3 ms·

I've used bitpay and liked their service. Seems like these social engineering hacks can happen to most anyone. Although Im suprised such emails wouldnt requir

I've used bitpay and liked their service. Seems like these social engineering hacks can happen to most anyone. Although Im suprised such emails wouldnt require a two-factor authenitication or at least a PGP-signature.

Vespasian 11y ago
As said in another comment, phishing can circumvent 2fa (just phish the code as well).
- Sanddancer 11y ago
  2fa doesn't necessarily have to be something online. For quarter million dollar transfers, it could, and probably should, require some steps of offline verification, like needing the CFO to sign off on it too, or a quick phone call to make sure everything is on the up and up. Hell, the CEO shouldn't even be handling these transactions. I don't know of a single other place where the CEO would be this involved, especially if transfers of this size are "routine". This is just poor accounting top to bottom.
jandrese 11y ago
Good luck getting anybody else to use PGP. I've been trying for years and to date not a single person has ever sent me an encrypted email. The only company that bothers is Facebook, and I'm not sure their pilot program is going to last much longer.
- flatline 11y ago
  For internal usage s/mime is not really that bad. Works fine with gmail. $25 a year gets you a personal cert. All my work email is encrypted. Bitpay is small enough to be able to do this without any extra infrastructure.
- aianus 11y ago
  We use PGP for sensitive internal emails at Coinbase as well as for signing releases on some of our open-source client libraries. Keybase makes it pretty easy. You can see all of our keys here: https://keybase.io/coinbase https://keybase.io/coinbase