Banking Protection Blocks Webpage Load After Login

Karibu

1. Banking Protection detects Self Service (fidelityrewards.com) and launches.
2. After login Banking Protection prevents:

• The loading of webpage elements, booleans and connected data that are imported by embedded html from servers hosting the content/data.
• The use of authentication apps (e.g. Authy, Google or Microsoft Authenticator are blocked from connecting to the network and this breaks them) that are required to be used as MFA to access certain webpage elements.

Solutions that have NOT worked include:

• Exclude fidelityrewards.com individual webpages from Banking Protection.
• Exclude the entire fidelityrewards.com domain from Banking Protection.
• Start the MFA authentication app before launching the webpage detected by Banking Protection.

The only solution that does work and permits use of the website combined with the required intra-page access requiring MFA authenticator app is:

• Disable Banking Protection entirely for the entire fidelityrewards.com domain.
  • Webpage elements populate.
  • User can obtain code from authenticator app.

PawełP

Hi @Karibu

Today I received a reply about your problem from the security department.

They have updated the category of the reported domain, but from the screenshot it seems that the webpage having issue is the member of area which we are unable to access.

So if the problem persists we will need to receive the diagnostic data.

I'll send you a private message on community forum.

Please check your inbox.

Kind regards

Pawel

PawełP

Hi @Karibu

Thank you very much for your post.

Let us discuss this problem with the security department.

I am sure we will find a solution to this problem.

Please be patient for a while.

Pawel

Karibu

Received reply from Support that fidelityrewards.com has been added to Banking Protection on the F-Secure side.

Despite this URL whitelisting, issues reported still persist.

Followed official F-Secure troubleshooting guide provided by Support, still issue persists.

Browser used does not matter... Chrome, Microsoft Edge, Firefox, Internet Explorer (which is no longer available on Windows 11).

PawełP

Hi @Karibu

Give me some more time.

 I'm trying to explain it.

Best regards

Pawel

Karibu

Problem persists.

I submitted fsdiag files as requested in private message.

Please let me know.

Thank You

Ukko

Hello,

Sorry for the discussion.

Is it possible that some CDNs (or any other third-party domains) are just not rated as safe for banking by F-Secure.

Could you check which one resources are loaded while you logged (and probably 'failed' to be loaded)? It is possible to do by using Browsing console (perhaps, usually, accessible via F12 button). As for MFA - I think it is also can be something as Iframes.. or similar loaded resources from the sides.

At least, with mentioned login page - I do see, at least, three domains (one of them is CDN-purposed) which are with some difficulties to get content from. But my set-up has a bit more tweaks about - so I am not sure which part will block something.

Karibu

The vast majority of U.S. financial websites use CDNs and most of them also perform re-directs to external webpages for certain functionality - such as money transfers or making credit card balance payments.

F-Secure Banking Protection is not blocking IFrames with regards to MFA. It blocks the Authy desktop app from connecting to its backup & sync server - which is required for it to generate a 2FA code.

F-Secure needs to contact Authy directly for infos.

PawełP

Hi @Karibu

Could you please check the situation now?

Thank you.

Pawel / F-Secure

Karibu

https://community.f-secure.com/en/discussion/comment/135924#Comment_135924

Hello Pawel,

It appears to be fixed for this specific website: www.fidelityrewards.com .

I will update here should any further problems happen for this specific website.

Thank You

Hei Pawel,

Se näyttää olevan korjattu tälle verkkosivustolle: www.fidelityrewards.com .

Päivitän tänne, jos tälle verkkosivustolle tulee lisää ongelmia.

Kiitos

Tere Pawel,

See näib olevat selle konkreetse veebisaidi jaoks parandatud: www.fidelityrewards.com .

Värskendan siin, kui sellel konkreetsel veebisaidil peaks ilmnema probleeme.

Aitäh

Witaj Paweł,

Wygląda na to, że zostało to naprawione w przypadku tej konkretnej witryny: www.fidelityrewards.com.

Zaktualizuję tutaj, jeśli pojawią się dalsze problemy z tą konkretną witryną.

Dziękuję

Здравствуйте, Павел!

Кажется, это исправлено для этого конкретного веб-сайта: www.fidelityrewards.com.

Я сообщу здесь, если возникнут какие-либо дальнейшие проблемы с этим конкретным веб-сайтом.

Спасибо

Karibu

Same problem:

www.huntington.com

(website of bank that issues its very own credit card; consumer makes credit card balance payments here)

www.myaccountaccess.com

(website of large international credit card issuer on behalf of many banks; consumer makes credit card balance payments here)

F-Secure Banking Protection prevents webpage re-directs and webpage content\elements from loading. Webpages are unusable while F-Secure Banking Protection is enabled for each website.