Where is 2FA for our accounts??
I see the product is now renamed Acronis Cyber Protect but it seems like we still cannot enable 2FA for our Acronis accounts :(.
I am not really sure Cyber Protect is an appropriate name for the product without this basic cyber security and using Acronis products still seriously concerns me that my data is not safe.
When is 2FA coming, Acronis?
2FA for Acronis Accounts is not a feature of any of the Acronis applications that run on PC's - this would need to be implemented on the Acronis web servers where the accounts are being accessed. I don't see any recoding of ACPHO bringing in 2FA as it is a client application.
I would recommend all users who want to see 2FA implemented to submit Feedback direct to Acronis with this request.
My issue is my online Acronis account which I can log into to see my backups in the cloud is protected purely by password and no 2FA.
It doesnt matter if backups are encrypted or further password protected because if my Acronis account is compromised somehow then attacker can go in and press the button to delete the account and thus my data.
I expect Acronis to act in a responsible manner and employ reasonable security precautions in a product called Cyber Protect.
I submitted feedback about this at least twice over last few years and am amazed it is not yet implemented. I take issue with it again mainly because of product name change suggesting security efficacy.
Hello Everyone,
thank you for sharing your feedback on this long awaited functionality (registered all the feedback as the votes for TI-131874 Two-factor authentication for Cloud). We really hope to get this feature added to Acronis Cyber Protect Home Office after we release the new reworked product next year.
Ekaterina, sorry but if Acronis are looking at 2FA only for the new version of ACPHO, then they are missing an important point here!
2FA is needed to protect all Acronis user accounts and in particular when accessing the account via the Acronis web pages to access account information, or the Dashboard etc.
Steve Smith wrote:Ekaterina, sorry but if Acronis are looking at 2FA only for the new version of ACPHO, then they are missing an important point here!
2FA is needed to protect all Acronis user accounts and in particular when accessing the account via the Acronis web pages to access account information, or the Dashboard etc.
+ 1
It should also be an option when doing things within the GUI, such as doing cleanup or deleting a task. One odd thing I have noticed is that for encrypted cloud backups you are not asked for the encryption key when deleting a backup task - you are required to do so for non-cloud backups. I am sure this has not always been the case - or am I having a seniors moment.
Also, the password requirements for both the forum and user accounts needs to be reviewed. They are very weak.
Ian
I am in Agreement with Steve & Ian above. There should be a 2FA step when accessing not just the Acronis backup console, but it should also cover login to the cloud storage portal to prevent deletion of backups or changes in account permissions. We were just auditing security and I was surprised and disappointed to learn 2FA was not an option on Acronis (yet?).
I think that 2fa is a must. I am considering changing to another vendor which has 2fa.
Also, I am considering switching from Acronis software to a competing 2FA-protected software. Unfortunately, I currently use the program only for local backup. The lack of additional security in the form of 2FA, or preferably U2F, makes the cloud service useless for me.
Has anything changed in the case?
Is it really unnatural in 2023 to request 2FA in such a critical tool as cloud backups?
Two-factor authentication is absolutely necessary in such an infrastructure to be able to say that the product meets basic requirements. I still can't use your cloud for backups because you don't give such minimal security as two-factor authentication when logging into the system.
In my opinion, this is highly unserious behaviour by a company towards its customers. Especially as there have been requests from home users about the need for this type of security for many years...
Marcin Karwowski wrote:Has anything changed in the case?
Is it really unnatural in 2023 to request 2FA in such a critical tool as cloud backups?Two-factor authentication is absolutely necessary in such an infrastructure to be able to say that the product meets basic requirements. I still can't use your cloud for backups because you don't give such minimal security as two-factor authentication when logging into the system.
In my opinion, this is highly unserious behaviour by a company towards its customers. Especially as there have been requests from home users about the need for this type of security for many years...
Hello Marcin.
I notified the team regarding this feature.
So far there isn't any ETA but we expect to introduce it in the near future.
Thanks in advance!
IanL-S wrote:
It should also be an option when doing things within the GUI, such as doing cleanup or deleting a task. One odd thing I have noticed is that for encrypted cloud backups you are not asked for the encryption key when deleting a backup task - you are required to do so for non-cloud backups. I am sure this has not always been the case - or am I having a seniors moment.
I also find it strange that I can delete a backup from the GUI with all data in the cloud without first being asked for the encryption key.
This massively reduces the protection if you fall victim to a human operator ransomware, as it first deactivates all existing protection mechanisms and deletes backups.
Or alternatively to protection delete action from the GUI with the encryption key:
It would be ok if you could delete the backup job from the GUI, but then have to clean the backup data separately on the web (secured with MFA). That would be a kind of air gap.
Thomas Huber wrote:IanL-S wrote:It should also be an option when doing things within the GUI, such as doing cleanup or deleting a task. One odd thing I have noticed is that for encrypted cloud backups you are not asked for the encryption key when deleting a backup task - you are required to do so for non-cloud backups. I am sure this has not always been the case - or am I having a seniors moment.I also find it strange that I can delete a backup from the GUI with all data in the cloud without first being asked for the encryption key.
This massively reduces the protection if you fall victim to a human operator ransomware, as it first deactivates all existing protection mechanisms and deletes backups.
Or alternatively to protection delete action from the GUI with the encryption key:
It would be ok if you could delete the backup job from the GUI, but then have to clean the backup data separately on the web (secured with MFA). That would be a kind of air gap.
Hey Thomas.
Thanks for the feedback, we appreciate it.
I will forward your message to the team.
Thanks in advance!
Jose,
I am sure the development team is aware of these issues. If I recall correctly, I have sent emails to the product manager and Ekaterina, and that it was discussed at one of the MVP briefings. In an earlier post Ekaterina indicated that it would be addressed in the recode project (which is running many months behind schedule). The beta was anticipated to be released in the first quarter of 2022, so that would make it a year.
Ian
Hello,
I cancelled the subscription for this product because I found a better solution.
What bothered me about the Acronis Cyber Protect Home Office was that I was able to back up all the data in the cloud directly from the computer program and therefore there is no real air gap for the backup.
The new solution is also from Acronis: the "Cyber Protect Backup Advanced" product. You can buy it directly from Acronis or one of the countless resellers (https://www.acronis.com/de-de/partners/locator/) under similar names. The workload to be protected is a workstation and so I now protect all PCs of me and my relatives with it (with a reseller, unlimited devices and 1 TB storage for 15 EUR/month). Fetarues: Backup to the Acronis cloud, vulnerability assessment (shows me old software versions on the clients).
Everything is configured in the web interface of Acronis or a service provider and only one client is installed on the PCs, which starts with will be linked to my account. On the client, only the encryption key for the backup can be set and nothing else. No cloud backup can be deleted from this!
The only thing that could be manipulated on the PC is to change the encryption key, but then
the backup brings an error message. Every week I have a report sent to me, from which I can check the status of the backups etc. of all clients. A very nice solution for me.
IanL-S wrote:Jose,
I am sure the development team is aware of these issues. If I recall correctly, I have sent emails to the product manager and Ekaterina, and that it was discussed at one of the MVP briefings. In an earlier post Ekaterina indicated that it would be addressed in the recode project (which is running many months behind schedule). The beta was anticipated to be released in the first quarter of 2022, so that would make it a year.
Ian
Hello Ian.
In fact there is the the feature request TI-131874. Happens that from what I can see there is no ETA for the implementation ( at least for now ).
Thanks in advance!