Should Vistana.com have 2 Factor Authentication?

[DannyTS]

I know, I am probably paranoid about this but I sometimes fear that if I am ever hacked somebody can cancel my reservations and can create a nightmare scenario especially when the plane tickets are bought and family members are invited to travel with us. How do you feel about this?

 

[sjsharkie]

I know, I am probably paranoid about this but I sometimes fear that if I am ever hacked somebody can cancel my reservations and can create a nightmare scenario especially when the plane tickets are bought and family members are invited to travel with us. How do you feel about this?

I work in information security.

The answer is yes, as account takeovers continue to rise across the industry, fueled by mass credential breaches that have occurred over the last few years.

But two factor costs money. Think about every SMS that has to be sent, etc. Given the cost cutting going on with the call center wait times, and the fact that MVCI does not use two factor for their login, I don't see it happening soon.

Best thing you can do is use a password vault like LastPass (which is what I use) and have a strong master vault password. My Vistana password is over 15 random characters long and would be costly for a hacker to brute force.

Ryan

Sent from my SM-G965U using Tapatalk

 

[controller1]

I work in information security.

The answer is yes, as account takeovers continue to rise across the industry, fueled by mass credential breaches that have occurred over the last few years.

But two factor costs money. Think about every SMS that has to be sent, etc. Given the cost cutting going on with the call center wait times, and the fact that MVCI does not use two factor for their login, I don't see it happening soon.

Best thing you can do is use a password vault like LastPass (which is what I use) and have a strong master vault password. My Vistana password is over 15 random characters long and would be costly for a hacker to brute force.

Ryan

Sent from my SM-G965U using Tapatalk

Agree.

Everyone should use a password vault and never use the same password on multiple sites. My Vistana password is 20 random characters and by using a password vault I don't have to remember any of my passwords other than that of the vault itself.

 

[DannyTS]

I work in information security.

The answer is yes, as account takeovers continue to rise across the industry, fueled by mass credential breaches that have occurred over the last few years.

But two factor costs money. Think about every SMS that has to be sent, etc. Given the cost cutting going on with the call center wait times, and the fact that MVCI does not use two factor for their login, I don't see it happening soon.

Best thing you can do is use a password vault like LastPass (which is what I use) and have a strong master vault password. My Vistana password is over 15 random characters long and would be costly for a hacker to brute force.

Ryan

Sent from my SM-G965U using Tapatalk

How is Google password manager that is integrated to Chrome in terms of safety?

 

[okwiater]

I’m actually more worried about the lack of security when calling Vistana by phone. All someone needs to wreak havoc on my reservations is my name and address, which are part of every rental agreement I have ever sent out. And yes, I am aware I could try to obscure them, but a quick public records search would defeat that as well. The lack of any meaningful safeguards is really unconscionable.

 

[CalGalTraveler]

Yes

 

[PamMo]

I’m actually more worried about the lack of security when calling Vistana by phone. All someone needs to wreak havoc on my reservations is my name and address, which are part of every rental agreement I have ever sent out. And yes, I am aware I could try to obscure them, but a quick public records search would defeat that as well. The lack of any meaningful safeguards is really unconscionable.

Absolutely agree with this. When calling in, half the time I'm asked, "Is your email still XXXXXX and ...."

 

[jabberwocky]

I'm for two-factor authentication, but I don't think it should be via SMS. I regularly swap out SIM cards when traveling overseas and would not want to be locked out of my account because of this. There have also been reports of cell phone numbers being taken over by scammers who then use the SMS feature, so this is a false sense of security.

For example, I was traveling in the US last year and knew I had a Capital One credit card payment coming up. I went to log into the Capital One website. Capital One detected there was a change in IP address (even though it was the same laptop) and would not let me in without a text message (which was not possible since I had my US SIM card with me). I managed to end up calling in and finding out the balance to be paid, but it was a huge pain and a waste of time.

In contrast my brokerage account uses 2FA but it is tied to an app on my phone which uses the device MAC address. When I log in on the computer a message pops up on the phone asking for my password and facial recognition (iPhone 11). Once that is provided the website automatically logs in.

 

[DannyTS]

I’m actually more worried about the lack of security when calling Vistana by phone. All someone needs to wreak havoc on my reservations is my name and address, which are part of every rental agreement I have ever sent out. And yes, I am aware I could try to obscure them, but a quick public records search would defeat that as well. The lack of any meaningful safeguards is really unconscionable.

I absolutely agree with you and that should be addressed as well. About a year ago, as someone suggested on TUG, I called Vistana to add a key word to my account and they said they would ask about it every time I would call. Not only they did not ask me the key word when I called them again but the key word and the question appeared on my annual bills, all of them, a clear failure of what that key word was supposed to do.

 

[bogey21]

It is fine unless you are like me and have text messaging blocked on your primary cell phone. I tolerate the ones where I have to answer stupid questions like where did I get married of my Mother's middle name...

George

 

[sjsharkie]

How is Google password manager that is integrated to Chrome in terms of safety?

Safety-wise, I would trust Google -- their security is top notch.

However, not sure Google password manager is available on every platform. So, if you are not using Chrome or Android platforms, you may be out of luck in having easy fill-in access to your vault because the plug-ins for say Safari might not be available. (Of course you can always manually access your vault and cut/paste -- but that is not the most friction-free solution.)

-ryan