Update -Improved Security- 2FA changes
We have recently taken measures to deliver new security functionality to provide contextual and adaptive multi-factor authentication (MFA) controls. As a result, MFA now takes into consideration a ra...
Forum Discussion
PriyaSelvaraj & other moderators - please note that I have had to go to a formal complaints process to get a clear, or at least clearer, answer on this. Why?
MYOB state -
Please be advised customers should not be choosing the ‘File’ menu then ‘Exit’ as this has never been the intended correct sign out process for AccountRight. This simply closes off the software but doesn’t log a user out, unlike the process from the 'Services' menu.
If we choose File & exit or simply select the "x" then there is NIL security when we log back in within 12 hours. MYOB are not listening to users and do not intend to change that. No problem with no 2FA within the 12 hours as a default however the default of no seucirty via the two common ways of exiting a program is a clear security risk, and one that we as users have no control over. In the instructions here MYOB helpfully tell us "It’s good security practice to log out at the end of every session" however we need to drill down at the bottom of that article to find out that we need to use the Services menu to do that.
If MYOB are a serious Accounting Software provider, how about being a little more serious about security? Back to basics - every time a file is accessed it needs a password!
With regards to:
Please be advised customers should not be choosing the ‘File’ menu then ‘Exit’ as this has never been the intended correct sign out process for AccountRight. This simply closes off the software but doesn’t log a user out, unlike the process from the 'Services' menu.
I do not understand why if signing off by exit or X has never been the intended method, why then is it that it always worked before to let us sign out and be secure. I have been using MYOB for years and have only now just found out about using the services menu to sign out. Also it took a week or two of everyone complaining that someone from MYOB mentioned this method of siging out.
Hey JillL1 ,
Thanks for raising your concern and we do take the customer feedbacks seriously.
We understand your concern about security risk, and I would like to assure that our team is actively working on to improve the experience.
I will personally ensure to pass on your feedback and check whether our help article can be modified to clearly highlight the logout process.
Regards
Priya Selvaraj
This is the first time i have even heard of "loggin out" through the Service tab. I have worked on MYOB for so many years now and have never ever ever even been told that i need to do that.
In fact, if that is the case and we should not log out of MYOB (and backup each time) through the normal system either by X or "File" "Exit"....then why have we not had the security problem for years.
It has only been the last three months that the 2FA and the security "email and password" logging in has changed. And still, there is NO 2FA on log in no matter which way you sign out.
Cheryl Hutchinson
I've made a Product Idea post: https://community.myob.com/t5/AccountRight-Idea-Exchange/AccountRight-Desktop-exit-should-log-you-out/idi-p/846695 asking for Logout on exit. Even though it "never was intended" to do it that way it has been in there since even I used MYOB (at thats over 10 years).
I have no idea where MYOB got the idea that users wanted to stay logged in forever (user survey? analytics on how many people ticked the "remember me for 12 hours" option?) but if you are going to change the way this works then you need to communicate this to Everyone: There should be a mass communication (ie email) to every single AccountRight user on the changes made to logins. Not this waiting for people to search the forums for answers.
PriyaSelvaraj and other Mods: you need to tell upper management to do this. Heck, do we have to hassle the new CEO of MYOB Paul Robson about this?
Regards
Damien
Improving the instructions is better, but it does not solve the problem.
It is great that you understand the security risk and MYOB are actively working to improve that experience - BUT, the emailed response I received via the feedback process (Case no. 01503847) is different and does not mention re-instating the requirement to put in a password everytime. I presume that is what you mean? Not for the first time in the last few months I need to ask - which is the correct answer?
