Multi-Factor Authentication Is Inaccessible

Autistic people, ADHDers, and those who can’t afford cellphone service are excluded by most authentication systems

Photo: Jessica Lewis/Unsplash

Last January, I was out thrift shopping with my friend Imani when my phone suddenly stopped working. We’d made it about halfway through a long row of wool coats when I went to check my email and found I had no signal.

“That’s really weird,” I said to Imani. “My phone isn’t connecting to any towers.”

“Maybe the store just gets a bad signal.”

“No, that’s not it,” I said. “There are no bars, not even empty ones. And no little LTE or 4G symbol.”

“Try restarting it?”

I turned my phone off and back on again, and still there was nothing. I was used to getting a crappy signal inside buildings, but the absence of any connection was new. I have to admit I felt a bit of panic rising in my stomach — I was worried Trump had finally gone and gotten us into some nuclear conflict that had destroyed our satellites or cell towers or something. But when we stepped outside for a smoke break, Imani’s phone worked fine. She had a different provider than I did.

We walked to a coffee shop around the corner, and I connected to its Wi-Fi. I checked Down Detector and discovered that, yes, AT&T service was utterly kaput throughout all of Chicago and had been for well over an hour.

“Well, fuck,” I said. “My students have an exam coming up, and they need to be able to reach me. I guess I have to go home.”

When I got home, I tried to log into my university email and found I was due for authentication. A little while back, the school had made two-factor authentication (2FA) mandatory every two weeks or when using a new device to access email, HR documents, and class registration info. I’d signed up to authenticate via phone call. But I couldn’t take a phone call now — I had no cell service. So I couldn’t do any work.

I tried to log into my AT&T account to check in about the service disruption, but its site required — you guessed it — 2FA via a call to my phone. So I gave up. Service remained down for the rest of the day.