8 ms·
> 2FA tokens for all users worldwide were subsequently revoked to ensure the new infrastructure was in effect. We have mandatory 2FA policies on both the fronte
by Shank 5y ago
> 2FA tokens for all users worldwide were subsequently revoked to ensure the new infrastructure was in effect. We have mandatory 2FA policies on both the frontend and backend to protect users during this revocation phase, as outflows such as withdrawals have a requirement to setup and use 2FA in order to withdraw.
How is this supposed to work? They revoked all of their 2FA for all accounts? Doesn't this just open them up to credential stuffing attacks? This is a really, really odd response to me. I can understand migrating to a new 2FA system, but they'd have to re-establish the chain-of-trust somehow. Are they just hoping that users don't have compromised email/SMS accounts in order to enable the new 2FA system?
- ceejayoz 5y agoI'm wondering if it's a badly-worded way of saying "anyone in the system gets kicked out and has to re-2FA". If they literally removed 2FA from everyone, that's insane.
- idop 5y agoPretty sure that's what they meant. They said "tokens."
- presty 5y agoyes, they literally logged everyone out, removed 2FA, and on the new login, users had to re-add 2FA
- cornedor 5y agoWouldn't this also allow an attacker to add his own 2FA?
- nefitty 5y agoThis is hilarious. This company is literally at the apex of the crypto industry and this is the kind of mistake they make. Yeah, immutable smart contracts written by their fellow proponents will also save the world lol
- capableweb 5y agoCalling crypto.com anything near "apex of the cryptocurrency industry" is a very broad lie. Crypto.com is for people who just "wanna invest in crypto and get rich", others who are actually involved in the space (developers, companies and others) are nowhere near crypto.com as they have proven time and time again they are not serious about anything, even the basics like security.
- smt88 5y agoAren't they one of the largest exchanges? EDIT: They're #3 (bigger than Coinbase). Only OKX and Binance are bigger[1]. 1. https://www.coingecko.com/en/exchanges https://www.coingecko.com/en/exchanges
- barkingcat 5y agoNo! Coinbase is a large exchange...
- thebean11 5y agoI don’t think that’s true..bigger than Binance? By what metric?
- barkingcat 5y agoCoinbase doesn't have to be bigger than Binance to be "a large exchange" - we're not talking about "largest exchange" if you read the message. It's definitely more established than crypto.com though. Do you think crypto.com is larger than Binance?
- thebean11 5y agoSorry completely misread, I thought you were saying it's the biggest
- smt88 5y ago
- Scoundreller 5y agoDoesn’t really matter if your 2FA keygen algo got completely compromised.
- mdoms 5y agoOf course it matters. Even if we assume someone figured out how to own the 2FA system, that knowledge doesn't magically make its way into the brain of every script kiddy capable of credential stuffing a login form. They're two totally different vectors with different surface area.
- Scoundreller 5y agoMy thought is that it’s not really 2FA, and 2FA means temporary tokens, and there’s a method to gain entry with just login+token, e.g. via password reset.
- tialaramex 5y agoYou can just make up whatever factors. If you want to deliver security then MFA is an interesting strategy that needs careful consideration and planning, you might end up building things like Security Keys so as to solve real threats. You might fix real problems (Google eliminated phishing) at your organisation. But if your goal is to bamboozle fools into giving you their real money in exchange for Itchy and Scratchy money that you may or may not then "lose" then you don't need all that hard work. Take whatever nonsense you cobbled together and say it's "Two factor" because that means "good" to people who don't know any better.
- eswat 5y ago> users had to re-add 2FA And you are not asked to do this while logging in again. It is assumed you know why you have to reauthenticate and that you have to re-add 2FA in your app settings…
- deleted 5y ago[deleted]
- kerng 5y agocrypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it. But basically in this case, you didn't even need a password to log back in, it was just an email to click a link, then FaceId/PIN and logged in and prompt to re-add 2fa. The app must store the password itself somehow and auto use it. Anyone know how the do auth on the app? For users in the US there is no way to change the password, because the webapp (which might have that feature) is not allowed to be used from US. Once I asked how to change password and support said I can change the PIN on phone and dont worry your funds are safe.
- Shank 5y ago> crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it. If you're speaking from experience as a user of their service, I strongly suggest that you use a different exchange. Gemini + Coinbase both have very easy-to-understand authentication systems. If you don't understand the authentication system, that's a good red-flag that you should take as a reason to move to a more trustable platform. (Just my two cents, as someone who works on authentication system architecture design.)
- tornato7 5y agoAgreed. As someone who has integrated with dozens of crypto bank APIs, I can tell you Gemini's authentication and security is top notch (second only to Fireblocks)
- deleted 5y ago[deleted]
- kerng 5y agoGood point. Overall the user experience of crypto.com is really nice though. I mean the app is tons better then Coinbase and I think a big reason that crypto.com is growing tremendously. Users like it.
- godot 5y ago
- tsimionescu 5y agoBased on them saying they migrated to a new 2FA system, I think it's the latter - they disabled the current 2FA option and required everyone to register a new 2FA method. > In an abundance of caution, we revamped and migrated to a completely new 2FA infrastructure.
- AlexandrB 5y agoWhat are the odds they migrated to a new 2FA system in a few days without introducing new, serious bugs?
- nailer 5y agoI use crypto.com and they removed 2FA from me earlier in the week, asking me to set it up again. It was worrying as I wasn't sure if it was a scam, there was no reasoning behind it.
- PinguTS 5y agoThat was exactly my question when I read this. How do they establish trust, when 2FA is revoked? How they prevent that the bad guy enables now 2FA and the god guy is locked out of his account? May the god guy didn't get the message that Crypto.com had an issue, because s/he is unavailable.
- Scoundreller 5y agoMy thought is maybe they didn’t really do 2FA, but exploited a password reset mechanism that only required 2FA? IE: single factor resets, so a compromised “2FA” was actually keys to the kingdom? But you’d think the attacker would need access to a user’s email or some such then.
- tsimionescu 5y agoGiven that apparently their previous system simply allowed login/payments without the configured mandatory 2FA, per their statements about the root cause of the issue, this may have been a move of desperation...
- sparkling 5y agoIs anyone else getting the feeling from this press release that it seems they actually don't (yet?) know how their previous 2FA system was circumvented by the attackers?
- presty 5y agoyeah, the PR is totally unclear about how they got hacked, or if they even know
- nodesocket 5y agoMy exact thoughts, umm where is the root cause and explanation of the breach? They just reset 2FA as a reactionary measure. The attackers have compromised more than 2FA to be able to initiate withdrawals. This doesn’t add up.
- Mezzie 5y agoIf they knew, they'd share and talk about how they fixed it. As a communications person, reading between the lines tell me they've got no idea what happened. Comforting!
- ashtonkem 5y agoTime to play the classic crypto exchange game: hack or exit scam? Disabling 2FA in this scenario is dumb enough to raise the question of malfeasance of the part of this theft.
- lolinder 5y agoSomehow I doubt a fraudulent company on the verge of an exit scam would spend $700 million to rename an arena right before pulling the plug. Incompetent? Probably. Fraudulent? Unlikely. https://www.latimes.com/business/story/2021-11-16/crypto-staples https://www.latimes.com/business/story/2021-11-16/crypto-sta...
- otterley 5y agoThe Houston Astros played at Enron Field until Enron was revealed to be a criminal enterprise and several of its leaders went to prison. The world has a short memory, it seems.
- lolinder 5y agoWhat OP was referring to was a take-the-money-and-run plan where the company knows ahead of time that the whole thing is going to explode and causes it to on purpose. My understanding is that Enron's leaders were caught in fraud and that led to the collapse of the company—they weren't planning on it collapsing, so the investment actually made sense in that case.
- Applejinx 5y agoNo, that's normal pyramid scam behavior. I would say it was more likely that they were fraudulent if they were escalating their meaningless promo gestures to keep anybody from cracking as their scam gets too big to keep together. The bigger the risk, the bigger the colorful gesture. I'm imagining it as '$700 million IN CRYPTO, which is of course better than money'. For a name: which could easily be restored if it turns out the payment is worthless. But that's just my fantasy of how this might have gone on. If it's $700 million in real money that only underscores how desperate they are to make some colorful gesture.