Update -Improved Security- 2FA changes

PriyaSelvaraj 

As with other users we are floored that MYOB believe this is acceptable.    If I log out via the methods suggested then ANYONE can log in to the accounting file without a password.    This is clearly NOT improved security.    The 2FA option of 12 hours is OK, please re-instate the requirement for a password EVERYTIME we login.

This was one area of MYOB that was not broken - why "fix" it??    

This update is not an improvement.   I would highly recommend that you revert to the previous iteration because this, in effect, provides no security on a regularly used device.  I am no security/cyber expert, but I am also not stupid.  This is not an acceptable solution.  

Yeah, I'm rather upset about this. Not only on my behalf, but on behalf of all my clients, whose accounts are now vulnerable. I work both from the office and from home - at a minimum, the insta-login needs to only be available from one computer at a time, not all three of my office desktop, home desktop, and laptop, all at the same time.

This is not improved security, it is reduced security. Security for my clients' data should not be completely dependent on me having a dog to protect my computers when I'm not there.

Please see our improvement to your house security by taking your door down, we did this because the community requested it. The door periodically reappears after 12 hours. During which time, your fence has to do the job for you.

I use a home pc for my bookwork and having to enter my email and password all the time is a pain. There is no option for me to "Trust this device for 30 days" or even an option to save email and password if I so desire.  Is something missing my end or is this just MYOB? Running MTOB Accountright

PriyaSelvaraj & other moderators - please note that I have had to go to a formal complaints process to get a clear, or at least clearer, answer on this.  Why?   

MYOB state - 

Please be advised customers should not be choosing the ‘File’ menu then ‘Exit’ as this has never been the intended correct sign out process for AccountRight. This simply closes off the software but doesn’t log a user out, unlike the process from the 'Services' menu.

If we choose File & exit or simply select the "x" then there is NIL security when we log back in within 12 hours.   MYOB are not listening to users and do not intend to change that.   No problem with no 2FA within the 12 hours as a default however the default of no seucirty via the two common ways of exiting a program is a clear security risk, and one that we as users have no control over.    In the instructions here  MYOB helpfully tell us "It’s good security practice to log out at the end of every session"  however we need to drill down at the bottom of that article to find out that we need to use the Services menu to do that.    

If MYOB are a serious Accounting Software provider, how about being a little more serious about security?    Back to basics - every time a file is accessed it needs a password!

Hi 

When this happened initially, I called your support line, who told me to untick the my.myob box .... now suddently we have two screens for log in.  And people who changed their passwords ..... wait for it .......... have to log in with their OLD and NEW passwords on the two different screens.  THIS IS REDICULOUS

'

We are your CUSTOMERS, you should listen to our requirements for security.  WE didn't ask to remove our security, MYOB did it.

Very simple, PUT IT BACK PLEASE!!!  I use XERO as well and honestly, none of this nonsence ever happens with them.  MYOB will lose even more customers to XERO if you continue with this and refuse to give us back our security.

I am still having the issue where we can log in without password & 2FA. Please advise when the issue will be fixed?

Hi MYOB,

Just another post regarding MYOB login concerns. Three of us from the same company, sitting in the same room,  have completely different MYOB AR login processes since the upgrade that threw MYOB security out of whack. One of us is not required to sign in at all - just open MYOB and they are in - zero security which is a concern. One of us has not had their process changed at all, just the password required - normal security which is great. One of us now has to enter their email address and password everytime we they open MYOB AR - excessive & not needed security which is annoying. 

What would Goldilocks do?

Are there any updates on this fix?

There is a gaping security hole in your software that has been in place for three months, and despite my best attempts to contact the help desk, I am told to just keep waiting and monitor this post for updates, but you have not provided any updates.