Blinkpy accepts incorrect 2FA Code

Describe the bug The Blinkpy module accepts any 2FA code that I enter, even if it is completely wrong from the 2FA code that Blink sends in an email.

Steps to reproduce the behavior:

1. use no_prompt=False in the Auth() method
2. Run script
3. Get email from Blink for 2FA code.
4. Enter wrong code from Blink Email
5. Blinkpy will accept the code and continue on.

Expected behavior The Blinkpy module should deny access if the 2FA code is incorrect from Blinkpy.

blinkpy version: blinkpy==0.16.4

Log Output/Additional Information

pferland@rpi4:/mnt/6T/blink $ python3 main.py 
/mnt/6T/blink/config/.blink_config
Enter code sent to <REMOVED>: 7
Downloading Videos
Blink Cameras
Front Door - Outdoors
{'name': 'Front Door - Outdoors', 'camera_id': '<REMOVED>', 'serial': '<REMOVED>', 'temperature': 33, 'temperature_c': 0.6, 'temperature_calibrated': 33, 'battery': 'ok', 'battery_voltage': 145, <TRUNCATED>}

I reached out to the Blink Support team about this and they put the blame on the Blinkpy module. I do not believe them that this is an issue with the python module. I believe that it is an issue with their API not authenticating users correctly with the 2FA code. So I just wanted to cover the bases and have you take a look if possible and if you are able to replicate and verify that it is not an issue with the python module I will go back to Blink Support with that evidence.

Thank you for contacting Blink Technical Support.

Regarding about the third party script that you were using right now, we no longer have any support with any third party script. If you were having trouble with your third party script. We apologize but we can’t help you with that matter. We suggest you may contact the third party script operator that you were using. If the issue is with the blink application, we can definitely help you with that. Looking forward for your response. Best regards, Blink Technical Support

Thank you! -Phil

[fronzbot]

It returns false, but you’re not blocked from API calls so this is still an open issue

[pferland]

The Official Blink App does not allow bad 2FA Pins, this seems to be they are limiting access via their app artificially.

I was able to bypass the 2FA in my script by doing the following:

auth = Auth({"username": "<USERNAME>", "password": "<PASSWORD>"}, no_prompt=True)

blink.auth = auth
blink.start()
time.sleep(5)
blink.auth.send_auth_key(blink, "1")

<Continue on with code>

And it still works downloading the videos.

So, no need for 2FA even thought Blink “Requires” it for unverified clients.