Mandatory Two-Step Authentication (Verification) a Bad Idea

[ChrisKay]

Making this mandatory is an exceedingly bad idea since it will slow down authentication and when it breaks—and it occasionally will—it will prevent access completely.  At least give the end-user the option of deciding how much protection to require for the account.

[dcfox1]

---

@Oldgeezer56 wrote:

I have tried to use 2FA on my PC but where does it allow you to default to an email instead of SMS which I cannot use due to bad cell coverage? 

---

I replied to you question a page back on the 14th, did you try that work around. 

[Oldgeezer56]

Thanks dcfox1.

My programming background thinks it is illogical to enter a phone number that I will not be able to use. However I tried it on my PC and there is no other option showing.

[smartypants123]

You know when 2FA is really great? When you change phone numbers and you no longer have access to your old phone. SMS for 2FA is what happens when geeks are driving the bus and companies trust the geeks over their customers. Arlo, you suck. I have posted at least two dozen times on my social media pages warning people against your products. And I am that guy who all my friends and family trust for tech advice. You are making a massive mistake. LISTEN UP!

[BigPoppa]

It's the middle of the night and you are laying in bed when you hear a noise at your front door.  No problem, you think, I have Arlo cameras watching my front door.  So you grab your laptop from the nightstand and:

1) Use the link to the browser page that shows your cameras.
2) You type in your username
(BAM BAM, more noises out front. )
3) Type in your password
4) You are prompted for 2-factor authentication
5) You leave your bedroom to get your cellphone from the charging station in another room

(You hear glass break.  Is that my car in the driveway or is someone breaking my window?  You hope it is just someone throwing a bottle in the street.  Hopefully, you will know soon as you are waiting for a text message from your cellphone carrier now.)
6) Finally the text message comes in.
7) You need to use it to verify your identity with Arlo
(You hear a car revving its engine and spinning its tires as it squeals off into the distance)
8)You are in!  You click on the camera you want to see a live view from
9 CONNECTING.....   connecting...    "Please Wait"  appears on the screen.  You hope it doesn't fail to connect like this time as it often does. 
10)  SUCCESS!  It didn't fail to connect this time.  This is the fastest you could hope for to see what is going on outside with your Arlo system that you spent nearly $1,000 for.  Oh no...   you can see that your front door is wide open, meaning they were inside your house and your car is no longer in the driveway.  All that remains are some black marks from when the burglar spun out.   All of this happened in the time it took to access your Arlo camera.

This is the copy I suggest we all paste on our social media if Arlo does not fix this REAL WORLD issue.   That, or refund me my money as you are no longer providing the service that you sold me.

[smartypants123]

Exactly! What are these buffoons thinking? A "security" product is now just something your kids can watch your murderer escape on. There's you liability, Netgear. I couldn't access my camera fast enough because of your idiotic policy and my child was abducted. I am flabbergasted by this 2FA mandate.

[Chris67]

So where is Arlo’s contribution to this “discussion”? I know they moderate these forums so why the silence? If they hope it is all going to go away they will have a rude awakening when 2FA is made mandatory on 30^th September  and the full impact on customers becomes clear. Those many customers using PC’s or Tablets without cellular to monitor their cameras will have to jump through hoops to gain access and there is going to be an almighty kickback which will severely damage the Arlo brand. Is Matthew McRae aware of what’s going on here? Arlo please give us some feedback and hope by either allowing us customers to switch off 2FA or identifying PC’s and tablets without cellular as trusted devices. ARLO PLEASE RESPOND!

[thepom]

Well, I've tried their 2FA - doesn't work at all well for me. I always use 2FA when available, but every other implementation doesn't cause me unnecessary grief.

As I haven't left a review of Arlo on Amazon yet, if they don't sort it out before it becomes mandatory, guess what kind of review I'm going to leave?

Kinda goes "Nice hardware, but let down so badly by unreliable and badly implemented software that it's useless".

Anyone else fancy this path of justice?

[stevebos]

Two-step verification is overdone. I agree with others complaining.  No trusted device availability.  I have used my desktop and the main viewer for cameras.  Now, every time I use the same computer, I need to get a code.  Horrible way to treat people who spend $several hundred dollars for this product.  Fix this Arlo (Netgear!) 

[ScottSAZ]

Since Arlo (Netgear) doesn't have a customer feedback form, email address or even a telephone number on their web site to give them feedback or comments (which by the way says a lot about a company that doesn't want customer feedback), I opened a support ticket and wrote a letter to the management of Arlo giving them my feedback on 2FA and how it sucks as implemented and how they will lose me as a customer if they force me to use it. I had Ring and went to Arlo when Ring's product started to suck. Maybe flooding the support group with messages about 2FA might wake up Arlo management.

[smartypants123]

Everyone on this thread shod open a support ticket about 2FA. They need to hear us loud and clear.

[BigPoppa]

If anyone can navigate the maze they have in place to hide getting actual support

[Macahi]

When Arlo stops responding, they know we're right, but they won't change.  They have nothing to add and they don't care.

The fact that Arlo refuses to authenticate desktops is more proof (along with all of the other really miserable changes they've made to desktop) that they're trying to push us away from desktop.  They don't want to code for it and they don't want to support it, but it's really the best choice for many of us.  I think they believe that the more of a miserable experience they make using the desktop, the more of us will give up and stop trying.  What they're not understanding is that all of these poor decisions are just driving all of us away from their product completely. 

I am in the process of looking for a replacement.  Arlo is way too slow to be of use to me.  Arlo is way too restrictive in how I need to use it to be of use to me.  As I expand my system, it's going to be 100% going to another product.  I'll just trash what I have or give them away.  I can't in good conscience sell them to anyone else and put them through this miserable experience.  I am also 100% recommending against Arlo to everyone I speak to. 

[Chris67]

"When Arlo stops responding, they know we're right, but they won't change.  They have nothing to add and they don't care".

You are absolutely spot on with your observations. Unless Arlo allows 2FA to be turned off or desktops to be seen as trusted devices, the full extent of their decisions will become clear in 1 weeks time. It will not be pretty. At least they provide these forums to make our views known.

[trickytcamgeek]

It is impossible to do the verification if you have an iPhone 11 (maybe other models too). As soon as you Pull down the menu to get the SMS code, you lose the login page on the App. When you click login again it sends you a new code, which you can’t see until you pull it down, taking the app off the login page again. You go round in a perpetual circle but can never put the code in before it has sent you a new one. This is the second fiasco with Arlo (after the app upgrade about a year ago). Bad move Arlo!

[OldManKnees]

Same with iPhone SE (the older one). I thought it was an issue with the small screen but I guess not. That’s something that should have been sorted out with even the most basic testing.

[trickytcamgeek]

No point in contacting support. It is outsourced to a call centre in the Philippines. The person you speak with is not an Arlo employee. She just had a checklist of instructions Depending on the problem. Mostly the response you will get is “try unplugging and restart blah blah blah...”. You might as well to a ten-year-old.

[trickytcamgeek]

The message from Arlo says that users are REQUIRED to use 2FA. For so many reasons this is a very bad idea. Deaths will occur which could have been avoided. I hope the families of the victims sur Arlo.

2FA should be optional not mandatory.

If you only use an iPhone, you will lose access. You won’t be able to use the App. I can’t believe this wasn’t tested.

If you set up 2FA and only use an iPhone you will permanently lose access because you can’t switch 2FA off unless you are logged in. You can’t login because the 2FA sends you into a perpetual circle. So basically if you turn it on, even once, your whole system becomes toast.

[ant]

---

@ScottSAZ wrote:

Since Arlo (Netgear) doesn't have a customer feedback form, email address or even a telephone number on their web site to give them feedback or comments (which by the way says a lot about a company that doesn't want customer feedback), I opened a support ticket and wrote a letter to the management of Arlo giving them my feedback on 2FA and how it sucks as implemented and how they will lose me as a customer if they force me to use it. I had Ring and went to Arlo when Ring's product started to suck. Maybe flooding the support group with messages about 2FA might wake up Arlo management.

---

FYI. Netgear doesn't own Arlo anymore as of the end of 2018: https://investor.netgear.com/releases/press-release-details/2018/NETGEAR-Completes-Spin-Off-of-Arlo/....

One week left before we are forced to use 2FA. 😞

[oillogger]

The natives are restless and I can hear a big "Uh OH!!!", from 319 employees at Arlo Technologies, 330 Orchard Parkway San Jose, CA.

[george852]

Simple as that:

Arlo😇 / Netgear😇 collect Client's Phone Numbers and they certainly intend to use this info in the future. 😇

They could easily have

• integrated 2FA with Google Authenticator, but they insist having a phone number, (a very personal information), from their customers.....
• saved a lot of money, as SMS cost money, G-Auth ist free.
  So having your number is worth more, than SMS cost....

Now they😇 / Netgear😇 even starts to force registration for Networt-Switches.......

https://www.golem.de/news/netzwerk-netgear-fuehrt-kontozwang-bei-switches-ein-2009-150979.html

You don't register --> You may only access all functions in web frontend 3 !!! times and then you only get limited functionality.

Make up your own minds about Arlo😇/Netgear's😇 strategy😇 for the future 🤢......

[ag100]

Sadly, I too have opened support cases about this only to discover that anyone that interfaces with the customers really have no idea of what's going on. Having given up, and having no intention of continuing to pay Arlo monthly fees for the pleasure of dealing with their support, I, as some others have mentioned, plan on replacing my Arlo system as soon as I find suitable replacements. For those that have replaced their system, which solution did you replace yours with? Thanks!

[SCKG]

UPDATE:  Arlo Technologies has yet to respond to the complaint I filed with the Better Business Bureau.  They were asked to respond by October 18th.

Complaint ID#: 830017
Business Name: Arlo Technologies, Inc.

You recently requested our help concerning a problem with the company named above.

The company has not responded to BBB to date. If your complaint has been RESOLVED, please let us know by accessing your complaint via the link below.

We encourage you to use our ONLINE COMPLAINT system to keep up with the progress of this complaint.

Sincerely,

Elizabeth Espinosa
Business Development Specialist
BBB Complaint Department

[oillogger]

SCKG,

Please keep us abreast of the developments with your BBB Complaint ID#: 830017.  I would like to also see the initial content of your complaint if possible.

[SCKG]

I posted a second complaint - Arlo has two listings on the BBB.  The second complaint will eventually be posted here:  https://www.bbb.org/us/ca/carlsbad/profile/security-cameras/arlo-1126-1000061663

Here is the gist of the complaint:

Arlo is requiring that existing customers purchase a cellphone to comply with their new mandatory two-step verification procedure. Arlo makes security cameras for indoor use that one can access via the internet. For example I can monitor my disabled partner when I am in another room in the house. Arlo just issued a mandatory requirement "that all users must enable two-step verification : an added layer of account security to verify that it's really you, even if someone knows your password. Once authenticated, Arlo will verify your identity any time you sign in with a new device, to prevent unauthorized users from accessing your information." Arlo intends to initiate this verification via text messaging (not email). My issue: I purchased this product several years ago and there was not a requirement that I have a cellphone with text capability to access the online data. By imposing this new requirement those of us without cellphones will no longer be able to access the online data, rendering their product useless. It is an unnecessary burden for Arlo customers to have to purchase a cellphone with text messaging. Other companies have resolved this issue by enabling two-step verification via email (no cellphone required). I have contacted Arlo regarding this issue and there position is "if you don't have a cellphone you cannot access the online data". It is an unfair practice to change user requirements after one has purchased their product; and is particularly insensitive to the needs and abilities to the disabled and the elderly. Additionally per the Arlo forum there are over 200 complaints identifying issues with those customers who have tried to implement the two-step verification procedure and have encountered serious problems. Numerous customers including myself have contacted Arlo customer support to no avail. Thank you.

Desired Outcome:

Arlo needs to either:

a. make two-step verification optional or

b. permit users to enable two-step verification by email or

c. refund prior purchases due to this new requirement.

[Retired_Member]

I use cron to run a Python script daily to automatically check the battery level of my Pro 3 cameras and send me an email if the level drops below 20 percent. This will not be possible if mandatory 2FA is implemented. Please keep it optional.