topic Re: Password Reset Form - No Support for .GOV Addresses! in Endpoint Security

Password Reset Form - No Support for .GOV Addresses!

johnlolis — Wed, 21 Feb 2024 17:09:02 GMT

Sometimes the mind boggles when there's a serious error where the cause and solution is well known, but you just can't get anyone to acknowledge the issue. That's what I've been going through with Cisco's password reset form for SecureX (https://sign-on.security.cisco.com/signin/forgot-password). The problem is that it doesn't recognize any email addresses ending in .gov (and no doubt many other TLDs). So I can't reset my password. In my dealings with Support, each time they've tried an MFA reset which never works and they completely ignore anything about the reset form being the issue. In my last message yesterday, I called the tech out on it asking why that was being ignored. So far, no response. Btw, the password reset form for this community forum works flawlessly, but with the the SecureX reset form, you can't proceed with a .gov email address if you try the SMS or Email options. If you choose, DUO, it'll let you proceed, but in my case, my old phone died, and DUO with it (at least practically speaking), so that's not an option for me. There was one other site I came across that exhibited the same behavior where it didn't recognize my dot gov address. It's speculated that somewhere out there is a library or class that lacks broad support for all the possible TLDs, and that's what's been used in these cases.

In any case, I thought I'd post here in the off chance that someone at Cisco will sit up and take notice.

Re: Password Reset Form - No Support for .GOV Addresses!

Matthew Franks — Wed, 21 Feb 2024 17:14:29 GMT

John,

Can you ask for your SR to be escalated so someone on my team can take a closer look? While waiting for that I'll make an inquiry to see if we do have an underlying issue regarding .gov email addresses.

Thanks,

-Matt

Re: Password Reset Form - No Support for .GOV Addresses!

johnlolis — Wed, 21 Feb 2024 17:39:35 GMT

Hi Matt,

Thanks for the response. The support number is SR 696842243. Here's what
I sent yesterday. I'll wait to see what the next response holds since I
pretty much suggested that the case be escalated:
*I appreciate your efforts, but why do you keep ignoring me when I tell you
that the password reset form doesn't recognize email addresses ending in
.gov? Regardless of fixing my login problem, *that form is still broken*.
If you escalate that fact, we might get somewhere if the form is fixed and
I can then reset my password.*

Thanks again. I'll let you know what transpires.

Re: Password Reset Form - No Support for .GOV Addresses!

Matthew Franks — Wed, 21 Feb 2024 17:40:22 GMT

Just wanted to update that we have an internal ticket open with the developers now to investigate but they stated there is no mechanism to prevent password resets for .gov addresses.

-Matt

Re: Password Reset Form - No Support for .GOV Addresses!

johnlolis — Wed, 21 Feb 2024 17:56:35 GMT

I suspect that the developers see no such mechanism on the back end of
things, that is, the code that processes the request; however, the form
itself returns an error that the email address field is blank even though
my address is clearly in there. I found if I changed the address to my dot
org alias email address (ending in @whiteplainslibrary.org), it gets
successfully submitted. The problem with that is there's no Cisco account
associated with that address. As far as the developers go, it could be
that they don't see an issue because their code points to a class or
library that actually lacks the TLD support, and they haven't delved into
that. It's gotta be there somewhere though.