Blink Security Deprication

[captconstruct]

I received this email earlier today:

You are receiving this email because your account has used automation scripts that use an outdated login method to connect to your Blink account. With security and customer protection as our top priority, that login method is being deprecated.  This means that any scripts you are using will no longer work as of 5/11.  

We encourage you to try out IFTTT, our supported 3rd party integration, for more secure automation functionality. If you have other feature preferences or requests, you can always email product feedback to info@blinkforhome.com for consideration.

Thank you,  

Team Blink

[madshall]

Me too. Will see if it really gets broken and will take a look at the options afterwards.

[madshall]

Meanwhile I'll take a look which auth method IFTTT uses. Maybe I can switch to using it before they break things.

[tonymet]

I'm glad to hear it -- this felt like a weak security model.

btw anyone know how to get login notifications from blink?

[mtressl]

Just came here for the same email I got from Blink. Following.

[bartdorsey]

As a consumer of this for my homebridge module, I'll be interested to see what you can come up with. As for now I'm going to put an notice at the top of my module's github to let users know what's going on.

[erickribeiro]

blinkpy library is currently beta testing a solution to enable 2FA. See details here:
https://community.home-assistant.io/t/blink-cameras-discontinuing-legacy-login/192837/49

Any chance the same could be implemented in node-blink-security?

[madshall]

I am pretty busy today, but I think I could take a look at it this weekend. If anyone wants to help I'd be happy to accept a PR, too.

[madshall]

The PR is ready. I'd appreciate if anybody could pull that branch and test it, too. With auth_2FA = false it will follow the one-time verification flow via email. With auth_2FA = true it will prompt for a verification code every time the app runs.

[bartdorsey]

Okay so if I'm understanding this correctly when you set auth_2FA to false it does 2FA but only ONCE and then it saves a token somewhere for future authentications? while setting it to true causes it to prompt you for the code every time?

[bartdorsey]

After entering my code the first time I got this message:

    at Request._callback (/Users/echo/Developer/homebridge/homebridge-blinkcameras/node_modules/node-blink-security/lib/blink.js:423:33)
    at Request.self.callback (/Users/echo/Developer/homebridge/homebridge-blinkcameras/node_modules/request/request.js:185:22)
    at Request.emit (events.js:311:20)
    at Request.<anonymous> (/Users/echo/Developer/homebridge/homebridge-blinkcameras/node_modules/request/request.js:1161:10)
    at Request.emit (events.js:311:20)
    at IncomingMessage.<anonymous> (/Users/echo/Developer/homebridge/homebridge-blinkcameras/node_modules/request/request.js:1083:12)
    at Object.onceWrapper (events.js:417:28)
    at IncomingMessage.emit (events.js:323:22)
    at endReadableNT (_stream_readable.js:1204:12)
    at processTicksAndRejections (internal/process/task_queues.js:84:21)

But after clicking "Allow device" on the "Verify new Device Login" it seems to login properly with 2FA set to false.

[bartdorsey]

BTW after I'm authed correctly switching 2FA back to true results in this:

BlinkException [Error]: Can't retrieve system status
    at Request._callback (/Users/echo/Developer/homebridge/homebridge-blinkcameras/node_modules/node-blink-security/lib/blink.js:462:18)
    at self.callback (/Users/echo/Developer/homebridge/homebridge-blinkcameras/node_modules/request/request.js:185:22)
    at Request.emit (events.js:311:20)
    at Request.onRequestError (/Users/echo/Developer/homebridge/homebridge-blinkcameras/node_modules/request/request.js:881:8)
    at ClientRequest.emit (events.js:311:20)
    at TLSSocket.socketErrorListener (_http_client.js:426:9)
    at TLSSocket.emit (events.js:311:20)
    at emitErrorNT (internal/streams/destroy.js:92:8)
    at emitErrorAndCloseNT (internal/streams/destroy.js:60:3)
    at processTicksAndRejections (internal/process/task_queues.js:84:21)

[bartdorsey]

Also this is odd, i'm setting device name properly in the options but in one of the emails from blink it shows this:

I'm guessing this might be a bug on blink's side since the email I get with the code looks fine and shows my correct device name.

[madshall]

@bartdorsey I believe with the code verification it has to be required each time since that's how it works in 2FA usually. The way they implemented it is unknown and I believe the work isn't even finished on their end. That "|DEVICENAME|" is one of the reasons for me to think so.

when you set auth_2FA to false it does 2FA but only ONCE and then it saves a token somewhere for future authentications?

No, they register your deviceId in their systems and allow authenticating from that device later without you having to verify it again.