3 ms·
> For all the shit coinbase gets, it's difficult to lose your coins in this manner. Aside from U2F, Coinbase offers TOTP and SMS-based 2FA, both of which are v
by Ansil849 6y ago
> For all the shit coinbase gets, it's difficult to lose your coins in this manner.
Aside from U2F, Coinbase offers TOTP and SMS-based 2FA, both of which are vulnerable to phishing. So no, Coinbase is not immune to losing coins in this manner. If Coinbase wanted to prevent being vulnerable to phishing they would i) only allow U2F 2FA, and ii) make U2F mandatory for all accounts.
- nemothekid 6y ago1. AFACT the user was phished in a manner that was specific to this platform. It's not really comparable to clicking a nasty link in an email. Whether you chose to use U2F or TOTP, the risks is upfront. The user in this case was running official software - there was no URL to check. 2. The vector of the attack isn't important. The user ultimately lost his coins because he wasn't running the latest version of the software. He could have have easily lost his shirt from an RCE. That is much more difficult on a managed SaaS platform.