Mandatory Two-Step Authentication (Verification) a Bad Idea

[ChrisKay]

Making this mandatory is an exceedingly bad idea since it will slow down authentication and when it breaks—and it occasionally will—it will prevent access completely.  At least give the end-user the option of deciding how much protection to require for the account.

[SCKG]

So much for the BBC complaint.  2 Minutes later I received this response - again not addressing the issue!  I now ask that the complaint to be escalated to a manager - but I am not holding my breath...

Hello Stephen,

Good day!

I would like to convey to you our sincere apologies for the inconvenience you have experienced with your device. This issue has no doubt caused you some frustration and we want you to know that this is certainly not typical of our organization. Arlo Technologies Inc. takes great pride in maintaining a reputation for excellence, and we will make every effort to ensure that your next transaction with us is handled most efficiently. Arlo Technologies Inc. appreciates hearing from customers like you because we need feedback from our customers to help us monitor and maintain the quality of our products & services.

Stephen, please let me assure you that we continue to be committed in providing you and all of our customers with the highest standards of product & service in the industry. I would like to get in contact with you to make the best attempt in regaining you confidence in our company and provide solution to your problem as soon as possible.

At Arlo, our goal is to keep your personal information private and secure--that's why we support two-step verification. Two-step verification is an added layer of account security to verify that it's really you, even if someone knows your password.

We can set up the two factor authentication by following this instructions:

To enable two-step verification email from your desktop:

Log in to my.arlo.com.
Click Settings Profile Two-Step Verification.
Click the switch next to Enable.
Click Add SMS Verification as your verification method.
Note: Your Arlo account email is an automatic back-up option.
Follow the instructions to complete your two-step verification setup.
Two-step verification is enabled for your account.

https://kb.arlo.com/000062288/What-is-two-step-verification-and-how-do-I-set-it-up




Thank you for choosing Arlo Technologies Inc.

Sincerely,

Louie Ordanza
Customer Care Advocate
Arlo Technologies Inc.

[oillogger]

Looks like you just went down miles and miles of a long road to no where.  Sorry about that.  Thanks for trying.

[SCKG]

Arlo is going to call me to tell me how to set up 2 Step Verification with SMS text - even though I do not have a cellphone.  Keep you posted!  

[BigPoppa]

Ha ha ha...  this should be good.

[SCKG]

I had a telephone conversation with Louie from the Arlo San Diego office.  He was very courteous and walked me through the entire process to first set-up two-factor authentication with my landline and then switch to the email option.  I think he was surprised to find that IT DID NOT WORK!  You finally replied that you do have to have a cellphone to initially activate the authentication.

I repeated my complaint:  Either a) make the process optional, b) initiate with email also, or c) refund the price of my system because I will no longer be able to access the data.

Again, I asked that this request be escalated to a manager.

[SCKG]

I also asked Louie to review the complaints on the Arlo forum.  He said he would look at it and also notify his manager....

[SCKG]

Louie agreed to refer to the Arlo Engineering Department...

"I understand your point. I just want to ask if you do not have any mobile number that we can use to set up the two-factor authentication?

This is the highest point of escalation and what I can do is coordinate this with our engineering depart to check if they have a work around."

[Hanry]

The same problem as "Retired Member.

Can not add my Win10 laptop to the Two-step verification. 

My Ipad and Iphone works fine.

[Gene2916]

I have 6 arlo cameras and their base station. I am going to be forced to replace my arlo cameras with something that doesn’t require me to jump all around the house to view a camera. This creates a danger!

[Gene2916]

I have 6 arlo cameras and their base station. I am going to be forced to replace my arlo cameras with something that doesn’t require me to jump all around the house to view a camera. This creates a danger! Do you have any suggestions?

[Gene2916]

I have 6 arlo cameras and their base station. I am going to be forced to replace my arlo cameras with something that doesn’t require me to jump all around the house to view a camera. This creates a danger! Do you have any suggestions?

[Gene2916]

You have the best idea! We must have the choice!

[storgeman]

There is only 1 day left until the end of September.   I have not and will not enable this effort to saddle us the end user with Arlo's security.   The main reason they are doing this is because you can purchase products right from their app.   Remove that from the app and Web site and then there will be less need for 2fa.  

Thursday will be interesting.   If I can't login without enabling 2fa.   I will delete my logons and remove the cameras and base station and they will appear in MY RUBBISH by Friday Morning.    I'm really glad I only had to pay for the solar panels since the system was paid via points accumulated from a credit card.  

[dcfox1]

---

@storgeman wrote:  The main reason they are doing this is because you can purchase products right from their app.   

---

I don't like also but what does this have to do with it? You can still buy on web. 

[DougAshford]

Please please either cancel your 2 step authorization rollout or fix it as hundreds of your users have requested. Once any device...phone, tablet, chrome book, pc, any web access is authenticated with a 2FA it must remain a trusted device, simple to log in.  The necessity for 2FA on a webcam is really questionable anyways...so either make it optional or do it properly. It is more complex to get into the Arlo 2 FA than a bank account, which is really unnecessary security.

[Chris67]

Let's not get into conspiracy theories. The reason Arlo are doing 2FA is clearly that they want to minimize the likelihood of data breaches and the resulting disruption to their business and possible litigation. Most online businesses are moving in this direction.

The problem is the way in which they are implementing it, in that PC's and devices without cellular cannot be identified as secure devices and customers have no means of nominating their secure devices themselves. Until Arlo fix this problem, customers should be allowed to switch off 2FA.

[oillogger]

Totally agree.  Spot on answer.  They should be taken to the woodshed over their lack of foresight and poor implementation over what they should be experts at.

[CCNE37]

I had not seen this thread until now (after a useless online chat session after activating 2FA).

I just enabled the dreaded 2FA since today is the last day, and I assumed (like every other 2FA system) that it would remember my desktop (which is the device I almost ALWAYS use for Arlo). Well I was wrong.

It tells me EVERY time I try to log-in from my desktop that it is not a authorised device and I have to approve it from my phone.

Since my Pro 2 kit is more than 1 year old, I cannot create a support call, so I did an online chat. Well that was a complete waste of time.

The online chat person just told me that only a phone can be an authorised device, and that my account will not work properly tomorrow (if I leave the 2FA disabled), so I will have to have the phone handy to authorise the desktop EVERY time I use it.

I asked what happened when I am on a cruise ship where I can only have one device connected to the wifi, which would usually be my laptop - how do I authorise it ? The response was basically tough - the system is the system and nothing that can be done !

I have never heard anything so ridiculous - it is just a completely flawed system. This is more evidence (on top the Pro2 pixelation debacle) that either Arlo doesn't have a clue or doesn't give a damn about their customers.

Every other 2FA system I have used remembers devices when they are authorised. It is just insane that this system doesn't.

[Gene2916]

Obviously arlo doesn’t want our business anymore!

[MikeBravo]

So, I have several laptops and do most of my work on a 17" model. If I get an alert, what better place to view the cameras than on a large screen (considering the awful inconsistent camera resolution I need all the help I can get).

But if do that, i have go through some abstruse, complicated secret ritual----HAS ANYONE FROM ARLO EVER TRIED IT?--- JUST TO LOGON! By the time I do that considering that motion capture is still AWFUL and notification lag IS EQUALLY AWFUL, whatever has caused the alert is over and most time you don't even get the recording. 

So now, if I want to shave as much time off the process as I can, instead I have to view the activity on my phones quite small 5" screen. 

Raise you hand if that makes any sense.

BTW, anyone who has any information about, I presume, the hundreds, if not thousands or even millions of complaints of system being accessed unlawfully, I would sure like to know where you got the information because we haven't seen any which I would imagine would be the reason for imposing such an Orwellian restriction on we so called 'valued customers'.

Oh, also, the previous comment about being told that was 'just the way the system is' is really cute. Very reminiscent of Arlo's parent company, Netgear, and their repeated defective router firmware updates.

Well, will give it time. Mabye over the next few days when folks are surprised by this ill advised, Draconian solution looking for a problem, they'll revert.

[dsPrometheus]

I just wanted to pile on here - the 2FA is a dumpster fire. It is absurd in 2020 that they have this level of issue with 2FA when just about EVERY online service offers correctly implemented 2FA.

Asking me every time I login ( and short timeouts too ) ?

No support for private devices?

No support for 2FA apps?

and you are going to make this half baked idea mandatory?

But please  - don't go by me because I already have one foot out the door. I have an arlo system because it was gifted to me. I refuse to add on to the system and I will replace it with a good old fashion NVR and wired cams just as soon as it makes sense for me to do so.

[Gene2916]

Tomorrow is dooms day!

[Macahi]

I've sent arlo 3 reminders about the phone call I was supposed to get from them last Friday.  Not only have I not received the phone call, they're completely ignoring my open ticket.

That's some world-class customer service right there...

[ag100]

Oh, their service is horrible.  They were supposed to call me a couple of weeks ago.  When they missed the time, they emailed me the next week asking for another time and I told them not to bother.  Cannot wait to pawn this crappy company's gear off onto someone else.

[SCKG]

Arlo will contact you if you for a complaint with the Better Business Bureau.  Please refer to my prior posts.