Using Mobile phone only to log in to Doctor

[melmerby]

Hi all

I have just had an e-mail from My doctor's IT system (EMIS) telling me that from tomorrow (Plenty of Notice- NOT) that I will need to use a mobile phone to log in to the system, as to log in each time I will need a one time unique passcode sent by SMS.

Talk about trying to stop people using systems!

This makes me very angry.

I've been using a computer to login from day one that they started using the system.

 

I've called my GP surgery and they said they hadn't been notified of the change and thought it unreasonable.

 

Any comments?

[Reorte]

As someone without a mobile phone and with no desire whatsoever to get one I fully sympathise, and I get very angry about anything that worked perfectly well without one that gets shifted to needing a mobile. It's just a case of a provider trying to be as cheap and nasty as possible (if that's all there is, I've no problem with it as an alternative, nothing wrong with choice).

 

That said, depending on your ordinary phone provider, it's possible to send a text message to it and it'll appear as an automatically read out voice mail. Still not really good enough though.

[33C]

My surgery has gone over to this system and I was sceptical at first but after a few wrong turns have found it very quick and useful. Saves a lot of waiting on hold!

But that's just me. 

[melmerby]

23 minutes ago, Reorte said:

That said, depending on your ordinary phone provider, it's possible to send a text message to it and it'll appear as an automatically read out voice mail.

My landline phone will accept proper SMS text, but they are always intercepted by the BT "voice"

Edited March 6 by melmerby

[melmerby]

1 minute ago, 33C said:

My surgery has gone over to this system and I was sceptical at first but after a few wrong turns have found it very quick and useful. Saves a lot of waiting on hold!

But that's just me. 

I never wait on hold on the current PC based system.

I can log in quickly (3 level login) then navigate to appointments or repeat prescriptions, done in an instant.

Why stop PC logins?

[jpendle]

It's all part of the drive towards 2 factor or Multi-Factor authentication.

It's happening everywhere in an effort to stop malicious actors hacking into people's online accounts.

 

My company has had us enter a code received by text for at least 5 years, BUT now even that isn't secure enough, they now insist on a phone call or an Authenticator app on our mobile phones.

 

If EMIS were doing it properly then there should be an alternative to SMS.

 

Regards,

 

John P

[Nick C]

It doesn't sound like they're stopping PC logins.

 

It's a pretty standard way of doing two-factor authentication. You either need a mobile phone to accept a text message, or some other way of generating the code such as an authenticator app or physical token - requiring users to have either of those is likely to cause more upset, wheras the vast majority already have a mobile, or some other way of receiving SMS messages.

 

 

[Nick C]

28 minutes ago, Reorte said:

As someone without a mobile phone and with no desire whatsoever to get one I fully sympathise, and I get very angry about anything that worked perfectly well without one that gets shifted to needing a mobile. It's just a case of a provider trying to be as cheap and nasty as possible (if that's all there is, I've no problem with it as an alternative, nothing wrong with choice).

 

That said, depending on your ordinary phone provider, it's possible to send a text message to it and it'll appear as an automatically read out voice mail. Still not really good enough though.

Normally I'm with you on avoiding change for change's sake, but when it comes to cybersecurity, sadly it's not a case of "it worked perfectly well" - everything on the internet is subject to constant attack, and you really don't want someone else getting hold of your medical data...

[melmerby]

47 minutes ago, Nick C said:

you really don't want someone else getting hold of your medical data...

No medical data on the pages I can access, apart from my repeat prescriptions.

It doesn't even have my Covid vaccination record, even though there's an option for such info.

 

48 minutes ago, Nick C said:

everything on the internet is subject to constant attack

So are mobiles. If anything due to the number of mobiles around the hackers are putting more effort into it.

 

IMHO nothing is 100% secure

[melmerby]

The other services I use that rely on extra security send a code to the landline, which you enter into the login page.

If you only use a mobile it sends it to that.

Edited March 6 by melmerby

[Bernard Lamb]

What I find even more frustrating, is that even with the one off code procedure, the system falls over.

There seem to be banned words, a similar situation to posting such on social media.

I have one company that I use on a fairly regular basis, has a name that could be associated with betting or gaming. I place an order, I pay, I get the provide phone number for a code message, I enter the code. Then the order does not go through. I have now cracked it. If I leave the items in my basket the company will inform me the next day that I have an incompleted order. I now enter my details and pay and it goes straight through. This happens however large or small the sum £7.99 last week, so it is clearly a banned word in the company name rather than a large amount that is causing the problem.

Bernard 

[Nick C]

That sounds like a major flaw in the company's payment system, nothing to do with either their name or the bank's two-factor authentication. The bank's side of the payment system won't care what their name is as long as the account numbers match. 

 

I'd be steering well clear of said company and keeping a very close eye on my card statements if I were you. If you trust the company, phone them and let them know there's a problem with their web payments.

 

Two-factor authentication is about making sure of who you are, by combining something you know (i.e. your username and password) with something you have (your phone) - or occasionally something you are (e.g. your fingerprints) - it reduces the risk of interception as to impersonate you an attacker would have to breach two different things, in this case your PC to get your password and your phone to get the one-time code.

[Colin_McLeod]

I just phone the surgery and make an appointment.  Old technology but it works!

[cctransuk]

47 minutes ago, Colin_McLeod said:

I just phone the surgery and make an appointment.  Old technology but it works!

 

Fine - if you have half an hour plus to listen to "We do value your call; you are number 99 in the queue", followed by inane electro-music.

 

CJI.

[Welly]

1 hour ago, Colin_McLeod said:

I just phone the surgery and make an appointment.  Old technology but it works!

Fine if you are hearing!

[melmerby]

6 minutes ago, Welly said:

Fine if you are hearing!

Can't order prescriptions over the phone. that's my main usage of the website.

I can book an appoitment online but it's easier on the phone. Not all availabiliuty is put on line.

Edited March 7 by melmerby

[melmerby]

3 hours ago, Bernard Lamb said:

There seem to be banned words, a similar situation to posting such on social media.

My 35 year old username for Plusnet, is now not accepted on some sites (not a valid username) so when starting a new moble pay as you go account I had to use my (fake) Google username for You Tube!

[Jeremy Cumberland]

I, too, do not have a mobile phone. Two factor authentication isn't a problem in itself. Some providers use email. Some use automated phone calls to a landline. For online banking, one bank has a card reader and another has a stand-alone keypad registered to me (but, curiously, they don't offer this as a means of authenticating ordinary online payments, for which they only offer a text message).

 

A GP surgery really ought to be more inclusive than only offering two-factor authentication via text message.

 

My experience of trying to use an app for two factor authentication is that these apps only work on mobile phones, not on pcs or tablets. I think they confirm the phone number, which is effectively what sending a text message does. I wonder what happens if the person's phone is stolen.

 

Text messages to landlines are possible, and I think they depend on the sender's system, not the recipient's. I occasionally receive audio text messages without setting anything up specially to receive them. But an ordinary 01xxx landline number isn't accepted by most providers requiring a number to dial for two-factor authentication.

[Jim Martin]

24 minutes ago, melmerby said:

Can't order prescriptions over the phone.

That's surprising, because I think it's a pretty common use of online services by GP surgeries. My GP really isn't any great shakes and they've had this feature for a couple of years.

[robert17649]

At least you guys can get an appointment, my wife has been trying for two weeks and is constantly referred to the on line system which shows either none available or that “ your surgery does not offer this service”.

meanwhile today they sent me an appointment which I neither requested nor wanted, to add insult to injury they did not tell me when the appointment was/is.

I used to be a GP and find the current approach by practices to be inc omprehensible. Actually there aren’t enough to go round and the current contract is a joke. 

[melmerby]

1 hour ago, melmerby said:

Can't order prescriptions over the phone. that's my main usage of the website.

 

45 minutes ago, Jim Martin said:

That's surprising, because I think it's a pretty common use of online services by GP surgeries. My GP really isn't any great shakes and they've had this feature for a couple of years.

can't use the phone!!!

 

In person or online only

[TheQ]

We could order by PC during COVID close down, after a short time of  being able to order by phone. Now we are back to ordering by the paper slip, attached to the prescription. Oh the doctors is the pharmacy as well.

 

Mobile phone ordering would be useless here, i'd have to get in the car and drive most of the way to the surgery to get a signal.

Edited March 7 by TheQ

[Mike Buckner]

Technology ups the ante.

 

When telephones came out, businesses got a phone to attract more custom. Before too long, businesses without a phone were losing custom. When the fax came, larger businesses were expected to have that. Today, in most cases a business sending handwritten communications would raise an eyebrow. In the early days of computers, dot-matrix printers were an advance over what came before - but now they would shout cheapskate. Nowadays, businesses are expected to have a website. Large businesses are expected to have a well-monitored social-media presence.

 

I have a mobile phone, but I'm not in love with it. Sometimes it's handy. There is a growing tendency to insist on mediating transactions via a (smart)phone, which makes life less easy for those without one - but easier for the authority insisting on it. In Brighton now, you can only pay a parking meter by phone - cash is not accepted - an administrative convenience, and a reduction in theft of the cash. The railways are pushing for "smart ticketing".

 

It will, I'm afraid, become increasingly awkward to be without one.

[Flying Pig]

1 hour ago, melmerby said:

 

can't use the phone!!!

 

In person or online only

 

I'm really bewildered by this.  You said a few posts back that you had a mobile phone account at one time.  Do you still have it?  Even an old dumb phone will receive texts so you can get your one time passcodes.

 

Are you under the impression that the OTP has to be received on the same device you are using to log in?  This is not so.  You can get the code on your phone and type it into the computer to log in.

[Michael Hodgson]

2 hours ago, melmerby said:

Can't order prescriptions over the phone. that's my main usage of the website.

I can book an appoitment online but it's easier on the phone. Not all availabiliuty is put on line.

I can book an appointment online.  In theory.  In practice, it will only allow bookings up to 3 weeks ahead and as they are all already booked, in practice I can't. 

 

So I do have to ring the surgery, listen to book it online, call 999 if it's an emergency or 111, or you are no. x in the queue - and if there's too many in the queue already, I can't put the phone down and do something else while they get through all those, as the call is automatically disconnected after 20 minutes.    And if I do manage to get through, I have to explain what's wrong to a medically unqualified receptionist and persuade her that it sounds serious enough to see the quack.  But they don't as yet care what sort of phone I'm using.  Though I've not tried ringing them since Vodafone sent me a text telling me they've turned off 3G and I have to get new phone a because mine isn't that modern.

27 minutes ago, Mike Buckner said:

I have a mobile phone, but I'm not in love with it. Sometimes it's handy.

 

Very much so in Germany - mobile phone translates as das Handy.

30 minutes ago, Mike Buckner said:

There is a growing tendency to insist on mediating transactions via a (smart)phone, which makes life less easy for those without one - but easier for the authority insisting on it. In Brighton now, you can only pay a parking meter by phone - cash is not accepted - an administrative convenience, and a reduction in theft of the cash. The railways are pushing for "smart ticketing".

 

It will, I'm afraid, become increasingly awkward to be without one.

It suits the police state as well - if you're carrying one the old bill can locate you if they want to.

It's the introduction of mandatory id cards by the back door.