Employee Express now only allowing PIV login? Not OK.

[Mike Kilo]

Not unless you have set up access already to be able to check it outside of work.

I looked into my settings the other day for webmail to set the at up and couldn’t find anything about it.

 

[Durde_Cecof]

I looked into my settings the other day for webmail to set the at up and couldn’t find anything about it.

Go to the faa homepage at work and search “mfa”. That’ll bring you to the page to set it up to check at home. It’ll ask you about a Microsoft app or something, but you don’t have to do that, so check no.

 

[Termine]

It’ll ask you about a Microsoft app or something

That's a 2FA code generator. Basically there's a random number generator that uses the system date and time as one seed, and a saved unique code as the other seed, and that algorithm is running on MSFT's server and on the app on your phone. So you enter the number that your phone generates and it compares it to the number the server generates and if it's a match then that confirms it's you. Or at least it confirms that the person logging in has access to your phone...

But Google has an app that does the same thing if you prefer, or I think there might be an option for them to text you a code each time.

 

[Durde_Cecof]

That's a 2FA code generator. Basically there's a random number generator that uses the system date and time as one seed, and a saved unique code as the other seed, and that algorithm is running on MSFT's server and on the app on your phone. So you enter the number that your phone generates and it compares it to the number the server generates and if it's a match then that confirms it's you. Or at least it confirms that the person logging in has access to your phone...

But Google has an app that does the same thing if you prefer, or I think there might be an option for them to text you a code each time.

Yea, I just have them text me a code

 

[SharkBait]

Except you still have to do it at work because the verification code they send goes to FAA email

That's only for initial set up, after that you don't need to anymore.

 

[Mike Kilo]

That's only for initial set up, after that you don't need to anymore.

Unless he was dumb and clicked on “email me a code” instead of text lol.

 

[eltors0]

Holy shit they actually added yubikey support.

 

[CF]

Holy shit they actually added yubikey support.

Which is shocking since yubikey is good and the FAA doesn’t normally do good things.

 

[Rico]

The Parties have reached a memorandum of understanding (MOU) (see below) regarding the change in access to Employee Express. BUEs may utilize a two-factor authentication to access Employee Express on a personal device (e.g., cell phones, laptop computers) outside of an FAA facility, without going behind the Agency’s firewall.

To sign up for two-factor authentication, BUEs may send a code to either their home address or their FAA email address. BUEs will not be required to use their FAA.gov email addresses to set up two-factor authentication or routinely access Employee Express.

For sixty (60) days following the execution of the Agreement, BUEs who are not reporting to a facility/office and do not have access to government-furnished equipment may utilize the POCs listed in Appendix 1 of the MOU for assistance with matters housed within employee express. BUEs on long-term leave may utilize the POCs for assistance with matters housed within Employee Express for up to sixty (60) days following their return to duty.

Please click below to view the briefing documents for the specific steps necessary to establish the two-factor authentication.

Logon.gov Instructions and PIV Instructions