I’ve read numerous similar articles warning about the inherent insecurity of SMS and TOTP two-factor authentication, and it all comes down to how much effort is required on the attacker’s part.
With SMS an attacker just needs access to SS7 which can be accessed through a subscription service. Very low effort.
With TOTP an attacker would have to compromise the databases of the 2FA provider which is fairly high effort.
With U2F an attacker needs to steal your physical U2F key, which could be either high or low effort depending on how well you guard your possessions.
Thus my opinion that SMS is better than nothing, TOTP is preferred. I don’t have a device capable of using U2F so that’s off the table for me.
No argument from me… I voted for SMS so I’m in agreement with you @Loki.
I always use SMS vs nothing if it’s available… in fact, I prefer SMS over 3rd party apps requiring invasive permissions to my devices (not starting a debate - it’s my preference). Yes, yes… I do wear my tin-foil hat when needed
As the articles indicate… there are pros/cons to all methods. I posted them so less tech-savvy members could get more information without having to ask.
Biometric is serving a different purpose. It is protecting access to the mobile app on your existing phone. It would not protect someone from accessing your account from another device.
We are looking at 2FA to protect from someone connecting to your account with your credentials from another device.
Physical Security Key - Yubikey or Google Security Key would be awesome. This data is highly private and that is the most secure mechanism known to date.
No account lockout is enabled for the app or online login! There is also no 2 factor authentication! The account logins can be bypassed with a dictionary hack. All you need is a target email address which is publicly available information. This needs to be addressed immediately before someone’s live feed is actually hacked. Account lockout and 2FA are minimum cybersecurity requirements in most industries.
Account lockout occurs after 3 unsuccessful login attempts to the app or website. Without account lockout a hacker can just run a dictionary hack on any account they want. A dictionary hack tries every single account password possibility given a set of parameters. Account lockout prevents these hacks by locking an account after just 3 tries. Without it enabled a hacker just runs a dictionary hack and it is all automated. Account penetration is gauranteed in just a matter of time, depending on the password complexity. With today’s cpu and gpu processing power an 8 character password can be solved in 24 hours. I am a cybersecurity professional and a dictionary hack can be ran by anyone. It is one of the first methods tested in ethical hacking/penetration testing. Also to the comments on sms 2fa, sms 2fa is WAY more secure than nothing. I would recommend implementing it now. Wyze can always get more robust later. It is never a question if something can be hacked, it is always a question of making it too difficult for the reward of penetration to pay off.
I prefer Authy because it provides standard TOTP with some user-friendliness enhancements on top. Google Authenticator is just standard TOTP with no additions which is just as good security-wise, but Authy adds some handy user-centric things like cross device sync/backup, integrator-optional push notifications to respond to more easily than going through the whole ceremony by hand, etc.
SMS-based 2FA is insecure as well as error-prone so I don’t see any point in adding it. IMHO it introduces more problems than it solves, including promoting a false sense of security confidence among users, and creating room for serious security errors in the development process. 2FA verification is very frequently used as an account lockout recovery option in lieu of email confirmation. Making it possible via SMS makes account hijacking easier than stealing a password. Of course it takes a little money/effort to do so it’s not likely to be a widespread problem, but I’m not interested in security products that only care about protecting “most” users.
P.S. - I actually prefer U2F wherever possible but due to the cost of adoption I’d rather see TOTP implemented first, with U2F added as an enhanced option for the users who have the appropriate hardware.
While any type of 2FA would be fine, Okta integration would be awesome, though I understand for this type of device less people would have Okta than something like google authenticator, or just SMS text.
Are there any talks of a possible two step authentication when login into the camera app ? my concern is hackers… a lot of websites and apps currently allow me to send a text message to my phone with a verification code before i am able to see my information, is there a way to do the same with wyze cam ?
Dear Wyze Support, Recently Nest Consumers reported Securiry Breaches of recording from their Cameras. And Nest sent out an email to customers advising them to implement 2-step Authentication, so that no unauthorized users gain access.
So, As being Wyzecam Customer, I don’t see Wyze has no option of 2-step Authentication for the Wyzecam Accounts. I request you to please implement this Security feature as soon as possible for better Wyzecam Account Security.
The tag on this topic says “in-development”, which means Wyze is working on it. When that tag changes to “testing”, then it will be that much closer for release to public. I haven’t heard of a timeline on this feature, yet. I too, would like to see this implemented.
Early stages of design and workflow. During the first release, SMS will be used as this is one of the most requested methods. We will evaluate other methods in the future.
