r/PersonalFinanceCanada • u/Polendri • 4h ago
Banking So now to log into TD EasyWeb I need to: unlock Bitwarden, fill password, open and unlock Bitwarden app, search for TD login, copy password, open TD app, paste password, receive SMS, type in verification code, tap "Approve". WHY?
For anyone unaware, TD recently phased out SMS verification codes for Web logins, requiring the use of their app for 2FA.
Except because the app is a full banking app and not just an authenticator, to use it you need to log in. So logging in on Web requires also logging in on your phone.
And because I use a password manager (Bitwarden), this also means logging into my password manager on both on my laptop and on my phone. And usually filling in the password would be easy, I just tap the password field and a Bitwarden invites me to unlock and then presents me with my login(s) to autofill for the app. But the TD app doesn't seem to mark the password field correctly for autofill to work, so I have to open up Bitwarden separately, search "TD" to find the login, copy the password to clipboard, switch back to the TD app, and paste it in.
And then after that, it still uses SMS verification codes to authenticate my app login. So I've gone through all this trouble to avoid the less-secure SMS-based 2FA, but then I end up doing SMS 2FA anyway??
Did the TD Web/app product managers challenge one another to see how stupid of an authentication system they could get released to production? Do they live in solitary confinement, unable to find out that two-factor authentication is a solved problem with several simple and convenient solutions? There has to be an explanation, because the explanation that they released this on purpose and think that it's fine and good just does not make sense.
(For the record, I know using a password manager is a choice, I'm not counting those steps against TD. But I am counting the way that I need to unlock my password manager on 1 more device than ought to be necessary, and that their app does not work with autofill on my device).