Update Servus Credit Union

[asclepiadae]

Site name

Servus Credit Union

Site URL

https://www.servus.ca/

Update reason

It now supports 2FA.

Additional information

Supported 2FA methods

• TOTP (RFC-6238, Google Authenticator)
• Proprietary Software (Authy, Duo, etc.)
• U2F/WebAuthn security keys
• Proprietary hardware (Yubico OTP, RSA keys, etc.)
• Phone calls
• SMS tokens
• Email tokens

Official documentation (public-facing): https://www.servus.ca/security/protect-yourself/two-step-authentication
Blog post announcing 2FA introduction: https://www.servus.ca/blog/2020/10/two-step-authentication

Issue Eligibility

• The issue I'm creating is not a duplicate of an existing issue.
• The issue I'm creating is not a duplicate of an existing pull request

[Carlgo11]

Hello @asclepiadae,
thanks for submitting an issue!

After activating two-step authentication, you may be prompted to confirm your identity using Google Authenticator when you perform certain types of transactions, such as higher limit Interac e-Transfers®.
- https://www.servus.ca/blog/2020/10/two-step-authentication

What's described sounds more like authorization for specific user actions than authentication at the login phase.
We distinguish between the two in the section about authorization in Contributing.md.
Please confirm if this is the case or if 2FA is also prompted on login.

[asclepiadae]

Sorry for the delayed reply here. The bank's documentation here is rather lacking, as they practice some "security through obscurity" by not publicly defining what the triggering events are (there are a few other non-2FA security measures that are also completely lacking in any documentation).

From my home connection with a stable IP (but not truly static) I cannot recall when I last had to enter my 2FA. Same goes for when I use the mobile app on my phone. However, I have been asked to enter the 2FA at login when using my laptop on college campus or through a VPN when on a public WiFi.
I obviously don't make "certain types of transactions" as I have never been asked for 2FA post-login.

If you want to leave this issue open for a few days, I can reach out to the bank and see if they can clarify. Alternatively, we can close this with auth for user actions as that's what's documented, and I can open a new issue later if there is confirmation around 2FA during login.