We have recently taken measures to deliver new security functionality to provide contextual and adaptive multi-factor authentication (MFA) controls. As a result, MFA now takes into consideration a range of factors including user’s location, device & behaviour patterns to determine the level of authentication required. By analysing contextual information like time of day and user location, our MFA can identify if additional authentication measures are necessary. This approach aims to reduce user effort, whilst maintaining a high level of security. However, we have reviewed concerns raised by our customers. What we’ve heard: I want to be prompted for a login more frequently (7 days is not sufficient, unless I have the option to select this frequency) I want to understand MFA and login requirements. I want to understand my role in securing sensitive information. What we’re doing: Reverting login frequency to 12 hours. Users will be prompted to login after 12 hours, as they were previously. Users can select "Trust this device for 30 days", however may be prompted more frequently if additional authentication is required. We recommend users log out at the end of every session, via the product menu. What you need to do: We will provide further updates on these changes for all customer via our channels and MYOB Community Forum.

I'd like to be very clear here, the changes MYOB have made has compromised security!!! When users now exit out of MYOB via the options of either closing the program window using the X or selecting File>Exit, they can now open the program without ANY requirement to log in using a password. MYOB will immediately lauch the program without any password OR 2FA authentication!!!!! Previously when you closed the program, you would have to login using a password. Why did MYOB change this and how can you possibly purport that this improves security? The situation now, is that anyone who has access to my computer could simply open the program and have access to MYOB WITHOUT having to actually login in using a password. I'm sorry, but I fail to see how this is an Improved Security measure. Are you aware that other programs such as Xero & Quickbooks, require you to login with a password and Xero requires 2FA everytime you login. Both these programs will also time you out of the program after a period of time, also requiring you to use a password and 2FA to log back in to the program. If the MYOB program is exited in any way, as a matter of security it should require you to login using a password. No system should allow you to open the program without any authentication or password at all.

I am not being asked to log on at all. There is zero security.

I'm sorry, how are you actually "improving security"?!?! Removing the requirement to enter a password when logging in has totally removed all security for this program. At least when we previously selected "trust this device for 30 days", we still had to enter a password to login to the program and select the client files we wanted to work in. Now, all I have to do is click on the MYOB icon on my desktop and I can access any file I want, with no password or any other kind of 2FA required to access the files. This is highly unsecure!! If the security on my computer was to be breached, anyone would have direct access to all of my client files. And who is going to be liable for that??? MYOB??? Is my cyber security going to cover any claim for this??? And I notice that the new update released yesterday/today has not fixed this issue! MYOB - you need to get this issue sorted out ASAP, unless you are happy to lose clients in droves because that's what is going to happen. We are already looking at moving clients out because you can't provide a secure environment for our client's important data. And if you don't just lose clients, you will more than likely end up getting sued when someone's client's data is breached due to your lack of security.

It would be nice to have some security. I can still just click on MYOB on my desktop and I am in. It's been far too long and writing about how important and good you are about security and then not fixing this issue that has been going on for over a week and a half is riduculous.

Update -Improved Security- 2FA changes

73 Replies

Lmcstack
Experienced User
7 months ago
I'd like to be very clear here, the changes MYOB have made has compromised security!!!

When users now exit out of MYOB via the options of either closing the program window using the X or selecting File>Exit, they can now open the program without ANY requirement to log in using a password. MYOB will immediately lauch the program without any password OR 2FA authentication!!!!!

Previously when you closed the program, you would have to login using a password. Why did MYOB change this and how can you possibly purport that this improves security?

The situation now, is that anyone who has access to my computer could simply open the program and have access to MYOB WITHOUT having to actually login in using a password.

I'm sorry, but I fail to see how this is an Improved Security measure. Are you aware that other programs such as Xero & Quickbooks, require you to login with a password and Xero requires 2FA everytime you login. Both these programs will also time you out of the program after a period of time, also requiring you to use a password and 2FA to log back in to the program.

If the MYOB program is exited in any way, as a matter of security it should require you to login using a password. No system should allow you to open the program without any authentication or password at all.
- melbdesk
  Experienced Cover User
  7 months ago
  Well said Lmcstack
- Antoon
  Experienced User
  7 months ago
  Well said! 100 percent!
- CHutchinson
  Experienced Cover User
  7 months ago
  Absolutely agree, this lack of security is incredable.
Maddocks
Cover User
7 months ago
I am not being asked to log on at all. There is zero security.
- CHutchinson
  Experienced Cover User
  7 months ago
  
  That is exactly what the problem is,,,,,,,,,,,,,,,,,,,,,,theere is no security logging in at all now
- PriyaSelvaraj
  MYOB Moderator
  7 months ago
  Hi Maddocks melbdesk
  
  Thanks for your post! I would suggest doing a hard logout, as this would prompt you to log in.
  
  If you still experience issues after trying the hard log out, feel free to send a private message with email details & serial number and I will look into this further.
  
  Thanks
  
  Priya Selvaraj
  - Lmcstack
    Experienced User
    7 months ago
    I dont see how this actually resolves the issue here.
    
    I can do a hard logout via services>signout of accountright live>logout and yes it does prompt me for a password and 2FA when I log back in.
    
    HOWEVER, the issue is if I File>Exit out of the file or simply exit by closing using X, IT DOES NOT REQUIRE A PASSWORD to access the program. As I have pointed out repeatedly THIS IS NOT SECURE!!!
    
    What is MYOB doing to rectify this?????
becdbc
User
7 months ago
I'm sorry, how are you actually "improving security"?!?! Removing the requirement to enter a password when logging in has totally removed all security for this program. At least when we previously selected "trust this device for 30 days", we still had to enter a password to login to the program and select the client files we wanted to work in. Now, all I have to do is click on the MYOB icon on my desktop and I can access any file I want, with no password or any other kind of 2FA required to access the files. This is highly unsecure!! If the security on my computer was to be breached, anyone would have direct access to all of my client files. And who is going to be liable for that??? MYOB??? Is my cyber security going to cover any claim for this???

And I notice that the new update released yesterday/today has not fixed this issue!

MYOB - you need to get this issue sorted out ASAP, unless you are happy to lose clients in droves because that's what is going to happen. We are already looking at moving clients out because you can't provide a secure environment for our client's important data. And if you don't just lose clients, you will more than likely end up getting sued when someone's client's data is breached due to your lack of security.
melbdesk
Experienced Cover User
7 months ago
It would be nice to have some security. I can still just click on MYOB on my desktop and I am in. It's been far too long and writing about how important and good you are about security and then not fixing this issue that has been going on for over a week and a half is riduculous.
JillL1
Experienced User
7 months ago
Could I put in a special request for an "OMG are you serious" button? The "thumbs up" kudos button is just not cutting it!
ERStewart
Contributing User
7 months ago
I need to be able to log into more than one Myob account simultaneously.

The changes Myob has made to logging in are not "Improved Security", in fact, it's the complete opposite not to mention the accessibility issues. I have users of varying IT abilities, some of whom are elderly and have difficulty with adding a new online file every time they need to change the company file they're working on, this means I must actively supervise each login change.
Antoon
Experienced User
7 months ago
Why didn't Myob inform it's customers of these changes?
Tip: Put a logout shortcut on the Myob home page.
- PriyaSelvaraj
  MYOB Moderator
  7 months ago
  Hi Antoon ,
  
  Thanks for the tip! In the interim, you can navigate the Services menu and click the Sign-out option.
  
  In terms of these changes, it is rolled out phase by phase and the notifications were included on the login screen. However, I certainly hear and understand your frustration and I will relay this feedback to the relevant teams.
  
  Hope this helps and once again thanks for your feedback.
  
  Cheers
  
  Priya Selvaraj.
  - CHutchinson
    Experienced Cover User
    7 months ago
    Priya
    
    I note your reference to the "we are making changes to .... blah blah blah............BUT WHERE do you tell everyone that has MYOB that you are taking ALL THE SECURITY measures off the program...
    
    If you can show me where absolutely everyone and i mean every BUSINESS/COMPANY that uses MYOB for accounting has agreed to you taking this measure then i will reneg on all my negative posts.
    
    Until that time, you need to fix this problem. Its is a total lack of security. Not one of your solutions has achieved anything, not one.
    
    Cheryl Hutchinson
Debs657
User
7 months ago
This is not improved security. Anyone who has access to my computer and the other computer that has MYOB on it, can log in automatically. No password, no authenticator number.

Your 'improvement' is certainly NOT an improvement.

Insurance company certainly will not be happy that our MYOB program can be accessed by anyone who uses the computers.
CHutchinson
Experienced Cover User
7 months ago
This is the most ridiculous thing I have read. For the past 2 weeks BSI have had NOT SECURITY at all when signing in to MYOB. Absolutely none. But strangely enough, when i signed in to this FORUM i had to use the authenticator..................................what.

So anyone can get in to our Accounts but no one can get in to the Support Forum without security. This is an absolute joke.

CHERYL HUTCHINSON
BARDEN - STEELDECK INDUSTRIES

Looking elsewhere
- Lmcstack
  Experienced User
  7 months ago
  Yes exactly! You are required to input a password to access the Community Forum, but no password required to access the actual program that contains your highly confidential financial data!! Completely absurd MYOB!!!
Sharon_BCT
Experienced Cover User
7 months ago
Nothing has changed !!!!
Stop telling us how good you are and just fix the problem.