5 ms·
Agree. Although I would like coinbase to move away from SMS 2fa
by space_rock 5y ago
Agree. Although I would like coinbase to move away from SMS 2fa
- agumonkey 5y agoI don't know about you, but in the days of smartphones, login + mail + sms seems pointless. The only lock is the pin code / fingerprint on your phone, since when that is unlocked, the attacker gets to trigger all validation steps.
- opheliate 5y agoThe important part is having physical access to the phone. A targeted attack against you now requires a physical element, rather than being entirely online.
- danuker 5y agoAssuming the phone is not remotely exploited.
- willvarfar 5y agoAgree with everything you say, but add to that a lot of sms 2fa exploits are sim or redirection attacks. It’s possible to get access to a phone number without access to the phone. Here’s an old story of a friend who had a weird talk with someone who had redirected their phone: https://williame.github.io/post/24949768311.html https://williame.github.io/post/24949768311.html
- mdavis6890 5y agoThey already support other forms of 2FA, so I guess you mean they should turn off support for SMS. Keep in mind that for many users the alternative is no 2FA at all (they don't browse HN and Krebs), which is much, much worse. Coinbase should continue doing what they are doing, which is to support SMS, and educate and encourage users where possible to use something else instead.
- space_rock 5y agoOk before I was locked out of my account for changing phone numbers they only had SMS
- leonry 5y agoYou can change your phone number by re-validating your identity. During the 2FA step when logging in, you can click on "I need to change my phone number" (or similar).
- deleted 5y ago[deleted]
- judge2020 5y agoI'm not entirely familiar with coinbase, so is it really 2fa or is it 1fa in that you can use SMS as a recovery method when you don't know your password?
- zitterbewegung 5y agoHow about allowing users to turn off sms.
- mrb 5y agoCoinbase does allow SMS to be turned off. I did that on my account. When SMS is turned off, and when a U2F security key is the only 2FA you configured, if you lose the security key the only way to recover the account is to contact their support department and provide a photo of yourself holding your ID.
- wmf 5y agofor many users the alternative is no 2FA at all I'm pretty sure people have phones and Coinbase can force them to install a 2FA app.
- cbhl 5y agoWhich works fine until they buy a new phone and trade in or reset the old one without transferring the private keys -- and now you're locked out of your own account because you lost your second factor.
- sneak 5y agoUsing SMS 2FA is negligent, considering it’s been four+ years since NIST told the industry not to use it because it’s not safe. (It’s also the only option offered by many US banks, which is a sad commentary on the level of tech innovation in finance in the USA.)