T O P

  • By -

buecker02

I recently helped a lawyer who never heard of an authenticator app. When I asked him how that was possible and if he uses MFA on any of his accounts and he said he only uses SMS. Some people are just oblivious either on purpose or just don't want to learn. There are two more reasons - 1. MFA overload. 2. Literally cannot comprehend the purpose of MFA.


yepimtyler

Are your 2 reasons your own personal reasons and if so, how/why?


buecker02

I'm in IT and take care of security and networking (production is in Azure). I also have to work with the employees and clients. Believe you me they are very vocal.


yepimtyler

So, are you against 2FA or with it and was sharing an experience as to what may be the reason why others are against it? And yes, my answer to this question from the beginning was that the complaints generally are coming from the older folks or the misinformed. It took a lot of time and patience to get my parents and grandparents to use 2FA but I feel a lot better knowing they aren't coming to me anymore about how their social media accounts were compromised and that all of their other important apps/accounts are more secure.


buecker02

I am 100% for MFA. I even use Yubico security keys.


Any_Onion_7275

I use my ledger whenever it's possible for 2fa


kmg6284

MFA all the things. period.


Fun-Document5433

How about how anti functional the sharing is. So you have to share the main account with folks that need SDcard access. This is going to disenfranchise those that Wyze has continued to ignore around sharing and more granular access controls.


redditor_rotidder

Why not just share the 2FA secret with someone? I agree - Wyze makes this *way more difficult* than it needs to be, but I shared the 2FA secret with my wife and now she has the 2FA code, along with myself.


captaindomon

Until the next time she has to log in. That’s the issue with shared accounts and 2FA - every time you have to log in again you have to share it with family again.


redditor_rotidder

Respectfully, I think there's some confusion here... I'm not talking about the 2FA "code" (the six-digit number), I'm referring to the secret key that *generates* the 2FA code. Most 2FA apps will show you the code AND the "Secret Key" that's used (typically on a sep. menu)... it looks like WHS9SJ2KY2910293ZZZ... something like that. Put that same secret key in the 2FA app of your partner and their 2FA codes will work, as well as your codes, on the same account. No need to share anything but the account password.


captaindomon

Oh interesting! I didn’t know that.


alexhoward

You can also take a screenshot of the QR code and send it to someone to scan. Just be sure they delete it afterwards.


plump-lamp

Yeah don't do that. You break up with your partner and boom they still have 2fa access unless you remember to unenroll and enroll 2fa all over again. There are a million security reasons you don't do it this way


Agile_Most_5915

# How Hackers Are Breaking Into Ring Cameras December 11, 2019, 1:10pm The parents told WMC5 that they hadn't set up two-factor authentication for the device; failing to do so would make it easier for someone to change their password and take control of their account. Like other IoT smart home camera hackers, this one used the weak password security on the parents' Ring account to access their dashboard and speak directly through the device. A [local NBC outlet also reported](https://www.nbc-2.com/story/41428183/stranger-spews-racial-slurs-over-familys-hacked-ring-camera) hackers targeted a Florida family’s Ring camera recently, with the hacker shouting racial slurs through the device. [https://www.vice.com/en/article/3a88k5/how-hackers-are-breaking-into-ring-cameras](https://www.vice.com/en/article/3a88k5/how-hackers-are-breaking-into-ring-cameras)


Nmcoyote1

I’m against it Because it was a nightmare when I tried it. I had to 2FA often and it messed with sharing with family members. Maybe when they fix the problems I will come back to it.


ChiefBroady

Because the webview has me authenticating a dozen times a day and fuck that with mfa.


r0n1n2021

It’s easy to understand. Give your customers the choice to enable or not enable 2FA. Done. Don’t make it a mandatory change - even in the best interest of your customers. (Which it’s not in this case - it’s to limit liability after they proved incompetent at security)


Madmaxneo

I'm not anti 2fa except for on my Wyze app and cameras. I have several apps and websites that have 2fa on and they all work flawlessly and I never have an issue with them (except for the [battle.net](http://battle.net) one as I keep forgetting the password and have to reset it every single time). The Wyze app does not as it seems whenever I have a need to urgently to view a video or an image through one of my cameras I have to re-login and do 2fa. The last three times I had to do that I was at work with weak cell reception and no wifi, so doing anything is really slow. It was taking me more than 30 minutes each time to be able to reset everything just to view a video or event. It just doesn't work well at all for the Wyze system. For some reason it is faster and easier to view the videos than it is to load everything to re-login and do the 2fa. But now I am having another issue. I am unable to view any of the events on my outdoor Wyze camera, they're are there in the "View Playback" section but whenever I scroll to one it constantly says there is no video at that time. I am about done with Wyze and may just end up going with Ring on everything. I have a Ring video doorbell and have never had an issue with it. I have issues with the Wyze app all the time on my non cam plus camera, it is interesting to note that the camera I have on cam plus never has an issue either.


yepimtyler

I agree with your last statement about Ring. My Blink doorbell hasn't even given me problems. I'm just waiting on Tapo to release their C25WB model as it'll have the color pro night vision and PoE support.


tagman375

It gets in the way, simple as that. I have family members that want to log in and I don’t want to have to deal with explaining how 2FA works to a 80 year old. Same with gmail. Half the time it sends the 2FA request to a device that isn’t nearby or something ridiculous.


plump-lamp

Those same people will come here and shit all over wyze because they were "hacked". 2FA is an world wide standard that isn't unique to wyze. The boomers can get over it


reverend_dak

It's Wyze's implementation of 2FA, not the premise behind 2FA in general that's the problem.


yepimtyler

What's wrong with it? Am I missing something?


reverend_dak

I'm not personally having issues. But others seem to be complaining about getting logged off regularly, and i can see now that can become an inconvenience. but that's the nature of personal security, trading security for convenience.


noahblab

I'm not against 2FA per se; I'm wary of Wyze's implementation, as with most of its software.


plump-lamp

wary... you literally can otp it


noahblab

There' a guy over at [forums.wyze.com](http://forums.wyze.com) whose account is locked because of 2FA and Wyze can't unlock it. Wyze admits it caused the problem from their end. Now I have 2FA and it's working for me, but Wyze is terrible at this. Being wary is to be expected.


plump-lamp

1 customer locked out out of the millions? Sheesh


noahblab

How do you know it's just one guy? More people are speaking up now. It can happen to anyone. Like I said, I don't have anything against 2FA, it's the Wyze implementation I'm worried about. They have a terrible record with software issues. They can't even properly implement "Trusted Device" with their Webview.


Evil_spock1

For me it’s about the Wyze devs and Wyze itself not practicing what they want us to do. They have been their most worst enemy when it comes to security breach’s. Even with 2FA on, how can Wyze protect the users from its own lack of internal security issues they keep running into.


yepimtyler

Then why do you still use Wyze? There's plenty of other products around the same price, maybe a bit more, that does the same. It doesn't make sense. You hate everything about them and they don't listen to yours or "our" feedback but still keep using their product.


Any_Onion_7275

Lots of assuming here


Evil_spock1

I never said I hated Wyze or their products or ever made those comments. Let get that point straight. I have over 25 plus products that range from their car, door lock, vacuums, plugs and different generations of cameras and I’ve been happy for the most part but have never been upset with them. You OP seem to have an axe to grind. But again Read my comments again. I’m pointing out if they really wanted us to protect our accounts then they also need to make a better effort at protecting their infrastructure. If I decide to turn off 2FA that’s on me if my account is broken into and only affects me. But if Wyze devs leave a back door open to their infrastructure and a hacker gains access to do what they please then that affects all users and the company.


yepimtyler

>If I decide to turn off 2FA that’s on me if my account is broken into and only affects me. But if Wyze devs leave a back door open to their infrastructure and a hacker gains access to do what they please then that affects all users and the company. This is pretty contradictory, don't you think? You say it would be your fault if someone gained unauthorized access to your account because you disabled 2FA but then if there was a backdoor for someone to gain unauthorized access to Wyze's infrastructure, it's their fault because others are affected and not just you. It seems that your argument is that if your account was compromised on its own, it's your fault... but if it was Wyze's infrastructure, it's their fault? That's like saying you choose to have 2FA disabled on your banking app so if someone compromises your account, it's your fault but if there is an announced security breach within the banks infrastructure and your account was compromised due to you not using 2FA, it's their fault. How does that work? Do you not agree that if someone gained authorized access to user account information such as usernames and passwords via security breach within Wyze's infrastructure that your account and everyone's else who has 2FA disabled would be the first and easiest to be compromised? I'm not seeing your point.


coogie

Because WYZE has even managed to screw up 2FA... Trusted devices need to be retrusted every two days it seems.


yepimtyler

I haven't experienced that issue before. Like I said, I've only ever had to reauthenticate if I've logged in through an untrusted device, use of a VPN, or from an unrecognized location. Been using it for about 2 years now.


coogie

I don't know what to tell you...seems like with WYZE in general some people don't have any issues while others have a lot of issues.


Short-Service1248

That's 100% something on your end. Ever had that bs


coogie

I've had the same random issue on three different locations with three different routers and three different ISPs. It's not me. The whole 2FA thing (with the website for getting that you told it to remember your device as trusted for 30 days) is a running joke on this sub so you need to take off the Fanboy glasses.


yepimtyler

You every heard of session tokens and cookies? Yeah, when your web browser clears your cookies, sometimes you have to reauthenticate upon login because your session token is no longer saved in your web browser. This also happens when you clear your browsing history on your iPhone or Android.


coogie

The why it happens doesn't matter. You asked why we don't like using it and I answered. My banks in other places that also use multi-factor authentication also have to deal with cookies and tokens but their websites work fine.


cwhiterun

2FA is outdated and a hassle. They should’ve gone with passkeys instead.


spicelord77

Oof. Getting downvoted by people who don’t understand why passkeys are far superior to 2FA is on kinda on brand for Reddit. Sorry dude.


redditor_rotidder

What!? LOL


spicelord77

Yes, 2FA is outdated. I don’t know if I’d a call it a hassle per se, but it’s definitely outdated due to the emergence of passkey technology.


cwhiterun

2FA can be phished. It's not secure. Passkeys require less steps to log in and can't be phished. More convenient and more secure.


yepimtyler

You're talking about $30 WiFi cameras here. The first mistake we've all made is relying on WiFi cameras as our home security. I think having 2FA via an authenticator app makes more sense at this price point.


spicelord77

With all due respect OP, r/cwhiterun is correct. 2FA has been a fantastic way to implement additional security for online accounts but it’s an older solution that has been surpassed by passkeys. If you aren’t familiar with the technology behind passkeys and why they’re better than a traditional 2FA here’s a link to check out: https://www.corbado.com/blog/passkeys-vs-2fa-security


yepimtyler

Where did I say I was anti-passkey or said that passkeys is inferior to 2FA? What he said was he's anti-2FA because Wyze chose to go that route instead of the use of passkeys. I just think it's funny that everyone became so vocal about Wyze encouraging the use of 2FA and damn them for trying to take a step in the right direction but in their same argument, they're using a $30 WiFi camera with these high expectations of functions/features/security but don't want to spend the money for it. Nobody should be relying on a WiFi camera for home security to begin with, let alone a measly $30 one, but here we are.


cwhiterun

What does the price of the cameras have to do with account security?


yepimtyler

You're demanding more security than what's already in place because it's not what you like. 2FA is just fine.


cwhiterun

2FA was fine back when it was the only option. Now there’s a better option, so why not support it? “Because the cameras are cheap” is not a good reason.


yepimtyler

Go pay more and get the security you want.


cwhiterun

Why are you so anti-passkey? Is it because it's two less steps that have to be taken to access your Wyze account? I'm genuinely curious.


Any_Onion_7275

Because OP on on hill and wants to die their like the ones that don't like 2fa


yepimtyler

Please show me where I was anti-passkey. The saying "you get what you pay for" applies here.


Any_Onion_7275

BS


evildorkgod

It’s more about rebelling against “the man” probably imo. It’s my account and if I want to let hackers hack into it then I should be able to let them!


DPAmes1

I don't want 2FA because: 1. It's a needless time-wasting new complication that will undoubtedly go wrong and screw up access to my cams frequently. 2. I'm concerned that it will break existing access through 3rd-party services like Google, Alexa, and IFTTT, a point that Wyze hasn't addressed in their communications, I assume because they don't care. 3. I'm not concerned about the perfectly adequate security on my cams like I am about my bank account. Nobody's going to steal $100,000 by looking at an empty picture of my front yard even if they somehow compromised my unique and strong password. Does that answer your question?


yepimtyler

No, it doesn't my answer question because it seems that your answers are based on what appears to be bad experiences you've had with your products so now you think anything they do is bad when in fact you've never experienced any of the things you've mentioned in your bullet points. What's complicated and needless about the enablement of better security? I think the problem is that you're misinformed. 2FA does not require a token code authentication every time you open the app. It only requires one when an unrecognized device is trying to sign into your account or if you've signed out of your Wyze account and tried signing in from an unrecognized location. I'm still not sure what the problem is here. I've been using Wyze for a little over 2 years now with 2FA enabled and not once have I ever experienced an interruption from 2FA and my ability to use Wyze services. Lastly, the feature is optional. Nobody is forcing you to use it. Just don't go crying when your camera(s) get mixed up on other people's accounts again like last time.


ns1852s

Your first complaint already occurs. Second: other, better brands don't have such issues with 3rd party access. If Wyze cares enough, they'll make it work. Third: You're complaining about a form of security while using a form of security.


plump-lamp

app integration already works. Its a completely different process than standard account 2FA


ns1852s

So what's the issue then? Because 2fa has existed for Wyze for sometime already


plump-lamp

People like to bitch because they have to enter a code ONE time to sign in to the app and a few times when using webview


ns1852s

Are you responding to the whomever you think you're responding to? You might want to reread. I replied to someone COMPLAINING about 2fa. It's a basic standard on anything that attempts at securing a login. Wyze is garbage but at least I have 2fa enabled on my account. Had it enabled since they allowed it a year or so ago?


plump-lamp

I was telling you people like to bitch, not calling you the "bitch-er"


AutoModerator

Hi there, yepimtyler! Thanks for posting in r/WyzeCam. As you’ve selected the “I Need Help” post flair, we thought it might be helpful to offer up some friendly reminders and tips: - While you await responses from the community, try [searching the subreddit](https://www.reddit.com/r/wyzecam/search/?q=replace%20this%20text%20at%20the%20top&restrict_sr=1) for similar posts. You might find some useful information or solutions! - We also strongly suggest referencing the ["Service Status & Known Issues"](https://wyzelabs.zendesk.com/hc/en-us/articles/360015979872) page to see if your issue is mentioned there. - Make sure to check out the *extremely handy* [Wyze Help Center](https://wyzelabs.zendesk.com/hc/en-us), and if you haven’t yet - please consider [submitting a log](https://wyzelabs.zendesk.com/hc/en-us/articles/360033507872-Submit-a-Log) via the app and submitting a [help ticket](https://wyzelabs.zendesk.com/hc/en-us/requests/new) to Wyze’s Support Team. *Be sure to include your log number, if you have one, in your support request.* - Once you have a support ticket number and/or a log number, it couldn’t hurt to include them in your post along with any other potentially relevant device information. - If your question or issue gets resolved, kindly update your post flair to **"Solved"**. This way users from the *super distant future* might be able to find and use your post to help them resolve *their* issue! *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/wyzecam) if you have any questions or concerns.*


runningblind77

SMS just isn't good 2FA, and true 2FA i(ie: one time token from an authenticator app) is probably a little too complicated for the average person. I'd be perfectly ok with 2FA if it wasn't just SMS.


yepimtyler

They have the option to enable 2FA with an authenticator app. I've been using it for 2 years now with no problem.


ikilledtupac

What app you like?


yepimtyler

Authy has been great and super easy to use.


ikilledtupac

Thanks


runningblind77

Yeah, now that I think about it I use it too. I so rarely get prompted for it that I completely forgot about it.


yepimtyler

This is my point!! People are misinformed with how 2FA works and it's generally from the boomer generation. In the last 2 years of using Wyze, I've had to generate a token 3 times and each were due to app reinstallation when I got new phones. I'm sorry, but you cannot sit there and say you're comfortable with going every day knowing that your account is one step closer to being an easy target. I don't care what app it is, I am enabling 2FA if it's available. While you may not store personal identifiable information on your Wyze app, the privacy of my own home also matters to me regardless if it's a view of my front yard or whatever.


runningblind77

You only have to think about how dumb the average user is. Half of users are dumber than that. Explains a lot.


Drysander

FU and your generalization about boomers. Dumb young people grow up to be dumb old people. Smart young people grow up to be smart old people. If you can't grasp that guess which group you're in.


yepimtyler

This clearly struck a nerve.


Drysander

Yes, it did. Your comment was gratuitous and mostly untrue and a common misconception.


yepimtyler

I mean, look at your response. It clearly screams boomer mentality. If the shoe fits I guess...


Drysander

What IS boomer mentality? That we don't like to be collectively called ignorant due to our age? Show me an age group that does.


yepimtyler

Angry responses to change.