Authentication Apps 2 Factor & One Step Update

Frank DeMello

I have turned on 2 factor on some of my accounts using an authenticator app. Quicken's handling of this in the One Step Update process is painful.

For each account with this turned on you have to provide a key at every update. This is really making me hold back on adding this critical security feature to other accounts

We have a password to get into our file. A password for the vault for one step updates. Why do we also need 2 factor for every account as well?

splasher

Frank DeMello said:

I have turned on 2 factor on some of my accounts using an authenticator app. Quicken's handling of this in the One Step Update process is painful.

For each account with this turned on you have to provide a key at every update. This is really making me hold back on adding this critical security feature to other accounts

We have a password to get into our file. A password for the vault for one step updates. Why do we also need 2 factor for every account as well?

I'm confused here.  You decided to turn on MFA on the accounts and you are asking "Why do we also need 2 factor for every account as well?".  You have caused this yourself, it is self inflicted, you can undo the problem on your own.

Frank DeMello

I am talking about Quicken's implementation of it. I want 2 factor on my accounts for security. I don't think Quicken should utilize it in the one step update process when there are already 2 levels of security in the app.
I have many accounts. If I turn them all on (which I want to do for security) this will take an hour+ to run One Step Update. How does that make sense?

splasher

Quicken is making a connection to the financial institution (FI) as if it was you, you either use MFA or you don't, but Quicken can't get around requirements that you have setup at the FI.

Chris_QPW

Well that is the weakness of Express Web Connect.  If you had a financial institution that supported Direct Connect then you wouldn't have this problem.

Direct Connect, the OFX protocol, has its own security model and is setup with the understanding that this is to be an machine to machine protocol, which needs to have a security model that doesn't require the user to interact with it.

Express Web Connect on the other hand was created because of the lack of the financial institutions to adopt such a protocol.  Express Web Connect is the Intuit servers (Quicken Inc pays Intuit for this service) trying to log in as you to the financial institution's website and download the transactions.  As such it is subject to all the same security measures as if you logged in directly.

Frank DeMello

Understood Chris. Thanks