4 ms·

They already support other forms of 2FA, so I guess you mean they should turn off support for SMS. Keep in mind that for many users the alternative is no 2FA at

They already support other forms of 2FA, so I guess you mean they should turn off support for SMS. Keep in mind that for many users the alternative is no 2FA at all (they don't browse HN and Krebs), which is much, much worse. Coinbase should continue doing what they are doing, which is to support SMS, and educate and encourage users where possible to use something else instead.

space_rock 5y ago
Ok before I was locked out of my account for changing phone numbers they only had SMS
- leonry 5y ago
  You can change your phone number by re-validating your identity. During the 2FA step when logging in, you can click on "I need to change my phone number" (or similar).
deleted 5y ago
[deleted]
judge2020 5y ago
I'm not entirely familiar with coinbase, so is it really 2fa or is it 1fa in that you can use SMS as a recovery method when you don't know your password?
zitterbewegung 5y ago
How about allowing users to turn off sms.
- mrb 5y ago
  Coinbase does allow SMS to be turned off. I did that on my account. When SMS is turned off, and when a U2F security key is the only 2FA you configured, if you lose the security key the only way to recover the account is to contact their support department and provide a photo of yourself holding your ID.
wmf 5y ago
for many users the alternative is no 2FA at all I'm pretty sure people have phones and Coinbase can force them to install a 2FA app.
- cbhl 5y ago
  Which works fine until they buy a new phone and trade in or reset the old one without transferring the private keys -- and now you're locked out of your own account because you lost your second factor.
  - Consultant32452 5y ago
    No problem, just reset your factor over SMS!
  - driverdan 5y ago
    There are multiple ways to avoid this, such as using an app that saves those keys (eg Authy) or using recovery keys.
    - dotBen 5y ago
      But then bad guy just logs in to Authy with the same stolen credentials because most normal people will probably use the same credentials for everything, including Authy. And arguably, the smartest tech-savvy folk wouldn't be storing their 2FA keys in the cloud like Authy anyway. If your cloud account is protected by 2FA that's also in the cloud... it's turtles all the way down.
      - drexlspivey 5y ago
        How do you “Log in” to Authy? It’s tied to your Apple/Google ID afaik and the 2fa codes are also protected with a passphrase.
  - toomuchtodo 5y ago
    > and now you're locked out of your own account because you lost your second factor. To verify someone's identity ("Identity Proofing") using Stripe Identity [1] costs ~$2. They support IDs from 33 countries, and have implemented fraud detection in the flow. If you were so paranoid as to defend against someone stealing your government issued ID (used in the proofing process), you could paper mail a OTP to physical address on file. Does it suck and its the cost of no digital ID infrastructure in the US? Yes. Is it insurmountable? Not at all. At the end of the day, people are the weakest link, and we must fallback to meatspace trust anchors (in this case, possession of government provided ID that can be provided on demand with robust fraud detection mechanisms). You are who you are, and own what you own, not because of key material but because of the law. [1] https://stripe.com/identity https://stripe.com/identity
staticassertion 5y ago
> which is much, much worse. This attack wouldn't have been possible if they didn't allow SMS 2FA, so I don't think that's fair to say at all.
- winkeltripel 5y ago
  What if the users had no 2fa at all? attackers still had their passwords and their emails, and their sms numbers
bostik 5y ago
What they should be doing, is to subsidise YubiKeys to their high-value customers. Not just to lock down the logins to Coinbase, but to also secure their customers' email, Twitter accounts, and as many other online systems as would support hardware backed WebAuthn. Hell, PokerStars did this with RSA tokens back in 2008 so it's not like it's a new idea.
- matheusmoreira 5y ago
  I love my YubiKey but it doesn't work with my phone. Have newer models solved this problem?
  - twostorytower 5y ago
    My iPhone supports my Google Titankey through NFC, and I think newer Yubikeys also have NFC.
    - SpelingBeeChamp 5y ago
      HOLD ON. You can get your iPhone to actually recognize your Titan key via NFC? Please tell me how to do that? Two iPhones and every type of Titan key that is currently sold, still haven't been able to make NFC work, nor authentication over Bluetooth.
      - twostorytower 5y ago
        You just tap your key to the back of your iPhone whenever prompted (such as Coinbase app login).
        SpelingBeeChamp 5y ago
        Have you actually done that with a Titan key and had it work?
  - bostik 5y ago
    Yes. You need NFC chipped phone and and NFC model YubiKey. That also solves a major usability issue: instead of trying to juggle between a mobile application and a TOTP authenticator (on the same device!), or plugging in a USB adapter for authentication needs, you just quickly tap/wave your keyring next to the phone. Or take your phone quickly by your pocket when you need the second factor.
wpietri 5y ago
Wait, why should they accept customer funds if they don't think they can keep them safely? If somebody is saying, "Let me hold on to your money for you," it seems like a minimum bar is them being pretty sure it's not going to go anywhere.

space_rock 5y ago

Ok before I was locked out of my account for changing phone numbers they only had SMS

leonry 5y ago
You can change your phone number by re-validating your identity. During the 2FA step when logging in, you can click on "I need to change my phone number" (or similar).

deleted 5y ago

[deleted]

judge2020 5y ago

I'm not entirely familiar with coinbase, so is it really 2fa or is it 1fa in that you can use SMS as a recovery method when you don't know your password?

zitterbewegung 5y ago

How about allowing users to turn off sms.

mrb 5y ago
Coinbase does allow SMS to be turned off. I did that on my account. When SMS is turned off, and when a U2F security key is the only 2FA you configured, if you lose the security key the only way to recover the account is to contact their support department and provide a photo of yourself holding your ID.

wmf 5y ago

for many users the alternative is no 2FA at all I'm pretty sure people have phones and Coinbase can force them to install a 2FA app.

cbhl 5y ago
Which works fine until they buy a new phone and trade in or reset the old one without transferring the private keys -- and now you're locked out of your own account because you lost your second factor.
- Consultant32452 5y ago
  No problem, just reset your factor over SMS!
- driverdan 5y ago
  There are multiple ways to avoid this, such as using an app that saves those keys (eg Authy) or using recovery keys.
  - dotBen 5y ago
    But then bad guy just logs in to Authy with the same stolen credentials because most normal people will probably use the same credentials for everything, including Authy. And arguably, the smartest tech-savvy folk wouldn't be storing their 2FA keys in the cloud like Authy anyway. If your cloud account is protected by 2FA that's also in the cloud... it's turtles all the way down.
    - drexlspivey 5y ago
      How do you “Log in” to Authy? It’s tied to your Apple/Google ID afaik and the 2fa codes are also protected with a passphrase.
- toomuchtodo 5y ago
  > and now you're locked out of your own account because you lost your second factor. To verify someone's identity ("Identity Proofing") using Stripe Identity [1] costs ~$2. They support IDs from 33 countries, and have implemented fraud detection in the flow. If you were so paranoid as to defend against someone stealing your government issued ID (used in the proofing process), you could paper mail a OTP to physical address on file. Does it suck and its the cost of no digital ID infrastructure in the US? Yes. Is it insurmountable? Not at all. At the end of the day, people are the weakest link, and we must fallback to meatspace trust anchors (in this case, possession of government provided ID that can be provided on demand with robust fraud detection mechanisms). You are who you are, and own what you own, not because of key material but because of the law. [1] https://stripe.com/identity https://stripe.com/identity

staticassertion 5y ago

> which is much, much worse. This attack wouldn't have been possible if they didn't allow SMS 2FA, so I don't think that's fair to say at all.

winkeltripel 5y ago
What if the users had no 2fa at all? attackers still had their passwords and their emails, and their sms numbers

bostik 5y ago

What they should be doing, is to subsidise YubiKeys to their high-value customers. Not just to lock down the logins to Coinbase, but to also secure their customers' email, Twitter accounts, and as many other online systems as would support hardware backed WebAuthn. Hell, PokerStars did this with RSA tokens back in 2008 so it's not like it's a new idea.

matheusmoreira 5y ago
I love my YubiKey but it doesn't work with my phone. Have newer models solved this problem?
- twostorytower 5y ago
  My iPhone supports my Google Titankey through NFC, and I think newer Yubikeys also have NFC.
  - SpelingBeeChamp 5y ago
    HOLD ON. You can get your iPhone to actually recognize your Titan key via NFC? Please tell me how to do that? Two iPhones and every type of Titan key that is currently sold, still haven't been able to make NFC work, nor authentication over Bluetooth.
    - twostorytower 5y ago
      You just tap your key to the back of your iPhone whenever prompted (such as Coinbase app login).
      - SpelingBeeChamp 5y ago
        Have you actually done that with a Titan key and had it work?
- bostik 5y ago
  Yes. You need NFC chipped phone and and NFC model YubiKey. That also solves a major usability issue: instead of trying to juggle between a mobile application and a TOTP authenticator (on the same device!), or plugging in a USB adapter for authentication needs, you just quickly tap/wave your keyring next to the phone. Or take your phone quickly by your pocket when you need the second factor.

wpietri 5y ago

Wait, why should they accept customer funds if they don't think they can keep them safely? If somebody is saying, "Let me hold on to your money for you," it seems like a minimum bar is them being pretty sure it's not going to go anywhere.