Let's say you own a small business, and you want to get a payroll service to help with withholding taxes and automatic deposits into your employees' accounts. That's a very useful, powerful service: You're giving a third party the right to withdraw funds from your bank account and send them to others.
Being switched on to security, you'd look for a payroll company that supports multifactor authentication (MFA) based on a time-based one-time password (TOTP) application, knowing that SMS-based two-step login is effectively (in the words of Allison Nixon and Mark D. Rasch at Unit 221B Research) zero-factor authentication.
The trouble is, as of about three weeks ago, none of the major online payroll companies offered this feature. If you ask those companies, they'll say they offer SMS-based two-step login and then assure you they take security seriously.
I found one firm that does support application-based MFA: I'll call it Payroll Company B. PCB isn't a payroll company as much as a professional employer organization, but still, it does payroll — for twice the price of the others I just mentioned.
Anyway, you sign up. And after you go through the rigamarole to get the TOTP application working, if you're attentive, you may discover a seedy backdoor: If you were to forget the Web front end,call PCB's toll-free support number, and tell the company you need to make an account change, the entire authentication regime falls apart with these dreaded words:
"For security purposes, please tell me yo ..
Support the originator by clicking the read the rest link below.
