Pearson, Edexcel, 2FA oh boy

[KK20]

In their wisdom , Pearson sent an email yesterday to say they are enabling 2FA on their exam submissions website. They were enabling them from yesterday. Smart move as there are drama, language and music exams that are needing submissions (and you get 48 hours), these are multi MB files that do take some time to upload (the drama ones are a bit hefty). Oh and its a bank holiday weekend too.

 

This morning our exams officer logs on, 2FA sent, code typed. Nope. Our exams officer is quite savvy, they also write SQL reports and know about 2FA - the fact we use it for our MIS and 365 means all our staff understand 2FA. They can certainly type a code into a web page. Second email sent with 2FA code, copied and pasted - nope. Exams officer panics a bit as there are a lot of submissions today, im called, I walk down. I suggest clearing cookies, using another browser for the final attempt. This is what we do, fresh email comes in, I see the code, I type the code under the watchful eye aaaaaaand - nope, your account is locked.

 

Phone them up, there is a wait time of approximately 50 mins at the moment. Im guessing there might be an issue with Pearson and their hastily rolled out 2FA midway through exams on a bank holiday weekend.

 

Anyone else having pearson issues today?

[PotNoodleTech]

Watching exam boards try to modernise IT is like watching your 80 year old nan trying to use the sky box for the first time.

[free780]

I never understand why these companies don’t just let you use SAML with your iDP(Google / AzureAD). It would be so much easier.

[CTIDTech]

Agree! My father in law is 82 and every time football comes on....I get a technical support call to get him where he needs to be.....EVERY TIME!

[DeGrimmy]

I had our exams officer forward the email to me, and then shortly after we were on the phone trying to work it out. She's not very IT savvy, but she knows how to use what she needs to use. Eventually, I explained that like when logging into other exam boards, she'll get a code in an email. Then, we tried it. The login page hung for at least a minute, Chrome kept flashing up "Page unresponsive" but eventually, it sent us the code. Thankfully, we were able to log in straight away after that.

 

It's insanity to me that they would roll out something like this *just* before the exam season begins - Why couldn't they have waited, or done it at least a couple of weeks in advance so it has time to bed in?

[Brax]

I had our exams officer forward the email to me, and then shortly after we were on the phone trying to work it out. She's not very IT savvy, but she knows how to use what she needs to use. Eventually, I explained that like when logging into other exam boards, she'll get a code in an email. Then, we tried it. The login page hung for at least a minute, Chrome kept flashing up "Page unresponsive" but eventually, it sent us the code. Thankfully, we were able to log in straight away after that.

 

It's insanity to me that they would roll out something like this *just* before the exam season begins - Why couldn't they have waited, or done it at least a couple of weeks in advance so it has time to bed in?

Ironically they sent out some documents about it and the words "we know this a very very busy time of year" were on there. Well... Why roll it out then?

[ozydave]

Pearson should not be allowed near anything IT.

[jthompson]

Thought I'd just tag on to the end of this thread. Our staff have been notified by Pearson that MFA will be required for their Pearson Portal accounts from today.

 

The guidance instructs users to install the bespoke Pearson Authenticator app from the App/Play Store. I'm hoping that it's just generic T-OTP and that other authenticator apps will be fine to use. Why there would be need for anything non-standard on that front I don't know, other than to make their onboarding and end user support less confusing (people often get confused when invited to use Google Authenticator in conjunction with a non-Google account, for instance).

https://support.pearson.com/uk/s/article/Logging-In-And-Accessing-Pearson-Services-Using-The-Pearson-Portal

 

Edit:

Reading a little more (https://support.pearson.com/uk/s/article/Pearson-Portal-Authenticator#Q2) it does look exactly like regular T-OTP. Maintaining and mandating a bespoke app seems like a mad decision to me.

Edited December 5, 2023 by jthompson

[Brax]

Thought I'd just tag on to the end of this thread. Our staff have been notified by Pearson that MFA will be required for their Pearson Portal accounts from today.

 

The guidance instructs users to install the bespoke Pearson Authenticator app from the App/Play Store. I'm hoping that it's just generic T-OTP and that other authenticator apps will be fine to use. Why there would be need for anything non-standard on that front I don't know, other than to make their onboarding and end user support less confusing (people often get confused when invited to use Google Authenticator in conjunction with a non-Google account, for instance).

https://support.pearson.com/uk/s/article/Logging-In-And-Accessing-Pearson-Services-Using-The-Pearson-Portal

Could've sworn our exams officer used the Microsoft authenticator already for Pearson not sure why they need a seperate app. Regardless I've pushed the app to the iPads for staff that need it.

[jthompson]

Could've sworn our exams officer used the Microsoft authenticator already for Pearson not sure why they need a seperate app. Regardless I've pushed the app to the iPads for staff that need it.

 

I'm waiting for our exam officers' accounts to kick in with the T-OTP requirement, so that I can determine whether the Pearson app is required. If it's not, then I'll just circulate my standard T-OTP guidance to other staff, where I remind them that the Authenticator Chrome extension is available for them to use if they prefer to not have their mobile involved.

[Boredguy]

Already had one of the music teachers asking for the app to go onto the school iPad he has. Pointed out it's better on their personal phone otherwise they won't be able to logon elsewhere otherwise

[jthompson]

I've used a generic T-OTP authenticator (FreeOTP+) with Pearson, and it does work. One slight difference I noticed was that where T-OTP tends to use SHA1, in Pearson's case they're using SHA256 so I had to adjust that manually for an authenticator app (KeePassXC) where the setup was done manually rather than via a QR scan. Edited December 12, 2023 by jthompson

[jthompson]

Testing a bit further, Google Authenticator works correctly with Pearson accounts, but Microsoft Authenticator does not. Microsoft Authenticator generates codes using SHA1 only, it would seem, whereas Google Authenticator read in the correct algorithm to use (SHA256) from the QR scan.

[Brax]

Our exams officer has got the hang of it now. Thankfully we're in the process of switching to iPads here so were able to supply the exams officer with a device. Using microsoft authenticator for pretty much most of the boards rolling this out.

[jthompson]

Testing a bit further, Google Authenticator works correctly with Pearson accounts, but Microsoft Authenticator does not. Microsoft Authenticator generates codes using SHA1 only, it would seem, whereas Google Authenticator read in the correct algorithm to use (SHA256) from the QR scan.

 

It seems that Google Authenticator now can't be used for Pearson T-OTP. Trying to onboard a member of staff here the other day, and Google Authenticator wasn't reading the QR being displayed on the Pearson webpage. I'm fairly sure that it's worked in the past, judging by me earlier posts here.

 

I wonder if Pearson have moved to deliberately make their system incompatible with it, ramming some extra stuff into the QR code to scramble the data and make it readable only by their own app. Google Authenticator is still able to scan in a QR code that specifies use of SHA-256 (MS Authenticor can not, and instead generates incorrect 6-digit codes). Using https://stefansundin.github.io/2fa-qr/, I generated a QR based on my existing Pearson MFA secret, using SHA-256, and Google Authenticator still scans it and generates the correct codes as a result.

 

Thanks Pearson, you're shifting your user support responsibilites onto people like us.