Users of GotoWebinar getting immediate account locking when logging in..
Hi,
I have been talking with some internal teams and reviewing accounts in order to get a complete picture of what is happening.- We protect our customers by performing a risk assessment on every login - learn more here: https://support.goto.com/meeting/help/how-do-i-verify-my-login-g2m850064
- Recent improvements are more sensitive to account sharing and device re-use, which are common brute-force account take-over tactics
- For the vast majority of our customers this will have little or no impact
For customers sharing credentials, we see two common patterns appear high risk:
- From a single device, frequent logins with different credentials
- For a single email, multiple logins from differing devices (especially involving long distances between those devices)
In both instances, explicitly marking a device as trusted will reduce the risk and subsequent logins will not be denied. Learn more about managing trusted devices here: https://support.goto.com/meeting/help/how-do-i-manage-my-trusted-devices-g2m850096
When a login is blocked, email verification is typically required to proceed. Repeated offenses will escalate to the system assuming the account has been compromised, requiring a password reset to proceed. The challenge with marking devices as trusted is that it needs to be done after a successful login. Either the person in control of the email needs to login and mark all their colleagues devices as trusted, or everyone sharing those credentials need access to the email to successfully respond to the email verification challenge.
Once a device is trusted, it should not be denied access during subsequent logins. Also, devices cannot be trusted until one successful login attempt has been made.
Currently, there is no way to make an exception for certain accounts and disabling the security check would leave all customers at risk.
