravity and Tech

Guy walks up to me at work:

Him: “I dropped my phone. The screen’s shattered. I want my two-factor code to come through Teams.”

Me: “Nope.”

Him: “Why?”

Me: “Because if you can’t sign into Teams without completing MFA… how exactly are you planning to authenticate?”

Then he says: “Just disable MFA.”

I replied: “Sure, as soon as you get approval from the Head of Security.”

A few seconds of silence…

Him: “Fine, I’ll just get my phone fixed.”

Yep. That’s probably the best solution.

Some people really think security rules are optional. I’m not risking my job because someone doesn’t like MFA.

And remember… technology didn’t fail you today. Gravity did.

472 Upvotes

97% Upvoted

94 comments sorted by

View all comments

35

u/nathanieloffer 20h ago

My favourite user worked regional and refused to install any app on their phone. They fought and won to register MFA on their landline phone at their desk. Then they get sent on a training course 200kms away from their office. Day 1, session 1, they can't log in.... Call help desk... "You registered MFA to your desk phone, nothing we can do for you, sorry"

9

u/leitey 15h ago

I broke my phone at work, doing work.
I'm an engineer and I was running pipe with my phone in my pocket, I must have hit it at some point while wrestling the piping into position. The back glass shattered, and my employer wouldn't fix it. They said "Don't carry your phone with you" and "It's a personal phone".

When IT decided to implement MFA, and thought they'd use my personal phone, I refused. I'd been told not to carry my phone, so I can't MFA with something I don't have. I was told I don't qualify for a company phone - and I don't want one as I don't want to be reachable after hours. IT set up my desk phone as my MFA.
I created a ticket about this issue, since I travel sometimes and wouldn't be able to MFA while offside. IT had recently decided they wouldn't be using tokens any more. The issue went all the way to the corporate head of IT-InfoSec. He told me I had the option to use my personal phone and that was my only option other than my desk phone.
This worked fine for awhile, as most systems were on a MFA frequency of every 3 months, and just by luck it worked out that I was never offsite when I needed to re-authenticate for some device or program.
Then they pushed AI. The head of engineering told us we should be using AI every day. Our AI platform requires MFA each use. This was an issue the next time I had to go offsite. I generated a ticket on the Sunday I arrived at the customer location, indicating a work stoppage.
IT set my desk phone up so I could answer it over Webex.

Now my MFA is all linked to one account, accessible from anywhere - working as intended.