[Help] OTP code not asked thru mobile app!

[j.mrtns]

Hello,

I have a F8 SSD Plus NAS with latest TOS version (6.0.673) and i decided today to connect the NAS to mobile TNAS app.

I'm very concerned about security so i also set up an two step verification for my admin account using OTP function.
And while it does work as intended on LAN connection, when i connect using the mobile app it doesn't need the OTP code! Just admin login and password!
I restarded NAS but that's the same.
This is a serious security flaw for me and i don't understand the point of setting up a two step verification if you can connect to NAS thru internet without it...

Please can you correct this issue?

[EthanLiu]

Thank you for your feedback. Data security has always been a core area that we attach great importance to and continuously strive to optimize. Regarding the issue you described, we have conducted multiple rounds of in-depth discussions and comprehensive evaluations.

When users connect to devices via our mobile client, we employ high-strength transmission encryption technology to rigorously protect sensitive information such as account passwords. Meanwhile, we have established a complete set of internal verification rules to ensure the security and accuracy of data during its transmission and processing.

Based on the aforementioned security measures and after thorough consideration, we believe that in the current scenario of mobile-end login, we are already able to provide sufficient security protection. Therefore, we do not mandate OTP (One-Time Password) verification. However, please rest assured that we will continue to monitor security trends and constantly refine our security strategies to address potential security challenges.

[j.mrtns]

Thank for your answer and i'm sure you're confident about your security measures but as a user i'm not confident about that. And that's why i set up a two step verification.
So the problem is not that your app uses encryption to protect the password in itself. The problem is that it does mean that the NAS is accessible thru internet without OTP code! This is nonsense!

[TMevanna]

Thank you very much for choosing our product and offering valuable feedback on account security! The OTP protection mechanism you mentioned is very important, and we fully understand your concerns. Regarding the issue you've raised, currently, OTP authentication skipping is only applicable to clients, but when accessing TNAS through a browser, verification code validation is still required.