This new authentication way of logging in is straight garbage

[tscove]

I get what toast was trying to do with logging in mobile, letting your devices security (fingerprint or face) log you in "faster" but it's literally now an EXTRA step to login EVERY time. 

Why if I authenticate with my fingerprint, do I STILL get the captcha stuff? How dumb is that, I just proved I am not a robot, also it's not integrated into my phones platform so it doesn't of course just populate my authentication then login no, my phone has to ask if its okay every time then loads to a new screen then of course can't forget the Captcha my god no what if the robot's got my face somehow.

Seriously, the webapp isn't great but logging in before was at least somewhat easy. How long do we need to wait till there is a dedicated app for us to check/see toast reports? Square and Lightspeed both have these and they're slick as all get out. Toast could do this if they want but they just continue to not or say "oh we're working on one" bull.

Please, I am begging you, make it faster to login on mobile. Cut the incessant captcha stuff after it's been even an hour. Even my bank in't that bad.

/rant

[Penguin_Meg1]

What are the basic office needs that you have those accounts set up to do? I have tried altering permissions for the most basic access levels for my assistant front of house manager that basically needs to do labor (checking clockin and outs) and sales summary for pm drawer counts. It still does not allow for turning off multi-factor authentication.

I was initally told that if the employee doesn't have permission 8.1 & 8.7 then they could turn it off. That proved to not work. Upon calling again they customer care agent said ALL toasttab logins are going to be required to have it regardless of permissions. 

[Penguin_Meg1]

escoop:

All I can say is I feel your pain. I have started a case # with Toast support voicing my frustration because my managers are all pretty upset with this login situation. For us it has shown to be less secure and not functional in a restaurant environment so I feel like there must be some ways we can play with permissions so the multi authentication doesn't have to affect ALL my MODS.

I plan on calling Toast daily, if time allows, to be the squeaky wheel and hopefully get this issue escalated. If I get any new information I'll come here to update.

[Penguin_Meg1]

I'm sorry this info isn't more helpful but it's what I've found out at this point.

After much time spent on the phone with Toast POS and Toast Payroll there is not a way to turn off multi-factor authentication for people who do not have access to financials, because they are making it so that everyone who logs into TOASTTAB will have to have the multi-factor login regardless of their permissions.

My main concern is that this switch over has made my Toast Payroll account that is HR+ much LESS secure than it was before due to the fact that Toasttab does not automatically log out if it's been inactive for a period of time. If Toasttab doesn't logout then Toast payroll doesn't logout.  This is much less secure when you have MANY managers using the same back office computers.

My managers are also having a lot of issues with Toast Login allowing them to login at all. It get stuck in a loop of login process.

I have a case number open that I am using as a reference and submitting a feature request daily for the issues to be solved with some urgency.

[KellyLynn01]

You're right, it is a fairly long process to log in, but the way I look at it is that Toast is helping not only protect my business's security, but the security of all my employees information (bank account numbers in payroll, tax forms, etc).  I know this isn't the solution you were looking for, but it really does help to think about it in the way that I know we're doing everything we can to keep us all safe!

[Penguin_Meg1]

I don't expect Toast to care about he how inefficient of a system it is when it comes to security. Protecting our information is top importance. My problem is that it has made things MUCH LESS secure.  I have and will continue to put in customer care cases with Toast support until something changes. The way it is less secure, is if someone forgets to logout or steps away from the computer and how Toast Payroll and ToastTab are now linked.

Let me explain:

I know most restaurants operate under these circumstances. Many managers using the same back office computers- Assistant Managers to ADMIN using the same computers at different times. Restaurant people also don't spend a lot of time at the computer, they need to jump onto toasttab to pull numbers from sales summary, or review time entries, product mix reports, lookup a ticket. Most things are about 5-10 min on the computer and then jumping off it, usually under a time constraint. And about 50% of that time you're on the computer you get interrupted because of one thing or another (customer issue, repair issue, staff issue, etc.).

If a manager forgets to close out their toasttab then payroll is now accessible through their toasttab and toasttab doesn't TIME OUT. Toast Payroll used to time out and close out if you were inactive for 15-30 min. Toasttab however just stays open. So it doesn't matter if there is a mulit-factor authentication if toasttab is left open for any reason everything is open for whoever sits at that computer next. 

I have seen this happen in multiple ways.  Here is one: My general manager logged into her toasttab to do the drawers at night and got pulled away at the end to take care of a closing issue and forgot to log out. The computer went to sleep and I came in the next morning and her toasttab was still open. I wanted to test the security. I clicked on the payroll link in her toasttab and no problem it opened up her payroll account which is an HR+ and asked for no multi-factor authentication. I then closed the browser tab with toast payroll. Went back to toasttab and logged her out. I logged myself back in with multi-factor authentication in toasttab. Clicked on Toast payroll and once again HER TOAST PAYROLL access opened up.

The are a few more examples that I have given to toast that are just as alarming.

I am saying all this because I am pleading with Toast POS and Toast Payroll almost daily to fix this serious lack of security. Toast listens if we speak up as customers. They are made for restaurants and they change to make us better. This change is not better and the more I can be a squeaky wheel I will do it.  As much as the login process is inefficient that is not the point.

Toast engineers, this system has had unintended consequences that can be solved by making Toasttab time out of sessions.