Comment by warner25 | Hacker News Reader

Comment by warner25 | Hacker News Reader

Even worse than Antarctica might be working in a US DoD "vault" or SCIF. Many of us encountered this problem in recent years as various DoD organizations bought into O365.

For a while, I had to enter a password and then get an SMS authentication code once every 24 hours to login to Teams. The problem is that cleared spaces don't allow any personal devices (there's no cellular service anyway with TEMPEST hardening) and the unclassified (NIPRNet) workstations are usually blocked from connecting to websites like Google Voice and some commercial webmail services. The authentication code would timeout after five minutes, and that didn't always leave enough time to exit building, get to my phone with cellular service somewhere, and then re-enter the building and return to my workstation with the authentication code. If you always worked at the same desk, you could set it up to make a voice call to that desk phone number for authentication, but I didn't always work at the same desk.

My own solution was to use my personal Google Voice number for the authentication code, have Google Voice forward those messages to my personal Gmail inbox, and then have Gmail forward those emails to my official DoD email inbox. (Our official email wasn't yet on O365 and only required our smart cards to login, which later became the method for O365 login, thankfully.)

>my personal Google Voice number for the authentication code

A lot of financial institutions do not allow gv/voip numbers anymore. So, I've had to add one more layer to this, namely forwarding sms from phone to gv, which then goes to email. It looks like there aren't great solutions for forwarding sms to email directly on android, but there is an sms forwarder app on f-droid that works for forwarding to gv.

> It looks like there aren't great solutions for forwarding sms to email directly on android

You can also do this with a Particle board or some other similar embedded device running code on bare metal instead of an Android phone. The advantage being that you won't fall victim to a Java crash or software update, and you can probably set up a watchdog reboot on it.

This seems insane to me. If I were in this situation, I would simply not use Teams if I can't log into it. The only way to get situations like this resolved is for the pain to be felt by someone with the power to change it. Absorbing the pain yourself by working around it is just enabling these things.

Who has the power to change it? How do you make them feel pain? Is this the hill you want to die on? If you can't suffer the asinine 2FA problems while trying to get work done on your glacially slow PC in your 88F office, you will not last long enough to make change. More accurately, you'll probably be able to stick around forever, but without promotions, approbation, or influence.

The answer is to be heroically productive, despite all these ridiculous obstacles, and then to use your reputation to build a base of opposition within your organization from which to fight these problems. If that sounds hard, exhausting, and thankless, then you have your answer for why these things don't get fixed.

>Who has the power to change it?

It doesn't particularly matter who has the power to change it, but it's probably near to the top of the organizational structure.

>How do you make them feel pain?

The way I see it, either:

1. Teams is crucial and not being able to access it easily means eventually things that are important to the people at the top of the organization are missed or take too long. This is the pain you can make them feel. You presumably have your ass covered by raising your issues in writing earlier, so the blame ultimately doesn't rest with you.

or

2. Teams was never important, so not being able to access it easily turns out to not really be that much of an issue for anyone who has any kind of influence.

>you will not last long enough to make change

The person doing this is not trying to make change. Rather, the whole point is to stop insulating decision makers from the consequences of their decisions.

I love your indignation; it validates the way I've felt about various things over the years, so you deserve some explanation of the culture and my thought process:

I'm reminded of the investing maxim that "markets can stay irrational longer than you can stay solvent." I'm a military officer who's not yet senior enough to be vested for retirement benefits, but senior enough to be within striking distance of vesting after 15+ years ("golden handcuffs"). The career model for officers is also "up or out" and every year counts (i.e. one needs to remain within the top 50% of performers who've also devoted the last 15+ years of their lives to this). If it takes the bureaucracy longer than a year to change something stupid, I need to be very thoughtful about what stupid things I choose to protest with disobedience. Furthermore, as someone who works in the IT part of the organization, saying that I can't figure out a way to stay logged into Teams would be an especially bad look. A significant part of my job at the time was helping non-IT people to find solutions for stupid IT problems while advocating for changes to the IT people above me.

Nobody uses Teams voluntarily.

So the DoD deploys IT that some of its users virtually can't login to?

Appart from avalability, at least that's secure :)

It's even worse when you consider the DoD at least have multiple functioning internal PKIs and issue smartcards in the form of the CAC and others to all its users.

I'm sorry, we don't want your fancy crypto, please accept this insecure SMS.

To be fair, I guess it's a product of being an organization of three million people who are globally dispersed, working in every conceivable environment. There are a lot of edge cases. So while smart card login was better for my case, other people worked in situations where username / password and SMS authentication was a dream. At the same time, we want everything to be uniform and interchangeable, because we've seen that patchworks of incompatible solutions can be even worse.

You can use the voice call method of MFA on Teams, send it to a Twilio number, and use a Twilio Studio workflow to automatically pick up and press # a few seconds later to confirm.

(Yes, I've done this.)

Reply on news.ycombinator.com