Contributor I

Answered

MFA for Sonos Account

Forum|Forum|2 years ago
May 2, 2024
19 replies
809 views

Hi,

Hoping someone can answer a query around account security. As far as I can see the account we all use is only a single authentication. I’m hoping / wondering if there are any plans to change that by incorporating MFA?

Does anyone ( Sonos or community ) know if this is going to be incorporated or is on a rollout in the future ?

Thanks in advance !

This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.

Best answer by Corry P

Hi @mac2468

Welcome to the Sonos Community!

Thank you - I've marked this thread as a feature request and it will be seen by the relevant teams for consideration. Keep the ideas coming!

Show previous replies

Corry PAnswer

Sonos Staff

Hi @mac2468

Welcome to the Sonos Community!

Thank you - I've marked this thread as a feature request and it will be seen by the relevant teams for consideration. Keep the ideas coming!

"Common sense is the collection of prejudices acquired by age eighteen." - Albert Einstein

C

callmefrank

The web app now makes it possible to control your speakers from outside your network.
Without two-factor authentication it’s only a matter of time before users’ accounts get compromised and remote control of their speakers is possible by a third party!

I share this very concern and asked a related question here: can I turn off the web app?

It’s only a matter of time until we start hearing horror stories of people being woken up at 3am or having speakers blown by a hacker.

Sonos is not taking security seriously. Usernames are tied to email (so easy to guess) and they don’t require complex passwords (for example go check the setup account page - you can use ‘password’ as your password).

C

callmefrank

Hi @mac2468

Welcome to the Sonos Community!

Thank you - I've marked this thread as a feature request and it will be seen by the relevant teams for consideration. Keep the ideas coming!

Security is now a feature request? I’d think that should be foundational to any physical device you sell and then allow operation from the cloud...

A

Absolute40

Enthusiast II

Hi @mac2468

Welcome to the Sonos Community!

Thank you - I've marked this thread as a feature request and it will be seen by the relevant teams for consideration. Keep the ideas coming!

Security is now a feature request? I’d think that should be foundational to any physical device you sell and then allow operation from the cloud...

Agree security should be baked in from the start. I can’t think of any cloud-based systems that don’t use MFA. It’s asking for trouble. I checked my Sonos account and my home address is not populated, but some customers details will be, so there’s a potential GDPR issue there. On top of that we could potentially be locked out of our own accounts by a hacker who could then take full control our home speakers remotely. Our only option would be to create a new account, perform a factory reset on all devices and start the set-up from scratch!

Bring back the old Sonos app. It was clunky, but it actually worked!

M

mac2468Author

Contributor I

Hi @Corry P ,

Thanks for having me ! I appreciate that , I know it’s not for everyone but simply put it would be a decent step forwards in securing access to customers accounts.

Cheers!

Schlumpf

Virtuoso

Just my personal thoughts… but if my pw has been hacked, there is a security problem on MY side. And in case of Sonos use, what intention should a hacker have? To disturb me at night by starting some music? Worst scenario that could happen would be I have to change my pw.
There are other services that imo really more need a higher security level.
But as said… just my 2 cents

Ralf

A

Absolute40

Enthusiast II

Just my personal thoughts… but if my pw has been hacked, there is a security problem on MY side. And in case of Sonos use, what intention should a hacker have? To disturb me at night by starting some music? Worst scenario that could happen would be I have to change my pw.
There are other services that imo really more need a higher security level.
But as said… just my 2 cents

If my speakers started randomly playing music at night I think me and my family might have some issues with that! It’s only a matter of time before accounts get hacked, they don’t need a reason to do it.

Besides, I assume once someone has credentials for the underlying Sonos APIs they might be able to do more that just play music? Maybe they could compromise the devices/install malware/listen to microphones, who knows?

Bring back the old Sonos app. It was clunky, but it actually worked!

Schlumpf

Virtuoso

@Absolute40

Of course being hacked is not a pleasure, but I just wanted to leave my personal opinion about the necessity to do prevention for that on Sonos side or on user side.
And I‘m sure nobody can compromise your system from outside your network. And if someone is able to do so, I’m sure even MFA won’t stop him. Updating to MFA authentication would mean financial investment for Sonos and there has to be a real need for that. Just a „I‘m feeling better with that“ won‘t be worth the money I think. 😉

Ralf

G

gschellens

Lyricist III

Really amazed how lightly this is taken by some of the community. I live in a flat. Web services are hacked all the time. My neighbours would just *love* it when some joker plays some house music at max volume at night or when I’m travelling abroad 😬 Or damages my equipment. How much thought went into this, I wonder? So I really want MFA or at least an option to disable the web player.

btw I would never have bought Sonos if access from anywhere but the local LAN was allowed by default.

Sign up

Login to the community