4 ms·
What I'm getting from this is that Coinbase was/is using SMS-based 2FA? Using anything short of mandatory U2F means the responsibility of this breach firmly fal
by Ansil849 5y ago
What I'm getting from this is that Coinbase was/is using SMS-based 2FA? Using anything short of mandatory U2F means the responsibility of this breach firmly falls on Coinbase's shoulders. It's like if you found out your bank uses single-bolt doors for its vault.
- thinkharderdev 5y agoIs there any d2c business anywhere in the world right now that requires U2F on all accounts? I think you underestimate how confusing all of this is to non-technical users.
- Ansil849 5y agoPlenty of banks require HOTP dongles. Those are, if not more confusing, than certainly on par with U2F dongles. Meaning if banks can do HOTP, they can do U2F, and using "confusing to consumers" is not an excuse.
- thinkharderdev 5y agoWhich banks require an HOTP dongle for customers. Maybe it is a non-US thing but I have never once seen that.
- ed25519FUUU 5y agoThe fact that there’s no OTP option even available is what bothers me. Let the power users use OTP if they want it. When OTP is available I always remove my phone and use that. Sim swap is such a common attack these days.
- DennisP 5y agoCoinbase supports Google Authenticator, and also hardware keys like Yubikey. https://help.coinbase.com/en/coinbase/getting-started/verify-my-account/how-do-i-set-up-2-factor-authentication https://help.coinbase.com/en/coinbase/getting-started/verify...
- ed25519FUUU 5y agoGood to know! I didn’t see the option on my phone. Will set it up ASAP.