2 factor authentication is back (partially)

[zavandor]

Dear Disney Vacation Club® Member,

As we previously shared, over the last several months our teams have been working on a series of website enhancements to further protect our Members’ online security. We wanted to provide an update on our progress.

Beginning on May 24, Disney Vacation Club will implement a two-factor verification process exclusively for Members accessing their loan information on DisneyVacationClub.com. In addition to a strong password, two-factor verification adds an extra layer of further protection and reduces the risk of unauthorized access.

When Members visit the loans page of the Membership site, they will be prompted to verify their identity via an access code that will be sent to the email address, or the mobile phone number, associated with their Disney OneID account. Disney OneID is the account that is used across all Disney platforms. In order to receive the code, Members will need to have access to the email account or mobile phone with a U.S. area code listed in their Disney OneID account. Members should verify their email address and phone number are up to date in their Disney OneID profile prior to May 24 by clicking on the “My DVC” menu, then clicking on “My Profile” on the drop-down menu and selecting “Account Settings” located in the middle of the website page.

Additionally, as part of this system update, Members who need to reset their password will be directed to call Member Services at 800-800-9800 to initiate the password reset process and will no longer be able to reset online through self-service tools.

Members can learn more about two-factor verification and how to update their Disney OneID profile at DisneyVacationClub.com.

We appreciate our Members’ continued patience and understanding during this transition. This is an important step in making our online platform more secure.

Sincerely,
Disney Vacation Club

 

[zavandor]

I mean, it took months to rewite a failed system which forgot to check the user's password to then publish a system that doesn't allow to change the password online?
Are they joking?

 

[crvetter]

If this is the Disney OneID doesn't that seem to suggest I can still change it on Hulu, Disney+, DisneyWorld.com, Disneyland.com, ESPN, among the many others. Since they are all the exact same login/password combo and a change in one changes all of them.

It is a weird system overall, they went to this Disney OneID but seem to be doign the 2FA on a system by system basis rather than treating the authentication System (Disney OneID) as the place all the sites to should authenticate against with that having the 2FA.

 

[kilik64]

At least its only to get to the loan info stuff, shouldnt have to deal with it normally then. (Or at all if you dont have a loan)

 

[J-Dog]

Did I read that right, that we will have to now call just to reset our password?

 

[PalmettoPath]

Interesting as it specifies U.S. area code, so I wonder what will happen to us Canadians. No two-factor, or they count our area codes as U.S.

 

[crvetter]

Did I read that right, that we will have to now call just to reset our password?

I mean just get to the password reset via the other many Disney Services, I can't imagine they break on all sites.

 

[Disney World Dad]

So this only affects one small section of the website which each member may or may not ever go into depending if they do/do not have a loan? Wonder if this is them testing on a small subsection of the site to make sure things don't crash and burn... again... before rolling out to the website in full

 

[PalmettoPath]

Did I read that right, that we will have to now call just to reset our password?

Yeah, that is a really interesting one (and obvious a ton of steps backwards). I'm sure member services is not happy about that either as there will be a TON of room for error relying on someone else to enter a complex password that you are dictating to them over the phone. They have built-in a high propensity for errors (and more calls) doing this.

 

[J-Dog]

Yeah, that is a really interesting one (and obvious a ton of steps backwards). I'm sure member services is not happy about that either as there will be a TON of room for error relying on someone else to enter a complex password that you are dictating to them over the phone. They have built-in a high propensity for errors (and more calls) doing this.

Yes, I agree. And isn't that unsecure? To be saying your password on an open/unencrypted phone line and then having a human type that manually into their computer - presumably with the screen open in a call center? Isn't the point of this to make it more secure?

 

[crvetter]

Yes, I agree. And isn't that unsecure? To be saying your password on an open/unencrypted phone line and then having a human type that manually into their computer - presumably with the screen open in a call center? Isn't the point of this to make it more secure?

I’m going to guess they send a reset link to your email after verification.

 

[J-Dog]

I’m going to guess they send a reset link to your email after verification.

Yes, hopefully. That would make sense.

 

[PalmettoPath]

Yes, I agree. And isn't that unsecure? To be saying your password on an open/unencrypted phone line and then having a human type that manually into their computer - presumably with the screen open in a call center? Isn't the point of this to make it more secure?

Very good point indeed.

 

[Ronaldo17]

 

[CarolynFH]

I’m going to guess they send a reset link to your email after verification.

That's what I think too - the email says (bolding added):

Members who need to reset their password will be directed to call Member Services at 800-800-9800 to initiate the password reset process

 

[mickeymom629]

I was hoping it meant that, if your pw doesn't already meet the criteria, you have to change it, or when you need to change it in the future.

It says "Members who need to reset their password..."

 

[gavvy]

Calling to reset a password when the hold times are already silly- that's a mad idea, and how is that more secure than email? Very odd decision

 

[ljhayes]

If this is the Disney OneID doesn't that seem to suggest I can still change it on Hulu, Disney+, DisneyWorld.com, Disneyland.com, ESPN, among the many others. Since they are all the exact same login/password combo and a change in one changes all of them.

It is a weird system overall, they went to this Disney OneID but seem to be doign the 2FA on a system by system basis rather than treating the authentication System (Disney OneID) as the place all the sites to should authenticate against with that having the 2FA.

Is there any chance we'll now be locked out of changing our pwd on the other sites?

 

[LadybugsMum]

So, it's now in effect. Anyone else having issues accessing the loans page? I can log in and put in the code to get the green check mark, but then just the blue circle of death goes round and round.

 

[Disney Spaz]

So, it's now in effect. Anyone else having issues accessing the loans page? I can log in and put in the code to get the green check mark, but then just the blue circle of death goes round and round.

We are having the same issue. I am not willing to sit on hold to fix this. Very frustrating!