-
Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
Why is there no 2FA for Tesla accounts?
- Thread starter PoitNarf
- Start date
I am thinking about how to best protect my Model 3 with the given authentication methods.
Obvious things:
Good thing: I just changed my password to something stronger via the web browser on my laptop, and the phone instantly required me to enter the new password for access although I was already logged into the app.
Obvious things:
- Strong password
- change password periodically
- Use PIN to drive (even if it doesn´t help when account data compromised but there are other cases, like stolen/cloned key card)
Good thing: I just changed my password to something stronger via the web browser on my laptop, and the phone instantly required me to enter the new password for access although I was already logged into the app.
Eno Deb
Active Member
Great, so then when someone grabs my phone they get both my car key AND my 2FA device...
Eno Deb
Active Member
Obviously getting your car key stolen is always a problem, but they can't do anything with the 2FA codes if they don't also steal your account password, so in no case will you be worse off than you are now. Besides, assuming Tesla supports standard TOTP, there are authenticator apps that protect the codes with a passcode or biometrics.
Atari2600
Active Member
I wonder if the car itself could support 2-Factor using your phone (Bluetooth) or Keycard (RFID) and Yubikey (RFID) instead of using a PIN.
Sure, I mean, it’s just kind of funny. My biggest fear (such as it is) regarding my tesla account is that if someone has my phone, they can drive away with my car. They don’t need to unlock the phone or anything, just carry it up to the car. So the ‘added security’ of sending codes to my phone, or using an app on my phone to generate codes, helps me not at all — it just makes it STILL WORSE if someone walks away with the phone!
Now, I’ve never had a phone stolen and this isn’t keeping me up at night. But I feel like if I was going to ask for one security thing, it would be for my wife’s phone to be able to instantly de-authenticate my phone and cause the car to come slowly to a stop if my phone is the ‘key’ allowing it to run. (Not to put additional weight on my phone as a security device.)
Eno Deb
Active Member
Sure. Same if they steal your wallet with the key card (or a traditional car key, for that matter). If you're really concerned about it you can use the PIN-to-Drive feature on a Tesla.
It doesn't protect against a stolen phone, but it does provide additional protection in case someone steals or hacks your password.
Yes, but that has nothing to do with 2FA.
Last edited:
Eno Deb
Active Member
In terms of security what we have is terribly broken IMO. And in case you don't care, Tesla will very likely make 2FA optional like most other companies that offer it.
I certainly hope so. But reality shows that most companies initially provide optional 2FA, but then ram it down everyone's throat later down the road. Apple is a perfect example of that.
Eno Deb
Active Member
Actually Apple doesn't really force you to use it (they just don't let you turn it off if you are already use it). And I don't think "most" companies have similar policies (I can't think of a single example other than Apple?).
Not going to continue this with you. I'm against 2FA in this situation. I've said my piece. Feel free to keep talking over me if you so chose.
They do if you have a HomePod (of all things). Also I think for developer accounts.
Eno Deb
Active Member
Heh, that's funny about the Homepod. It makes a lot of sense for developer accounts though, since it is possible to submit manipulated binaries to the app store with such an account (that has actually happened in the past).
Exactly, any login you have today that doesn’t use 2FA is just waiting to be hacked. People use the same passwords everywhere. Once one hash is stolen and cracked, then your common password becomes readily available. Just looks at haveibeenpwned.com to see all the online services that have already lost your info.
At some point we’re going to need 3FA to combat hacking. Something you know, something you have, and something you are (face, fingerprint, etc).
Uncle Paul
Well-Known Member
Tesla currently has the ability to access your car to download OTA updates. They can remotely unlock the doors, give you emergency access, track your car, track your data stream from video and sensors. They can remotely diagnose any problems you might be having and even warn you if a part is acting up and arrange for you to take it into your local service and have the part waiting for you when you arrive.
Would they still have this capability with the additional personal security.
Would they still have this capability with the additional personal security.
Eno Deb
Active Member
Yes. They have privileged access to the cars in other ways (e.g. through SSH) which won't be affected by regular user authentication.
One comment on 2FA for this is that it needs to the TOTP type where you get the code from an app (Authy, 1Password, etc) and not a text message. Beside the inherent insecurity of SMS (google it) that restricts you to one phone. Many people use one login on several devices (several cars) and if you needed to re-login would need a shared TOTP method.
Yes, you can set up different Tesla accounts for each car but that is a major pain.
Yes, you can set up different Tesla accounts for each car but that is a major pain.
Similar threads
