I've been thinking about this for a while. I realize the isy.io portal has always been an additional risk to our systems, but now with standard browser based access it feels our systems are at an increased risk level.

Not complaining about the direction eisy is going, just being pragmatic.

I feel more authentication security, even if only optional to setup, is warranted. I would like to see MFA added, via an authenticator app or at least via text/email when accessing our systems via the isy.io portal.

There are many authenticator apps, I use Duo.

Rob

@RRalston personally I've been leaning more into the Passkey option and keeping them in iOS and/or Chrome (oddly enough). I am not much for a fan of the "old" way MFA worked since it seemed to be the most commonly method to attempt a phishing or sim clone attack. Although if somebody really wanted to just control my lights go for it! They'd have a lot of fun turning my lights on and off.

Mostly the device is local and while it can be contacted from outside feel that the process of doing that is too complicated for most hackers just to gain access to a "dumb" computer. But if they're just looking for random computer power for a broader function that's another thing.

I like that UD is going to a SSO with the portal credentials and that the eisy/eisy_ui is still available without an internet connection, but at the end of the day it's up to the user to make account credentials strong enough that they might withstand an "easy" attack.

Since you mention it...I use Authy for my authenticator. But I've been moving more into the iOS passwords world as Passkeys and codes can be handled in one location.

1 hour ago, Geddy said:

I am not much for a fan of the "old" way MFA worked since it seemed to be the most commonly method to attempt a phishing or sim clone attack

I don't disagree with this, which is why I suggested an authenticator app as an option, not just text or email codes.I also really like passkeys and I can store those in my password manager. The problem I have with passkeys at this time, in my experience, implementations typically still allow a password authentication method to be used, so it does not mitigate that attack vector.

From what I can tell, UD refers to the ISY.io portal as SSO, but I don't think it technically really is that, since we log into that site and can access our systems via browser launched from there. They do leverage it hat way for this forum and support ticket logins.

I don't think someone getting access to my eisy would be fun for me. Typically, malicious activity would be more about causing disruption, like deleting everything. I depend on the eisy when I am not home to still run programs and I would not necessarily be immediately aware if it is working or not. If I do become aware, how do I fix it when I am not home and probably can no longer log in remotely anyway.

I know I could choose not to use isy.io portal, but then I would lose UD Mobile whether at home or away. UD mobile was the initial driver for my use of the portal. Also, I want access to eisy when I am away and UD is now moving plug-ins inside IoX so we can also manage them remotely.

Anyway, we have to recognize that isy.io portal is not immune to hacking, including vulnerabilities in the portal's code base. AI based hacking will make this worse.

Anyway, those are my thoughts on this.

Rob