Mandatory Two-Step Authentication (Verification) a Bad Idea

[ChrisKay]

Making this mandatory is an exceedingly bad idea since it will slow down authentication and when it breaks—and it occasionally will—it will prevent access completely.  At least give the end-user the option of deciding how much protection to require for the account.

[CCNE37]

Paul

I took your last statement      "I'm not sure what they've changed to cause this...geeze!   🙄"    to indicate that it was bothering you - clearly I misunderstood the exasperated tone in this comment.

As per my reply to another poster above, I don't think my comment/question was silly at all. If you don't like the 2FA and it isn't currently mandatory, turn it off until it is either mandatory, or they improve it more to your liking. But if you are not bothered by it, then please feel free to completely ignore me.

[oillogger]

---

@MikeLloyd wrote:
Yeah this is correct.

I'm at the point now where I'm abandoning Arlo since this breaks all my smart home integrations and forces me into something I don't want. I've built my own self-hosted security camera system that gives me all the benefits of Arlo and none of the drawbacks. And I'll get 24/7 recording and non-expiring storage with no monthly fees.

I encourage you guys to look into this option. It's not that hard to set up and is cheaper than buying Arlo hardware.

---

Please provide some details so we can consider this option.  Like what type cameras are you using and the software used.  Also is there remote access via PC and cellphone?

[MikeLloyd]

There's a lot involved but basically it involves setting up your own home server and using that to manage your own IP cameras. Yes they can be access and controlled remotely. Here's my setup:

- Raspberry Pi running Home Assistant
- Zoneminder or Shinobi for managing cameras.
- 4x 5MP Reolink IP POE cameras
- 2 GB HDD for recording video

I managed to get all this working by studying up on Reddit forums like r/selfhosted and r/homesecurity.

It's not plug and play like Arlo or Ring or Nest. But the payoff is worth it.

[KachinaShadow]

@CCNE37 

Thanks for clearing that up...the eye roll emoji and the "geeze" were more of a WTF 🤔

I've gotten over being bothered by Arlo stuff long ago 😁 

Thanks,
Paul

[Chris67]

Urgent: Activate Two-Step Verification
Arlo requires all users to activate two-step verification to continue to access your recordings, devices, and account.

Is Arlo being “cute” with the word “Activate”? Are they really saying that you need to at least “start” the process of activation to get it set up for the first time and then it is up to you to either turn it off or keep it on? This would make sense from a liability point of view because Arlo has at least provided the means for better protecting your data. Obviously if you keep it turned on, it will ask for a verification code EVERY time you try to access your cameras, library etc. as you are starting up the 2FA process. The Cambridge Dictionary defines ACTIVATE as follows: “to cause something to start”. I did activate 2FA once, provided my mobile number and received a code which I entered. After that I turned off 2FA through my browser and have not been bothered with 2FA again. Why else would Arlo give you the option to turn off 2FA?  I just wish Arlo could be transparent but I guess it is not in their culture.

[MikeBravo]

Back when this stuff started one of our family suddenly faced 2FA and couldn't get an e-mail in time to authenticate. This happened over and over until I showed them how to turn it off.

No problem since then and no prompts to turn it back on. 

If Arlo were to confine it just to situations where you forgot your password or logged in from a new device\browser, I'd be fine with that, but after the problem we had initially, if it were to become constant we'd have to switch to Blink even though they don't have a PC\Windows portal.

BTW, now that we're all squabbling amongst each other like we do on my Dell and Windows forums, Arlo can keep us distracted and not worry about their lousey video, crappy motion detection, stupid activity zones that take LONGER to activate recordings than if you don't use them at all, their useless settings that allow you to filter out everything but people for motion detection but still allow wind, rain, and UFO's to trigger recordings (just kidding about the UFO's), not to mention declining battery life and that even with skins on dirt and stuff still gets into the battery wells.

Divide and conquer.

[oillogger]

---

@MikeLloyd wrote:
There's a lot involved but basically it involves setting up your own home server and using that to manage your own IP cameras. Yes they can be access and controlled remotely. Here's my setup:

- Raspberry Pi running Home Assistant
- Zoneminder or Shinobi for managing cameras.
- 4x 5MP Reolink IP POE cameras
- 2 GB HDD for recording video

I managed to get all this working by studying up on Reddit forums like r/selfhosted and r/homesecurity.

It's not plug and play like Arlo or Ring or Nest. But the payoff is worth it.

---

The cameras appear to be connected via ethernet for power/communication and also requiring a router that provides power on its ethernet ports.  I wonder if there is a work around such as a smart switch that would power on the ethernet ports.  Is there an android app available to remotely view and control this Raspberry/Home Assistant/Zoneminder or Shinobi system?

[MikeLloyd]

Yeah I bought a POE switch to power the Ethernet lines (should be like 30-50 bucks). I blocked the cameras access to the internet for security purposes and only my home server can access the feeds.

Zoneminder has a decent iPhone app. I don't know about android. But depending on how you set up your server, you can access the NVR via your browser.

[Resuna]

Two step verification that doesn't support standard TOTP (eg, Google Authenticator) or challenge-response (eg Yubikey) must not be made mandatory. Email and SMS are not only subject to hijacking (and the hijacking can cause more damage than interception!) but too fragile and too dependent on third party infrastructure.

[Sandytrain]

I want to "Opt Out" of two factor authentication. I don't always have access to my devices to approve if my husband gets on a different device and he's in another country and I'm sleeping or perhaps even something bad is happening to me or him. I don't want this! It wasn't a thing when we bought the cameras and we should be able to opt out! I have nothing good to say now to my friends and family about Arlo since this is a mandatory thing. I don't want it! It is only going to cause us problems. And yes, we have more than 5 devices and we can't use some of them in certain places, like at work. I hope you seriously consider removing the "mandatory" from this. It is a problem and I'm going to guess we are not the only ones who have a problem with this! I now wish I had not purchased these cameras.

[markjano]

I have same problem with iPad and iPhone.  At least 5 times a week says to verify, then enable PUSH,  AGAIN.  Then Trust device which has been done multiple times.  Does not allow to trust device.  Arlo worked ok till this amateur move and it is time to explore other manufacturers.  

Arlo said to call tech support who wanted to charge me for a phone call.  Not gonna happen.

[YT_PoliceForce]

Arlo: We're forcing you to use 2FA
Also Arlo: No we're not
me: ...... what? [I'd save your email just in case]

[dcfox1]

Guess it was 5 o'clock somewhere. 

[YT_PoliceForce]

The council has allotted but a singular yike. 

[jescott3]

My experience with wireless cameras goes back to Netgear Vuezone days. I gladly moved up to the original Arlo system and have migrated to two VMB4000s with 5 Arlo cameras apiece. I have enjoyed monitoring those 10 cameras spotted around my home, and particularly like the ability to see their output, fee-free, on my Mac desktops, iPhones and iPads.

But like others in this forum thread, I became increasingly turned off by the need to login and wait through the 2FA mess. It got so irritating recently when I had to make multiple unsuccessful attempts to get that 6-digit code in a timely manner that I turned off 2FA. I also resent the constant "Urgent" threats by Arlo to deprive me of access to my "recordings, devices, and account" if I don't activate 2FA.

I do not need all the bells and whistles of newer Arlo products, and I do not need to use my Arlo system under threats by Arlo to take it away unless I do the 2FA Cha-Cha dance. So, I've bought the Blink package currently sold by Costco. It includes 4 Outdoor cameras and a wired indoor Mini camera, plus a Sync 2 (base station) and all the bits and pieces needed to install everything. The Costco price was $209.99 plus sales tax. A similar 5-camera package from Amazon is offered for $249.99 plus sales tax, and one is on the way to my home after Christmas.

The Costco system was installed a couple of days ago. I got it up and running alongside my Arlo system, and it didn't take me long to decide to order the Amazon 5-camera package. Not only is Blink less expensive, it meets my needs for home surveillance equipment that's easy to use and maintain. Each camera uses 2 Energizer Ultimate AA batteries, and Blink says battery life can extend to 2 years, depending on use and settings. That sure beats my constant rotation of 40 rechargeable batteries in my Arlo cameras. 

I'm still learning the ins and outs of the Blink system. I haven't quite gotten the hang of the built-in two-way speakers, but I will. The Blink app is available on mobile phones and tablets only right now, and not on desktops, which is a minor inconvenience. However, I recently got an Apple Silicon Mac mini with the M1 chip, which meant I could install the same iOS version of the Blink app on my Mac mini M1 as well as on my iPhone and iPads. Sweet!

To test Blink vs. Arlo, I walked around my house this morning. All cameras were set to record motion. The Arlos have been adjusted individually with custom settings over the years; the Blinks have stock settings. All cameras were armed for motion detection. Both systems detected my movements, and the Blink captured the sounds I made. The Arlos detected motion about 5 feet further away than the Blinks' stock settings. The Blink 1080p video was at least as good as Arlo.

Blink stacks a sharp photo taken by each camera in full-width mode on its Home screen, which makes for a breathtaking difference as I scroll up and down, compared to the 10 boxes jammed into a window Arlo delivers to me. Overall, it's easier to get crisp, decent-sized images in front of my eyes with Blink. However, the default setting for nighttime photos delivers fuzzy black and white images. I've got to tinker with those settings.

As for the reason I'm switching to Blink, Arlo's 2FA bullying, I was glad to discover that Blink has adopted a quite sensible approach. Each Blink account requires a valid email address. I installed and activated the Blink app on 2 iPhones, 3 iPads and my Mac mini. I've accessed the app on all of these devices many times and have not been asked to login to do a 2FA dance since the initial logins. Gee, if only Arlo could do that, I wouldn't be a new Blink owner.

This is not meant as a "review" of Blink. There are a number of granular user differences between Blink and Arlo. My experience so far has been sort of like moving from an older Accord to a new Honda Civic. But with each passing hour, I'm more and more pleased with Blink and less and less tolerant of Arlo's bullying approach to customer relations and 2FA.

Give Blink at least a look-see, particularly if you're a homeowner like me who just wants to see what's going on outside my house 24/7. I do plan to use Blink's two-way audio system to put the fear of something into the family of raccoons who maul the Arlo camera in my palm tree, as well as the neighbor cats who patrol our yard nightly. And I really like the idea of not changing batteries on a regular basis.

Oh yeah, I forgot to praise Blink's storage policies. The Sync 2 base station is an itty-bitty 2.5 by 2.5 by 3/4-inch box with a USB port. I have a 256 GB thumb drive installed in the USB port which records all my videos. I can eject the drive and download its contents onto my iMac or Mac mini anytime and view the .mp4 files. Blink also offers cloud storage for $3 monthly per camera or $10 for up to 10 cameras. Blink owners can use either or both storage solutions. I like the control of being able to store my Blink pictures locally, which sure beats the heck out of the proprietary Arlo solution that controls the thumb drives I've got in my VMB4000s.

[oillogger]

Thanks jescott3, you have provided very useful information for us with plenty of details.  Please keep us informed with any additional information good or bad you find useful as you come across it with the Blink system.  Thanks for the reporting!

[MikeBravo]

Hmmm.....you know, maybe Arlo has a rich uncle named 'Arlo' and as rich kids they don't really need the money, they're just 'playin' or hey, maybe they secretly own Blink and are just covering their bases. 

You know, selling Arlo to naive dopes like us and Blink to the smart folks.

You think?

[oillogger]

I assume the Arlo Essentials requires the same 2FA.  I viewed a Amazon video comparing Arlo Essentials,  ReoLink Argus 3, and Eufy Cam 2C.  The Argus 3 had higher contrast videos and could be viewed from a PC.  Do not know if they require 2FA.  The manual does not provide much information and you actually have to have the camera to know the settings available.  Maybe someone here can provide some information such as actual battery life, storage, etc.

[Linusl]

Reolink gives so many false alerts (bushes in wind, shadows etc) so the battery does not last long. I think I charge my reolink cameras 6-8 times when arlo is still on 1 charge.

[oillogger]

Sounds like Reolink is not a viable alternative unless a few others praise it.  Well, I'll keep casually looking at the other camera systems out there.

[leon_buczkowski]

Why can't two-step login be optional.   Whenever I login I choose the alternative method and use my email.  Why can't I simply go directly to my email for verification?

[dcfox1]

Why not just turn it off in your settings? 

[stevespalding1]

@jescott3 - I have a few of the blink cameras and to be honest, i think they are pretty awful. The battery life is good but otherwise they aren't very flexible.  The new synch module is not yet available where i am (UK)  and has been 'coming soon' for months now. I have integrations with Home Assistant and so far, Arlo are the only ones that function correctly - Blink is so closed as an ecosystem that the integration is just awful, even after their 2fA is successfully automated. I'm not saying Arlo are any more open, but the HA integration is a great deal better.  I also have acquired some Eufy 2Cs and time will tell how useful they actually are (so far the image quality is impressive as is the ease of setup but the integrations appear rather lacking at the moment). Where Arlo is concerned, they have made it abundantly clear that they don't care what their customers think and don't really know how to fix the mess they've got themselves in where the 2FA thing is concerned. Personally, I'm done with them and if one of the various wireless cameras doesn't do what I need it to, then I'll simply move to a professionally installed wired solution. 

[Linusl]

I also have blink and eufy 2c + eufy indoor cameras. Blink is pretty much garbage. But I am extremely surprised with eufy. If you know the arlo app it is a replica but I would say without bugs. Geo works flawless with multiple users at eufy.

I just sold 8 arlo pro cameras. Still have 3 pro 3 but is now adding more eufy cameras. I would highly recommend people to check them out.

[jescott3]

Hi stevespalding1 — Judging by the wide variety of comments about wireless surveillance cameras, there does not seem to be a big winner. I’ve got both Arlo (original cameras) and the newest Bling Outdoor and Mini cameras with the Sync 2 base station. Arlo and Blink are both “walled garden” systems, which suits me just fine. I just want to know what’s going on inside and outside my home, nothing more. None of the wireless camera systems are very good security solutions. Arlo is a little less walled garden because of the Arlo online server storage business, so it’s a security risk. I have my Blink cameras set up so they store snapshots on the 256 GB USB drive plugged into the Sync 2’s USB port. When the free online storage expires next month, I will rely on the Bling’s local storage setup, which suits my purposes just fine. I think Blink’s newest Outdoor, Indoor and Mini cameras are superior to the original Arlo cameras I have been using for several years. I especially appreciate the two-way audio feature, the crisp images and the extended battery life. In addition, I've turned Blink Outdoor cameras 90 degrees so I can see alongside my house on the east and west. Neat. To each his or her own.

Arlo just started asking for Touch ID authentication on my mobile devices (all Apple), but Blink has not asked for any follow-up authentication other than the original setup request. Arlo, OTOH, still nags me in colored banners to turn on 2FA. I did, and it was a PITA, so I turned it off. That was months ago and Arlo's still cluelessly nagging and threatening me. ROTFLMAO.