How to fix some glaring issues for Koodo's site

1. Most of the maintenance happens at night time though. It is just part of the process. CRA turns off their website 3 hour/day as well.
2. Do you have any good suggestion to defend bad actor who is using VPN from foreign countries? 
3. Can you share the detail of the scenarios where you had issue with 404 code?
4. MS authenticator or Google aren’t Koodo product though. Maintenance and glitch can also happen at anytime.

1. Timing. Don’t send text messages stating that your bill is ready but have maintenance ongoing to prevent login.
2. Just don’t. As a bad actor a VPN is pretty low level. Bad actors are often going to be in control of other machines, a botnet or some scammer that reverse shelled into a mark. To coordinate the attack through a patsy instead of a VPN would make everything appear legit. So by mandating that people not use safe browsing and security is a problem. Similar, if Koodo said that you could not log into their site if you use an ad blocker would be equally egregious. Despite the fact that the FBI and CSIS recommends people use VPN and ad blockers as a major vector of infection is malicious ads.
3. Sure, just go ahead and reset your password. The email that comes to you will have some links that work and some that do not. The Contact tries to go to koodomobile.com/contact which does not exist. Same with their “Thank you for payment” email. The Legal, contact us and UNSUBSCRIBE are broken links. Facebook, X and youtube work. So it is obvious that koodo has their priorities straight.
   1. Looking at the Unsubscribe, that would make Koodo out of compliance with CRTC CASL legislation.

   2. We should probably report the Broken Unsubscribe Link.

      1. If you encounter a broken or non-compliant unsubscribe link, you should report it to the CRTC's Spam Reporting Centre (SRC). The complaints submitted by Canadians are a vital source of intelligence for the CRTC's enforcement activities.

4. Yes, they are not koodo products, but enough fortune 500 and other companies use is as part of their RDP and VPN access protocols. Logins to mission critical services. You saying that industry recognised processes are insufficient is in a realm of its own. I would be more wary of a proprietary solution for a company that has shown that emails and login solutions are hard.

1. Could you share the instance where you experienced issues with both text and access to self-serve at the same time? Was it related to using a VPN?

2. Are you suggesting we remove some security measures just to allow unrestricted VPN use? That seems perplexing to me. You could try switching your VPN server to a local Canadian one to see if that helps. Also, could you share a link from the FBI or CSIS regarding VPN usage?

3. I haven’t encountered that issue myself. If possible, please share a screenshot of the email—just be sure to hide any personal information before posting.

4. I’m a bit confused by your suggestion. First, you recommend removing the VPN, and now you're suggesting adding another complex app just to login? Asking users to install an extra app just to log into a website seems like a bigger burden than simply disabling the VPN.

    

CSIS would never tell the broad public to use VPNs in Canada as that would make their mass surveillance efforts more difficult. Internal government gets that recommendation as well as perhaps international travel recommendations. The Canadian Centre for Cyber Security does issue guidance for businesses for network protocols tho.