3 ms·
Well, it's not like Coinbase should be blamed for all of it. It's a combination of their customer's poor hygiene + a flaw in Coinbase’s SMS Account Recovery pro
by Fiahil 5y ago
Well, it's not like Coinbase should be blamed for all of it. It's a combination of their customer's poor hygiene + a flaw in Coinbase’s SMS Account Recovery process.
At least they will be reimbursed, and everyone should walk happy.
- vngzs 5y agoAnyone care to speculate what the flaw in their SMS recovery flow actually was? It's hard for me to think there's even a safe way to implement SMS based account recovery. They would be smarter to just turn it off.
- floatingatoll 5y agoI do not have specific answer for Coinbase. Typically, the flaw would be in modifying one of the form inputs to get the code delivered to a different phone number. That usually works out to either modifying the "destination number" client-side form value, or swapping in an edited/reused session token from a different login session's MFA challenge, to exploit missing ownership checks on the various underlying pkey object IDs.
- gowld 5y agoSMS is fundamentally insecure, yes. But this sounds like a problem in the webapp that prepares and sends SMS messages, not SMS itself.
- gowld 5y ago> everyone should walk happy. The reimbursement comes from somewhere. Investors may not be happy. "everything is securities fraud" https://www.google.com/search?q=%22everything+is+securities+fraud%22 https://www.google.com/search?q=%22everything+is+securities+...
- latchkey 5y agoI'm guessing their insurance didn't cover it since it related to insecure account practices. So this is likely from their own revenues. https://help.coinbase.com/en/coinbase/other-topics/legal-policies/how-is-coinbase-insured https://help.coinbase.com/en/coinbase/other-topics/legal-pol... I don't see the connection with your link to securities fraud though.
- deleted 5y ago[deleted]