8

I am a graduate student at a university in California. The university is planning a policy change which will require me to use a "hardware token" (a little device which generates one-time passwords) to login to any university online resources, including the services which allow me to view and pay bills. I find this rather concerning, because I often find myself needing to access university resources at unpredictable times, and I cannot guarantee that I will have the hardware token available when I need it. Do I have a legal grounds for complaint?

It seems to me that if it were legal to require people to use hardware tokens for accessing and paying bills, then everyone would do it (e.g. banks). But it is quite unreasonable to expect people to have hardware tokens for every service they use.

To be clear, I'm not proposing to sue my university, only to complain and encourage them to provide alternatives to the hardware token.

  • 9
    You should be happy that your university is increasing their security profile as you are a direct beneficiary. All too often I deal with the opposite view through the telescope where people are victims due to lax security standards (e.g. Equifax with more than 143 million victims). Also consider that this token regime is de rigueur with many European banking institutions. The minor inconvenience is no longer perceived by their customers due to the recognized enhanced security of their assets and private information. – Glenn W9IQ Mar 8 '18 at 1:08
  • 35
    Hardware tokens for generating one-time passwords have been around for 20+ years. (I've been using one to connect to the VPNs at work since 2000.) "I find this deeply concerning, because I cannot guarantee that I will have the hardware token available when I need it." Are you deeply concerned because you cannot guarantee that you will always have your car keys when you need to drive the car? Or your apartment keys when you need to go home? – RonJohn Mar 8 '18 at 1:39
  • 11
    Your university likely requires you to use some kind of token (student ID card, keys, etc...) to access certain buildings, labs, offices, etc... That's equally concerning, because you cannot guarantee that you will have it with you when you need it, but the university expects you to make due. Why doesn't the same apply here? – Zach Lipton Mar 8 '18 at 3:02
  • 2
    "need to take the token with me everywhere." How often do you have to pay bills? (Maybe our definitions of "everywhere" are different.) "Bills can be due when I'm away from the university (e.g. over winter break)." So, bring the token home with you. Phone, drivers license, car keys, apartment key... you've got to carry them with you everywhere. The token (RSA?): not so much. And if you really do need to unexpectedly need to give money to the Uni at the drop of a hat... well, carry it with you. – RonJohn Mar 8 '18 at 3:46
  • 3
    Some hardware tokens can be replaced with a phone app (e.g. Google Authenticator or similar). It might be worth asking if this option is available. – Steve Melnikoff Mar 8 '18 at 12:29
36

There is little prospect for suing over this measure. The university has a legitimate interest in verifying that access to online systems is only granted to authorized users, and simple passwords are considered to be insufficient. (I don't intend to argue about password technology, I'm just making the observation that two-factor authentication is better than single-factor authentication). I have not encountered this requirements in US banks yet, but I have encountered it in Norway where an online transaction always requires with a password and a code generated by a gadget of the type you alluded to.

I surmise that your university mandates that all payments be done online, which means that you must have access to a computer in order to pay a bill. It is not reasonable to expect people to have a computer that is connected to the internet at all times, but it is reasonable (and often done, by universities) to expect people to be able to so connect some of the time. So likewise, it is not reasonable to expect that people will have their authentication gadget available at all times, but it will be available some of the time, and thus there is no insurmountable impediment to paying the bill (or accessing the library, or reading email...).

These gadgets do, however, potentially run afoul of ADA, but presumably they know that and can make accommodations.

  • 24
    I sincerely doubt that the university mandates that all payments be done online. There is almost certainly an office where one can pay one's bill with, e.g. a check. Otherwise a great answer +1. – sharur Mar 7 '18 at 19:49
  • 4
    Pretty much every bank in the UK requires some form of two-factor authentication, although the exact method varies from bank to bank. – Tim B Mar 8 '18 at 10:14
  • 1
    We have a similar system in Denmark for sites that require identification too: every government website, every bank website, and many other public-service websites use a login system that requires you to have a credit-card sized list of unique codes on you (with the option of using a code generator as described in OP). – Birjolaxew Mar 8 '18 at 12:20
5

I'm pretty sure any judge is going to give them broad leeway to the business to self-determine the manner in which they secure their electronic systems.

Where your argument disintegrates (or coalesces) is what may be blindsiding you: There's more than one way to pay a bill. Or there ought to be.

The court system is an entity that runs on paper. And it runs on physical service. The court is going to have zero sympathy for the argument (from the college or a millennial) that "online is the only way to pay a bill". That will be seen as an idle preference and certainly not court enforceable.

I mention this because this is the perspective from which the Court will see your problem:

For over a century, the normal way of doing billing is for a business to mail a paper bill (typically once a month on specific dates) and grant 20-30 days for the recipient to pay it by postal mail. The time is for postal transit both ways, and to allow the customer to gather his mail and sit down and pay bills at sane intervals (e.g. twice a month). If you look closely at e-bill mechanisms, you'll see they are abstractions of this.

As such, taking a 15 day sabbatical isn't a problem - just check your mail and pay every bill you have, then do it again promptly on return. You can extend this to 45 days if you know what bills you are expecting. Not knowing which bills to expect is a bit alarming!

If you overpay a service bill such as a gas or insurance bill, the money is still yours. It is carried as a credit on your account, and applied to future bills. The college should do exactly the same thing. (I only pay my gas bill about once a year.)

Also, once you become a student and enter normal billing, it's likely the bill comes due after you've started the service. That makes it a debt. Cash is legal tender for all debts public and private which means the university cannot refuse.

So -- the questions that will come up in court:

  • Why can't you act within the normal billing cycles (as I describe above)?
  • Why can't you pre-pay expected bills (again as I describe above)?
  • Why are you frequently being caught by surprise by bills (are you not aware when you contract services)? This makes you look oblivious.
  • Why can't you receive bills by paper mail and pay by check? (no 2-factor authentication).
  • Why can't you walk into the billing office, ask for a printout of your bill, and drop off or mail a check or cash?

I don't think you'll have credible answers for those questions. If you do, I'd say you have a case.

4

As a graduate student at a UC school, you are a private customer of business run on behalf of the State of California. Given private contract law and the general framework in the USA and California, I think they can require that customers pay bills by using two factor authentication as there are not any laws that explicitly forbid it.

In general, to sue you must have standing and show damages. I don't see how the risk of forgetting your hardware token rises to an actionable claim. Until you have shown damages, I don't any reasonable claims here. I'd expect the courts to ask if it was as sound and reasonable policy and dismiss the claim.

Your second paragraph doesn't follow. Setting up two factor authentication costs money, so not every origination would want to do it. It can be cheaper to either pay the costs from authentication fraud or to move the risks and costs to someone else. See how the credit card industry deals with this. Credit card holders have little to no liability on stolen cards/numbers (bank makes you whole). Also note that many credit card companies will make the vendor that took the card pay them back for the bad charges if the vendor can't prove the charge was from the actual card holder.

Also, FYI, suing on cases like this are expensive and a distraction. There are many better ways to solve problems than to sue your school because you are worried that the security policy it too tough. Have you talked to anyone in the school administration about this issue?

  • 2
    "It can be cheaper to either bare the costs or to move to risks to someone else." I think you've got a few typos in that sentence. I would suggest an edit, but I'm not actually sure what you meant. (Maybe "bear the risks" and "move the costs to someone else"?) – Wildcard Mar 8 '18 at 2:46
  • It can be cheaper to either bare the costs or to move the risks to someone else. I think, @Wildcard. – TRiG Mar 8 '18 at 11:34
  • 4
    I hope @Walter is clear about his 2nd Amendment right to bare arms - the Constitutional guarantee of tee-shirts. – Oscar Bravo Mar 8 '18 at 13:40
  • 6
    @TRiG : "bear the costs" - ("to bare" is "to make naked", "to bear" is "to carry"). – Martin Bonner supports Monica Mar 8 '18 at 13:44
  • 1
    To expand on your answer, you could only sue after damages, meaning you might sue over a late fee, and in that case you would be arguing that with the hardware requirement, you were not given reasonably sufficient time to pay the bill. In such a case, a phone call to get the late fee waived may be sufficient. – Cort Ammon - Reinstate Monica Mar 8 '18 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.