Mandatory Two-Step Authentication (Verification) a Bad Idea

[ChrisKay]

Making this mandatory is an exceedingly bad idea since it will slow down authentication and when it breaks—and it occasionally will—it will prevent access completely.  At least give the end-user the option of deciding how much protection to require for the account.

[Chris67]

@SCKG wrote:

RE: "I posted a second complaint - Arlo has two listings on the BBB.  The second complaint will eventually be posted".

Thank you for taking the trouble to follow this up with BBB. However, having 2FA delivered via email would make no difference to my restricted access to cameras etc. on desktop. It would even be slower than SMS for me. Desktops need to be able to be identified as secure devices for the purposes of timely access to my.arlo.

---

".

[SCKG]

I updated my complaint to include your comment.  Although, frankly, I don't believe that Arlo will respond...

[HogRyder]

Since ARLO won't respond to its customers, someone should create an ARLO SUX group on social media over this 2FA thing!

[ScottSAZ]

Well, I got a response to my support message which was in fact a complaint letter to Arlo management. Below is the answer I got and my follow up reply to there so called support. I will be filing a compliant with the BBB as well, that was a great idea. I have never done that before but I will for this issue. 

Answer from Arlo to my support ticket:

Dear, Scott.

Good Day!

Thank you for contacting Arlo Email Support. We sincerely apologize if we were unable to respond to your email right away. Due to some issues, we were unable to access our email cases which therefore left us unable to see pending updates. Rest assured that I will provide all the necessary steps to help you resolve this issue.

I understand your feedback about the two-step verification and in regards to the rules it might cause that the Arlo app is outdated or the OS version of the web that you are using is outdated. However, we still mandates our customer to enable the two-step verification. To better assist you on this case, please do the following instructions on the link below:

• Why am I required to set up two-step verification on my Arlo account?
https://kb.arlo.com/000062407/Why-am-I-required-to-set-up-two-step-verification-on-my-Arlo-account

• What are the minimum requirements for installing and using my Arlo system?
https://kb.arlo.com/000062043/What-are-the-minimum-requirements-for-installing-and-using-my-Arlo-sys...

Furthermore, kindly provide us the following information to better assist you in this matter.

• Serial Number of Base Station/Smart Hub
• Date of Purchase
• Place of Purchase
• Proof of Purchase
• Phone Number

For other support options please visit: http://www.arlo.com/en-US/support/contact.aspx and refer your case ID 41941876
We are open from 6AM – 6PM Pacific Standard Time.

Your response with a detailed result of the steps provided is much anticipated. We hope to hear from you soon.

Sincerely,


Abby
ARLO Support Expert
Support Site - https://support.arlo.com
Community site - https://community.arlo.com

My reply:

I don't need to provide you information about my products because you already have them. If the 2FA is implemented and forced on me to use the solution is simple. I cancel my fees for the cloud storage of video, and I replace the cameras with another product. There are a lot of people very upset with this mandate and will be doing the same. Without customers you don't have a business.

[Chris67]

What a garbled reply from Arlo. It in no way addresses the major issue, which is mandating 2FA using SMS and making it impractical for desktop or impossible some iphone users to access their cameras, library etc.

I don’t know how you would provide Arlo with “a detailed result of the steps provided”. What exactly are the “steps provided”? Good luck with that one!

It is frustrating that our concerns are not getting through to senior management as highlighted by this reply from an underpaid call centre operative in the Philippines.

[MikalB]

I cannot believe that this company has had a year to fix this issue and they have done NOTHING.  I also cannot believe that a company that relies so heavily on technology, is so technically inept.  

I am a fan of 2FA in general but not if it doesn't work.  I set it up last year when they first introduced it and immediately turned it off because it would not consider any devices Trusted Devices.  I had to get a code sent every time I used one of my four ways of accessing my cameras.  Support was absolutely no help.  Asking their normal questions that they already have the answers to and simply hoping they will put you off long enough so you will either figure it out yourself or simply give up.  A year later and nothing has changed.  I still have to get a new code each time I try to access cameras from my MacBook.  Support assured me that this is not the case and once a device is trusted, you do not need to enter another code...BS!

I currently manage over 50 cameras on my property, on four different camera systems.  This is the last straw with Arlo. I am done.  There are so many better systems out there.  It will be well worth the investment to buy new equipment for a system that actually works and that actually has a customer service department who understand and try to help solve problems instead of trying to tel you that you are doing it wrong and hoping you just go away.

[SCKG]

It is unfortunate that Arlo systems are highly recommended by Consumer Reports, PC Mag, CNet etc.  It may be helpful to discuss better alternatives to Arlo while we still can access this forum.  Any recommendations?

Blue?

Blink?

D-Link?

Google Nest?

Stephen

[MikalB]

The vast majority of my Arlos will be switched over to Nest.  Great experiences with them in the past.  Customer service are English speaking and they take ownership of issues and even follow up to ensure the issue has been fully resolved.  Two cameras will be moved over to Blink and two others will be changed to Reolink Go cameras.  I have had great experiences with all of these.

[SCKG]

Thanks for the recommendations!  Much appreciated!

[dcfox1]

Nest and many others have gone to 2FA. I hate it also but it is the trend. 

[SCKG]

Is there any camera system that does 2FA well?   Both email and SMS text options?  Remembers the device?

[hrarrajo]

From October you have to log in via the 2 step verification. Is this necessary? Despite the so-called security check I find this a very unfriendly obligation. The choice should be left to the user. Can this obligation be ignored?

[ag100]

Taking a look at these now - https://www.samsclub.com/p/lorex-6x4-1080p-wire-free/prod24640285?&source=ifpla&itemNumber=980271353 . The app gets pretty awful reviews, but after messing with it a bit, it doesn't seem too bad. Anyone have any experience with it?

[oillogger]

Looks like a Arlo Pro copycat.  Lorex has been in the wired security camera business a while and probably intends to continue so it is quite natural to come out with an competing wireless system to what sells the best.  Sure looks like a bigger battery which is a plus  and there is also a 50% bigger capacity camera battery available.  I wonder what the average expected battery life is.  Can handle up to eight 1080p cameras.  No fees. The biggest negative I see is only local storage.  The bad guy already knows to steal or destroy the recording equipment to eliminate the video evidence.  I will stay with my Arlo system investment as long as possible but will keep learning and reading the reviews about this Lorex system.  I also hope Arlo will go back to trying to build up customer loyalty. 

[Macahi]

The following is my chat with their support yesterday:.  Obviously I changed names and personal information before posting here:

Dear Mr. X`, Welcome!
A: Thank you for choosing Arlo. I'm Mr. Arlo, how may I assist you today?
X: hello

A: Hi Mr. X.
X: I set up 2FA, and it won't recognize a Macbook as a trusted device. how do I get that set up - 11:33 AM

A: I am sorry to hear that you are experiencing difficulties with it. As of the moment, computers, laptop/macbook cannot be added as trusted device however, you will have the code verification whenever you access the web. SMS, Email verification and push notification. (11:35 AM)
X: no, i have to be able to use the macbook, i won't have access to a cell phone for most of my day. how do I set that up - 11:37 AM

A: Are you able to receive SMS verification from your mobile phone? - 11:38 AM
X: yes, but I often work in a clean room where cell phones are NOT allowed. I will not have access. So I need to be able to log in directly from the computer. - 11:39 AM

A: If that's the case, you have to temporarily disable the 2 way authentication feature whenever you are at work. The email verification is not working from your Macbook too? - 11:40 AM
X: but arlo has stated that it's mandatory, that we HAVE to use it. Do we have to or not? Email can take more than 15 minutes to arrive making that useless.

A: I see. That's for additional security however, you can temporarily disable and enable the feature. - 11:42 AM
X: I don't want it. the only reason I set it up is that we've been told it has to be enabled.
Wait, so now that I've enabled it, I can turn it back off and leave it off?
are you sure? - 11:43 AM

A: Yes, you can do that anytime under your Settings > Profile page. - 11:44 AM
This is the recommendation I can recommend if there's a delay on the email verification code to be sent.
X: ok, so I've just disabled it. Are you telling me that in a few days, when 2FA is required, I'm not going to have ANY problems logging in even though it's disabled? - 11:45 AM
are you there? - 11:47 AM

A: So far, we haven't receive any complains about having a problem not being able to enable the 2 way verification feature. This feature is to protect your data and add an extra layer of security to your Arlo account. You may enable it whenever you are at home using your mobile phone with the App. - 11:48 AM
X: I understand the intent, but you CAN'T force it on people who can't comply. I bought this system more than a year ago and the design gets worse with every change.
No, you haven't had any complaints yet because it isn't mandatory for a few more days. - 11:49 AM
what I'm asking you is, once it becomes mandatory in a few days, am I still going to be able to log in WITHOUT enabling the 2FA? - 11:50 AM

A: We will be forwarding that request to our web developers. And as of now, since we haven't heard any complains, I cannot answer your question if there's going to be a problem once mandatory. To formally document the case, may I have the email address you have registered for your Arlo account and phone number please? - 11:53 AM
X: How can you not know the answer?
seriously?
this is your job to know. Get your supervisor please - 11:54 AM

A: That is because we haven't receive any complains yet on whether a customer was having an issue logging in when 2FA is disabled. - 11:55 AM
X: get your supervisor on the chat please - 11:55 AM

A: Please stand by while I am looking for available supervisor. - 11:58 AM
X: thank you - 11:58 AM
it's now been 15 minutes since I asked to speak to a supervisor. - 12:10 PM
it's now been 20 minutes since I asked to speak to a supervisor. - 12:15 PM
it's now been 25 minutes since I asked to speak to a supervisor. - 12:20 PM
it's now been 30 minutes since I asked to speak to a supervisor. - 12:25 PM

A: Thank you for patiently waiting and apologies for the long wait. Unfortunately, all of our supervisors are currently on a meeting and I would endorse the case to them for a callback. May I have your phone number, preferred callback time with timezone and the email address linked to your Arlo account?
X: email: x@x.com
phone: 555-555-5555 - 12:26 PM
they can call any time in the next 8 hours

A: Thank you for your full cooperation.
Case number is 41960229.
X: am I going to get a call today? - 12:27 PM

A: After the meeting, expect to receive a call. Kindly check your email as well including the spam and junk folders. - 12:28 PM
X: when is the meeting finished?
i got an initial email when this chat started, so the email is fine.

A: I do not have the ETA about when would that end but that's in a few hours from now. - 12:30 PM
X: I'm sorry that your company isn't providing you with sufficient information to help the customers. Thanks for trying. - 12:31 PM

A: Apologies for the inconvenience. - 12:32 PM
For other online support options, you may visit our website @ support.arlo.com and community.arlo.com
You are most welcome and kindly wait for the callback later.

X: The community is UP IN ARMS angry over this and over Arlos lack of support
they're furious that this isn't fixed and Arlo has known about it for a year, but done NOTHING - 12:33 PM

A: You may also post your comments in that site or Arlo ideas exchange site to better improve Arlo services. - 12:34 PM
X: They get ignored
100% of the time, they're ignored
it's worthless
I will be posting the resolution of this chat and the phone call. - 12:35 PM

A: Thank you, I am sure there are other customers that are having the same issue as well. - 12:36 PM
Is there anything else I may be able to assist you with today? - 12:37 PM
X: everyone who relies on a computer instead of mobile device is having this issue. When the change becomes required, you are all going to be busy with angry people. - 12:38 PM
nope, no resolution, but no, there's nothing else you can do today. Thanks - 12:38 PM

A: I understand your frustration about this and most of the affected customers are the ones that are relying on browser log in. I am sure we will be having volume of complains when there's a problem disabling the feature when it's mandatory.
You are most welcome.
Again, I'm Mr. Arlo, thank you for choosing Arlo and have a great day! You may now end the chat.
X: I'm VERY sorry I've chosen Arlo, but thank you.

Enter MessageEnd of Dialog

Probably needless to say, but even though I gave them an 8 hour window, I never got a call back.

[SCKG]

Well you certainly get an "A" for trying! 

Arlo - FAIL...

[TLyleJeep]

Hi ag100,

Do you know if the Lorex system is able to use a desktop login to view the camera's? That is what I use the most and this two-step authentication that Arlo uses is garbage that does not remember trusted devices. If Arlo follows thru on the 30th of this month and makes it mandatory to use the two-step authentication I think I'm going to have to jump ship and look for a new camera system.

[Macahi]

@JamesC @JessicaP 

We understand that you no longer have any interest in actually working with customers to get to any solutions, but maybe you'd like to take a look at the chat I posted above and address the issue that your support desk has no clue about how to handle the upcoming mandated change.

Was testing done? Are there use-cases? Is there documentation? What is the expected behavior?

I'd think your support personnel would benefit from some actual knowledge rather than being thrown to the wolves which is exactly what's about to happen to them.

[dcfox1]

I had a experience as @Macahi  did yesterday. I called about If you have no cell phone to set up with initially for my elderly parents if I gave them a cam. I showed them screens shots on the set up on pc and when we got to the page with just the option to enter a phone number he said "lets try the app" The whole point of the long conversation was without a phone. After explaining that again the said let me log into your account  then it was disconnected. I have a cell phone to set up and have done the work around to get an e-mail if the phone is unavailable but  even for that you need a cell number to set it up. 

[raowriter]

One fascinating thing I’m finding since setting up 2FA Is that Arlo keeps logging me out because, according to them, I’ve logged in on another device. Fascinating because I use Arlo only one device, my iPad. So doesn’t exactly instil confidence in their abilities.

[Linusl]

Not sure this is related to 2 step. I also get logged out with warning another login in another device has happened (and I know it has not).

I think bad testing processes and bad management decisions will cost Arlo alot very soon. Why buy expensive cameras and add a subscription if I can find another company that offers same quality of hardware with less or no bugs.

I myself habe nest, reolink, neo, wyze and blink and must say so far arlo is the better one of them (except the bugs they inteoduce all the time). Reason I say Arlo is the best of them is because Its the one with best animal/person detection not spamming me all the time like reolink and blink.

But Im pretty sure they or some other company soon will have same or better detection software in their cloud ans I will gladly then move to them. But for now I can not be bothered with alerts because of a branch shadow or a bush moving in the wind.

I have around 20 cameras at the moment (half of them arlos) and as of now I have turned off all push notifications except for the arlo cameras.

[raowriter]

I posted it here because it’s only happened since I implemented 2FA. Never happened before in the two years I’ve used Arlo cameras.

[Linusl]

To me it was introduced about a month ago. Part of my paid subscription to get logged out and get false warnings 😉

[Tseyvar]

Heck the Arlo community site recognizes my computer, but the web portal can't. I recently accidentally closed my Arlo tab, reopened it and was hit with the verification again, not even 3 seconds had past.

[SCKG]

I received an acknowledgement today from Arlo stating that they have opened a support ticket for the Better Business Bureau complaint:

Hello Stephen,

Thank you for contacting Arlo Support. We have created a new case #41965269 to track the progress of your request.

Your Arlo Case Details
Case Number: 41965269
Subject: BBB Complaint 
Created Date: 9/28/2020
Description: BBB Complaint 

Please refer to your case number in any correspondence with Arlo Support.

PLEASE DO NOT REPLY TO THIS AUTOMATED EMAIL.

Thanks,
Arlo Support