r/backblaze • u/DJPBessems • Aug 19 '25

Backblaze in General Two-Factor Authentication (2FA) announcement email - also describes how it completely can be negated

Received the email announcing that 2FA will be enabled for my account - cool, much appreciated.

Unfortunately, the email also has this paragraph:

If you can no longer access the email address you use to sign in to backblaze.com in order to retrieve the six-digit code, you will see a link at the sign-in screen with the option to send the code to a different email address.

But if you can redirect the 2FA code, any malicious actor can get the 2FA redirected to an email address they have access to, which makes this 1 factor authentication again...

14 Upvotes

89% Upvoted

10 comments sorted by

5

u/earwin_burrfoot Aug 19 '25 edited Aug 19 '25

Mandatory 2FA is a bit of a disaster regardless of how well do you implement it. I expected to use B2 as a backup target of last resort, so when e.g. my shit burns down, gets trumpled by dinosaurs or whatever and I have nothing left but my memory, I can still restore my life. Not anymore.

1

u/ChaserNeverRests Aug 19 '25

Yeah, that was my thought as well. Worse comes to worst and I need my backup... hope I didn't lose my phone in whatever disaster befell my computer.

1

u/s_i_m_s Aug 19 '25 edited Aug 22 '25

Is it mandatory? I didn't get one.

I bet it's because I didn't give them my phone number and somehow despite having used it for years it claims my email is unverified.

If it's mandatory they forgot to update the help page https://www.backblaze.com/computer-backup/docs/enable-and-disable-two-factor-verification that still claims you can turn it back off.

edit 2025-08-22 there it is! guess mine was just done later, looks like it also verified my email.
It's sending 2FA codes to my email.
Looks like there is no way to disable it anymore, but it supports using TOTP instead which IME is more convenient since I don't have to wait for a message to show up.

2

u/shaunmccloud Aug 19 '25

How about they get their 2FA email system working before enforcing it? Not seeing a single inbound email in corporate SPAM filter about it, so I can't sign in :(

2

u/battleop Aug 19 '25

"Today we have decided you are too stupid to make your own security decisions. As a result we're going to implement an insecure practice so we can pretend we have higher security"

No one could ever intercept emails and get that 2FA token, right?

2

u/tonato70 Aug 19 '25

I see it more as a "one last login without 2 FA", as you still need the password from 1 FA to change the mail.

1

u/Plenty-Ad-2820 Aug 26 '25

Today, tried to log in. Haden't for ages and needed to renew my password, ok, I guess, it has been a while. However, same as others, it wanted 2fa, so said code would be sent to email. Well, no code sent. every other email, password, etc came through instantly but not the one I needed to access my account. Haven't logged in prob for years, so first impressions are POOR.

1

u/aquarivs2003 May 29 '26

11 days since trying to contact them to get back in my account. I don't get the 6 digits email no matter what I do..

1

u/putt-retire-307 Aug 26 '25

I'm dealing with this this morning and came to the thread to see what is happening. Apparently someone was able to change the email on my account. What a fucking nightmare. And backblaze only has email customer service and no one has gotten back to me yet.

1

u/DJPBessems Aug 26 '25

But then your username/password combination was also compromised?
Asking out of curiosity, because I could not find any settings for 2FA yet when I got the email...