lack of 2fa when login to account (my apologies if topic already here) | Oaken Financial | Discussion forum

I really should check out my chrome extension then. It is suppose to clear everything when I press the button upon close. Either that or start using firefox in incognito mode all the time... ?
Although saying that. After I successfully login, there is no text saying that a login occurred. Very strange.

The official word is that this is normal not using 2fa to login. Something about behind the scenes the algorithm can tell if it actually you or not... I could find the quote, but you get my gist. Which is kind of frightening.

Bit of a rant below. Bottom line is for the literally extra few dollars a month in interest is worth it.

I just signed up for the account a few days ago. Apparently it's been over 5 days and haven't sent in physical signature yet. Guess better get on that one.

Not sure what "allow before login..." is.
It texts and emails me every time I login, always same computer, two browsers (firefox incognito mode or edge in regular mode). Clear cache, cookies, history, and everything else after close browser after any password related login.

Haven't phoned because they say everything is working as planned. Assumed they would be reading from the same script.

"Thank you for your email.

Our 2FA system takes into consideration different details that are captured when you log in to your account.

It is programmed in the system to trigger the verification code, should some of the criteria be met (for example, logging in on a new device or different location).

If the system performs a straight through log-in, this means that it was validated as so by the system.

Should there be an incident if your computer becomes compromised, please be sure to notify us immediately so that the necessary action can be taken."

Still not really sure why they can't just force 2fa at my request. I have already set up email to an account that a don't access on same device. Since if 2fa does come up, then can change to email vs text message.

I replied that the point of compromising a computer (keylogger etc..) is that the point is generally to not be detectable. Waiting to hear a response about how good there algorithms are.

Also asked about their security policy about having to memorize a 24 character password with symbols and lower and upper letters and numbers. Since not allowed to store credentials on device. Also said that that would mean I can't use a password manager either.

They responded that if the password manager is compromised, then they would not be responsible. I told them that it would be nice if 2fa actually existed, then that wouldn't be a problem in the first place.

As comparison At least (rip hubert) access credit union straight up says they don't have 2fa at login. But do employ it when adding in new etransfer contacts, and linking bank accounts. Too bad have to lock in money for a year (quarterly terms) to get about the same rate as oaken.