So recently my work, a mid sized engineering firm, decided to start upgrading their IT security. The rumor is that we have potential DOD work coming our way. Over the past few months there has been multiple company decided changes to our 2 factor authentication mobile app. I willingly installed the app on my phone over a year ago because without it I could no longer use my laptop out of office and couldn’t use Microsoft teams or outlook on my phone.
So about 2 months ago my company updated the 2FA policy and because of that, my phone is no longer compliant on the basis of it being to old. The initial consequences were that I lost access to email and teams on my phone, not a big deal because I prefer not to think about work on my off hours. Fortunately, I could still use a txt message to 2FA into my laptop incase I did need to work from home.
Fast forward to last Friday, our IT director sent out an email saying they were again making changes to the 2FA policy over the weekend. Among other things, the changes included removing the txt 2FA option, meaning I could no longer access anything work related as soon as I step out of my office building. Sounds like a dream right, and a good excuse to fall back on.
Come Monday, I find out that I need to use the 2FA app to access our payroll software to fill out my timesheet, even when I am inside the office sitting at my desk. Luckily, I filled out my previous weeks timesheet on Friday. So next Monday, as far as I’m aware, I will not be able to fill out my timesheet to get paid.
My situation: I will admit I am stubborn about buying new electronics, my phone is a Samsung S8 that I bought in 2017 when it was brand new. I currently see no benefits of anything the new phones have to offer but the day my phone decides to die, I will gladly walk into a store and buy a brand new android phone. My work does not provide cell phones and has refused my request to compensate me for my work related phone usage. I have been very vocal to my manager and bosses that they cannot force me to buy a new phone just to continue doing my job efficiently, and now it seems doing my job at all. The responses I have recieved were very indirect and not at all helpful to my situation. Really, I just want them to give me an ultimatum or some other option. I am not willing to lose my job over this but I dont want to give in and buy a new phone just so I can click OK on an 2FA app.
So Lemmy, how should I approach this ticking time bomb?
Talk to your boss and talk to security Tell them your phone is not supported and you would like to get paid. They will have to find a way to work it out.
The fact your phone is so old it doesn’t get security updates is a separate matter so I understand their security posture. But they cannot make it impossible to get paid
I told my direct boss today after having several conversations with IT. My boss knew of the situation but is now taking it more seriously because I told him I would not be able to log my hours next week, which came as a surprise to him, he noticed this was the first time he had to use the 2FA to get into the payroll software.
Yes, my phone is old as shit, I cracked the screen 5 years ago and it’s surprisingly still waterproof. I have had this phone longer than I have had my job, they have no bearing on what cell phone I use, hell when I was hired in I didn’t even use my phone for work other than phone calls. I understand my companies position as well but instead of requiring the employee’s personal property to be up to their standards they should offer an alternative method.
Agreed. Depending on their security stance the will just issue you a TOTP fob that you just carry around for the one-time codes.