bpecek81
Member

Two factor verification - when will we get it?

I an on Upwork for 5+ years and have generated a good income for myself and, via fee's, for the site as well.

I must admit I am very fond of the Upwork and happy I stumbled over it all those years ago - it's just the best freelance site out there.

 

But I must admit, I have started to move my clients off of it despite very much enjoying the convenience it offers and being happy to pay a fee for that.

But money is at stake and I strongly believe the security system is lacking.

 

Implementing 2FV would improve this substantially.

 

Supposedly, it was on the roadmap already in 2014

Screenshot_1308.png

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

But no progress seems to have been made since then.

 

Would anyone be able to update me if this is now coming or no?

I'd be bummed to have to leave the site but that is where things are going.

14 REPLIES 14
aocumen
Moderator
Moderator

Hi Bojan, 


I will go ahead and check this with the team and get back to you when we hear some feedback from them about 2FA. Thank you for the gentle follow up!


~ Avery
Upwork

Thanks, I'd appreciate a definitive response.

If it is going to be implemented I'd like to have a clear date of implementation.

Actually, the post was just last year, July 11, 2017.

 

The 2014 you mentioned was the poster's Joined Date.

vladag
Community Manager
Community Manager

Hi Bojan,

 

Unfortunately we don't have an ETA yet but will update the Community once we have more specific information. Thank you for your feedback and keep an eye on the forums for future updates on this and other features our team continuously working on implementing in order to enhance our users' experience on our platform.

Untitled

Thank you, Vladimir.

 

I would then have to look into moving the rest of my clients away from Upwork, not have 2FV is just too much of a liability.

I am not understanding how you cannot have any tangible progress on such a crucial feature, you are supposedly working on it for about 2 years. 

How can you not give users anything better than 'No update, we'll let you know once there is some'?

 

 

 

 

 

Whilst I would like to see 2 factor verification too, it's not that hard to keep your earnings safe.

Take reasonable steps to prevent people gaining access to your password, set up a security question, and withdraw your earnings when available, it's not rocket science.

Your work is all hourly, earnings become available the same time every week, set a schedule...

 

Threatening to leave is not going to get anything moving any faster, and you'd better believe that there will already be careful calculations of the 2 year line, before which you can not take your clients off the site, now you've announced that you have taken clients off the platform already and are planning to continue to do so if your demands are not met.

 

 

 

 

I apologize for my tone, this was really not necessary. 

I am following this topic for a while and my frustration of not seeing any progress got the better of me 😕

 

Regarding:

"Whilst I would like to see 2 factor verification too, it's not that hard to keep your earnings safe.

Take reasonable steps to prevent people gaining access to your password, set up a security question, and withdraw your earnings when available, it's not rocket science."

 

That is true but it is not only about earning, it is about accessing my account in first place. I want to keep that data safe as well.

I work in an open office environment and someone could, if determined, get access to that data. 2FV would make that harder.

 

 

 

 

Two-factor verification provides no benefit to me.


@Preston H wrote:

Two-factor verification provides no benefit to me.


That's only because you don't own a smartphone Preston. It doesn't mean that it wouldn't benefit you if you had a smartphone. All things being equal, 2FA brings an additional layer of security to one's account.

-----------
"Where darkness shines like dazzling light"   —William Ashbless


@Rene K wrote:

@Preston H wrote:

Two-factor verification provides no benefit to me.


That's only because you don't own a smartphone Preston. It doesn't mean that it wouldn't benefit you if you had a smartphone. All things being equal, 2FA brings an additional layer of security to one's account.


 2FV is a pain in the proverbial until the day it saves your account from being compromised.

Then it becomes beyond useful.

 

All,

 

A few posts have been removed from this thread as they were against the Community Guidelines. While we appreciate the discussion, we encourage you to be respectful toward other users and avoid personal attacks.

~ Valeria
Upwork

If PayPal and any number of other websites dealing in cash transactions can (and have) implemented two factor verification - there is no reason why U. can't.

 

Nothing else needs saying.

jtgallucci
Member

At this point, it's inexcusable that Upwork doesn't support 2FA. What's worse is that they force you to provide a ton of personal and financial information (don't even get me started on all of the security issues that desktop app has) and they make almost no attempt to implement basic security features like this. In 2018 2FA is table steaks for security...even my Starbucks account supports it. 

Making decisions like this that choose to ignore the valid and clearly articulated concerns of its user base is why other platforms have started to gain traction. 

We all pay Upwork a ton of money in commissions as it is, the least they could do is implement a basic security feature like this to protect our personal information. If my identity gets stolen, I guess I know where to look.

 

A thread on this topic was posted some days ago by someone else. I responded there but that thread is off the radar. As it's relevant to this I am reposting my findings on this subject:

---

So this is an interesting question and also very important. From what I see Upwork is supposed to support 2-factor authentication. That is your password (one factor) and either an email or an SMS code (second factor). The site DOES offer that. However, in practice the site does not appear very judicious about actually requiring both factors. As noted, you can logout and back in, even from two different browsers, and the second factor is never asked. The help document says the following (I added bold to a key statement):

 

"Your security question is generally used to access specific parts of your account and phone verification is generally used at login, but either could be required when our security systems detect a login attempt or other operation that appears high-risk. "

 

It would seem that for the second factor to kick-in, the login must appear to be high risk to whatever algo UW uses. Perhaps this is from a known range of suspect IP addresses or maybe even an IP address that is different from the range you normally use to access your account. It may be interesting to take a laptop to an outside wifi and see if that is enough to trigger the ask of a second factor. 

 

Net, I see the site is creating a second factor but how it's ever used is a mystery for now. If someone tries it in two totally different environments, please post results. For now either the process is totally broken or the algo doesn't think these different logins are "high-risk" enough.