Two-Factor Authentication (2FA) is a basic requirement in 2019 (or 2020!)
Hi - I'm trying out True Image 2020 and the product is excellent in every respect except one, which is a potential showstopper. I've seen several threads on this topic back to 2017, but all just leading to a "we're considering it" / "one day" kind of response, and pointing to backup-specific encryption keys (i.e. another password) as sufficient. I do like that feature, but it's 1FA x 2, not 2FA! The inherent weakness in passwords (whether you secure data with one, two or twenty of them) is that they are easily stolen - via key loggers, man-in-the-middle attacks and many more routes - and can then be used remotely and indefinitely by bad actors. That's why pretty well every application I use that holds valuable data has by now implemented 2FA in one form or another. SMS is a poor solution (just ask Jack Dorsey) but use of authenticator apps is now widespread even by some many smaller ISVs. In my day job I advise businesses from SMEs up to multinationals on cybersecurity, and you can rest assured that I wouldn't be recommending any cloud-based products managing data to them that did not include 2FA. I did read somewhere that you have 2FA in beta for your business product, which is good news. Can you give some indication as to when you plan to implement across products using cloud storage (including True Image)? Sure, predicting timelines in software development is tricky, but then so is building trust, reputation and long-term viability in a software business :) Mike
I would submit feedback through the app. If enough people request it and it's possible, it could be added down the road.
---------------------
Devil's advocate now though...
Although, I agree it's a stronger security feature, I'm sure it comes with a cost. Does your home router use TFA, your game console, smart TV, Alexa device, or whatever is connected to other online account logins (most of which are associated with what is probably the primary email account and one of the easiest vectors to compromise through social engineering)? Probably not. I'm sure it's possible, but at what cost, and would the general public be willing to pay for it to the point where making it mainstream would be cost-efficient?
None of the other home backup products, or cloud backup products I've tried offer it either... some enterprise ones do, but they are usually VERY expensive. I honestly don't think we'll see it any time soon, if at all in home backup products, and if we do, the cost is going to go up.
IMHO, real 2FA/TFA requires a physical device, like a smart card, or an RSA key, or something that you physically have to have on you and can't be spoofed without someone getting physical access to it. I would imagine that if a physical device is required, that will also be expensive... and a real pain to replace if you were to lose it since it's not like we can walk to the Acronis store and buy another one coded for our account. I feel bad for anyone who had an early crypto currency wallet and lost it or it broke.
Just look at the big YouTube hack from the other day where mobile phone text message TFA was completely bypassed using reverse-proxy lookups to steal the authentication codes.
As I am currently in the process to test this for Windows 1903 and later please also implement registration of FIDO2 keys, such as Solokeys, Yubikey, eWBM etc for a passwordless approach.
2FA support would be great with Microsoft Authenticator / Google Authenticator.
I would vote for 2FA as long as the user has the ability to activate it or not. Some of us do not need it! My experience with it thus far in my old work environment was a real PIA! If it were a set and forget on a local connection but required on a mobile connection I suppose I could not be annoyed by it.
Enchantech wrote:I would vote for 2FA as long as the user has the ability to activate it or not. Some of us do not need it! My experience with it thus far in my old work environment was a real PIA! If it were a set and forget on a local connection but required on a mobile connection I suppose I could not be annoyed by it.
Ditto to this. Personally, I don't want to use TFA on my computers with Acronis backups either. Maybe with mobile, but only because I don't really do mobile backups, and don't do any to the Cloud - just while on my local network to my own NAS.
I feel secure enough in the 256-bit AES encryption and strong password. In order to get backup data from the Acronis cloud, they would have to have my Acronis login to first connect and then my encrypted backup password to access the data as well. And the smart-phone text or send code to email TFA is not all that secure.. plus if you have TFA on your email as well, it starts to be too much.
Yeah, my workplace instituted TFA to access their mainframes. You had to do this every time you logged on so you had to have your cell phone on and ready to acknowledge, "yeah it's me" each and every time you wanted access. I understood why they did this but for the consumer at home on a LAN it is way overkill!
Hello Mobley,
I'll clarify the current status of this feature request, but according to the latest information I've got from the RnD, 2FA is not in the nearest scope for Acronis True Image..
Thanks all for the comments and information. Agree this is not a universal need, but it is a feature commonly found in competitor products that originated from the cloud side - e.g. Carbonite, Tresorit, IDrive and others. I'm not saying these are better / feature-comparible products, only that they have seen the risk associated with cloud-based data backup and offer (optional) 2FA as mitigation. There's a pretty well universal consensus across the security community that passwords alone are not sufficient protection for valuable data.
To allay fears and bad experiences noted by others, a well implemented 2FA solution has practically no user overhead. It's only the web portal login for True Image that needs 2FA protection, not the background or client-based interaction you have with the product day to day. And even the web portal login can incorporate "remember this device", which is effectively using your PC (something you have) as the 2nd factor under normal conditions. It's only when you do something unusual like trying to access your backup data from a different computer or place that you might be challenged to provide a code from an authenticator app. This is how Office365 and Gmail 2FA workand it is solid protection against a bad actor using stolen credentials to access my cloud-based accounts or data.
2FA via SMS is better than nothing as it takes considerable effort to work around, but I can see no reason to pursue this route given the availability of cross-application authenticator apps, which do not suffer the same SIM swapping vulnerability.
It's true there are other vulnerabilities to be aware of. Don't allow login to your home router from outside your LAN, don't allow inbound connections to devices that don't have 2FA, don't connect anything to your home LAN that isn't trustworthy. Stay abreast of developing risks. However this one is a long-established risk with readily available solutions. Why not mitigate?
Mike
Mobley wrote:availability of cross-application authenticator apps, which do not suffer the same SIM swapping vulnerability.
It's true there are other vulnerabilities to be aware of. Don't allow login to your home router from outside your LAN, don't allow inbound connections to devices that don't have 2FA, don't connect anything to your home LAN that isn't trustworthy. Stay abreast of developing risks. However this one is a long-established risk with readily available solutions. Why not mitigate?
Mike
In this ratio, special attention should be paid to the security of the user directory itself, especially there Are many security vulnerabilities when using the network Protocol. In particular, this method of attack is exposed to Active Directory in the system itself. If the LDAP resource in turn is responsible directly for accessing the directory. Then your network must meet the security criteria. The solution to this approach is dspa as a dynamic two-factor database protection directly from azure active directory as the provider of the same Micrfosoft. Therefore, this solution is more optimal.