Discussion: Why doesn't Netflix, one of the most shared streaming services fail to offer 2FA (two factor authentication)?
Tags: netflix, sec, twofactorauth, netsec
Published: 2019-07-22 01:33:18

Netflix, one of the largest streaming services in the world maintains millions of subscribers a year. This post doesn't cover the content or the subscribers, but rather poses an excellent question. 

**Netflix: why no 2FA for the login process?!**

2FA, also known as multi-factor authentication or two factor authentication provides an additional layer of security for an authentication mechanism. 
WIKI definition:

> **Multi-factor authentication**  (**MFA**) is an  [authentication](https://en.wikipedia.org/wiki/Authentication
> "Authentication")  method in which a  [computer
> user](https://en.wikipedia.org/wiki/Computer_user "Computer user")  is
> granted access only after successfully presenting two or more pieces
> of evidence (or factors) to an 
> [authentication](https://en.wikipedia.org/wiki/Authentication
> "Authentication")  mechanism: knowledge (something the user and only
> the user knows), possession (something the user and only the user
> has), and inherence (something the user and only the user
> is).[[1]](https://en.wikipedia.org/wiki/Multi-factor_authentication#cite_note-1)[[2]](https://en.wikipedia.org/wiki/Multi-factor_authentication#cite_note-2)
> 
> **Two-factor authentication**  (also known as  **2FA**) is a type, or subset, of multi-factor authentication. It is a method of confirming
> users' claimed identities by using a combination of  _two_  different
> factors: 1) something they know, 2) something they have, or 3)
> something they are.
> 
> A good example of two-factor authentication is the withdrawing of
> money from an 
> [ATM](https://en.wikipedia.org/wiki/Automated_teller_machine
> "Automated teller machine"); only the correct combination of a  [bank
> card](https://en.wikipedia.org/wiki/Bank_card "Bank card")  (something
> the user possesses) and a 
> [PIN](https://en.wikipedia.org/wiki/Personal_identification_number
> "Personal identification number")  (something the user knows) allows
> the transaction to be carried out.
> 
> Two other examples are to supplement a user-controlled password with a
> [one-time password](https://en.wikipedia.org/wiki/One-time_password
> "One-time password")  (OTP) or code generated or received by an 
> [authenticator](https://en.wikipedia.org/wiki/Authenticator
> "Authenticator")  (e.g. a security token or smartphone) that only the
> user
> possesses.[[3]](https://en.wikipedia.org/wiki/Multi-factor_authentication#cite_note-IOVATION-3)
> 
> **Two-step verification**  or  **two-step authentication**  is a method of confirming a user's claimed identity by utilizing something
> they know (password) and a second factor  _other_  than something they
> have or something they are. An example of a second step is the user
> repeating back something that was sent to them through an 
> [out-of-band](https://en.wikipedia.org/wiki/Out-of-band "Out-of-band")
> mechanism. Or, the second step might be a six digit number generated
> by an  [app](https://en.wikipedia.org/wiki/Mobile_app "Mobile app") 
> that is common to the user and the  [authentication
> system](https://en.wikipedia.org/wiki/Authentication_and_Key_Agreement
> "Authentication and Key
> Agreement").[[4]](https://en.wikipedia.org/wiki/Multi-factor_authentication#cite_note-4)

Netflix does not currently offer any forms of the above security. Why? Many claim that the engineering effort would not be worth it, or that their is not private information to protect. I'd argue these points and state that your:

 - Mailing address
 - Billing address
 - Last four of your credit card or PayPal (or billing method)
 
would be considered private information among many. A problem of unauthorized login sharing of Netflix credentials is rampant; 2FA would assist with preventing this. 

The question is -- **what's your take on why Netflix has yet to implement increased security measures for its users? Why no 2FA?**