topic Re: 2FA + web app and API in Arlo Pro 2

2FA + web app and API

Locutus73 — Wed, 04 Sep 2019 19:44:11 GMT

Admins closed as resolved/implemented the discussion about the 2 factors authentication, because it's implemented in the iOS/Android app, but what about the web app and the API https://developer.arlo.co ?

I guess most attacks will use those surfaces and not smartphone apps.

Securing half of the system is no security at all.

Thank you in advance.

Best regards.

Re: 2FA + web app and API

JessicaP — Wed, 04 Sep 2019 20:35:46 GMT

Hi Locutus73,

The two-step verification works with the web client on your computer as well. You can read more about the two-step verification here: What is two-step verification and how do I set it up?

For the link you provided, that is from a training management software company, which is not affiliated or related by us.

Re: 2FA + web app and API

Locutus73 — Thu, 05 Sep 2019 05:28:32 GMT

@JessicaP Ok, the link (documentation) is from an external company, but the APIs exist (and is yours), can be used (I use them every time for integrations, i.e. changing mode or setting off the siren from HomeKit) and are very nice... but are APIs protected by 2FA (I really don’t know, I’m asking)?

If I was an hacker trying to compromise some account I’d try using API and scripting.

Thank you in advance.

Best regards.

Rif.: 2FA + web app and API

Locutus73 — Thu, 05 Sep 2019 10:23:14 GMT

I just made some tests and

Old authentication API doesn't work if we activate the 2FA (but still works without enabling it)
New authentication API lets register iOS/Android phones/tablets as trusted devices (not requiring further 2FA), but it doesn't (still) have a mechanism for trusting the web app, so users are required to confirm the login on the master iOS/Android device each and every time they access from the web

This way third party integrations require either

Disabling 2FA for the used account (usually a separate account from the master)
Enabling it and somehow mimic an iOS/Android device in order to be trusted and blessed forever
Wait for a mechanism in order to trust web app and mimic it

Thank you in advance.

Regards.

2FA with NodeJS Scripts?

rdkarlo — Tue, 20 Apr 2021 15:18:48 GMT

Hi!

I've been using a nodejs script with my arlo account to automatically download images from the cameras.

Now that my account has been forced to turn on 2FA, my scripts have stopped working.

Has anyone figured out how to get a RESTful APi client to work with arlo's 2FA?

Thanks,

Bobby

Rif.: 2FA + web app and API

rdkarlo — Thu, 22 Apr 2021 20:07:17 GMT

Hi!

I created a second web account but it looks like they force you to turn on 2FA and I don't see a way to turn it off.

Are you aware of a way to turn off 2FA?

Thanks,

Bobby