5 ms·

yes, they literally logged everyone out, removed 2FA, and on the new login, users had to re-add 2FA

• cornedor 5y ago
  Wouldn't this also allow an attacker to add his own 2FA?
  • nefitty 5y ago
    This is hilarious. This company is literally at the apex of the crypto industry and this is the kind of mistake they make. Yeah, immutable smart contracts written by their fellow proponents will also save the world lol
    • capableweb 5y ago
      Calling crypto.com anything near "apex of the cryptocurrency industry" is a very broad lie. Crypto.com is for people who just "wanna invest in crypto and get rich", others who are actually involved in the space (developers, companies and others) are nowhere near crypto.com as they have proven time and time again they are not serious about anything, even the basics like security.
      • smt88 5y ago
        Aren't they one of the largest exchanges? EDIT: They're #3 (bigger than Coinbase). Only OKX and Binance are bigger[1]. 1. https://www.coingecko.com/en/exchanges https://www.coingecko.com/en/exchanges
        • barkingcat 5y ago
          No! Coinbase is a large exchange...
          • thebean11 5y ago
            I don’t think that’s true..bigger than Binance? By what metric?
            • barkingcat 5y ago
              Coinbase doesn't have to be bigger than Binance to be "a large exchange" - we're not talking about "largest exchange" if you read the message. It's definitely more established than crypto.com though. Do you think crypto.com is larger than Binance?
              • thebean11 5y ago
                Sorry completely misread, I thought you were saying it's the biggest
          • smt88 5y ago
            I checked. Crypto.com is the #3 exchange and bigger than Coinbase[1]. 1. https://www.coingecko.com/en/exchanges https://www.coingecko.com/en/exchanges
            • deleted 5y ago
              [deleted]
      • HaZeust 5y ago
        I would argue that by you giving the torch to crypto.com as the company that caters to casual users that "just wanna invest and get rich", it is indeed one of the apexes of the industry. A product successfully marketing a fringe and specialized technology to the average consumer is just that.
        • idiotsecant 5y ago
          Is it? I'm not sure of numbers of total accounts but anyone who knows anything about crypto is suspicious of crypto.com as a platform and I don't know anyone who uses it when things like coinbase are available. They just bought an expensive URL and spammed a bunch of ads. If that makes them the apex of the industry I guess CALL THE GENERAL AND SAVE SOME TIME is the apex of the car insurance industry.
          • simonw 5y ago
            The two car insurance companies I see the most adverts from are State Farm and Geico - and yes, it looks like those two are the apex of their industry: https://www.valuepenguin.com/largest-auto-insurance-companies https://www.valuepenguin.com/largest-auto-insurance-companie...
        • Karrot_Kream 5y ago
          This is a common play in several industries. Art of Shaving markets itself well to casual people interested in traditional shaving products but they take regular products, mark them up by a lot, rebrand and then upsell. Nobody claims Art of Shaving is the apex of shaving. Best Buy does similar marketing in regard to electronics, but Best Buy certainly isn't the apex of electronics retailers. What makes you think cryptocurrency companies would be any different?
          • HaZeust 5y ago
            I would say Best Buy is an apex electronics retailer. Why wouldn't you?
            • 5y ago
    • secondaryacct 5y ago
      I have an ex colleague working there as lead dev: knowing him, no, they re not at the apex lol
    • barkingcat 5y ago
      I'd say Coinbase is the company at the apex of the US cryptocurrency industry. crypto.com is a two bit player in comparison.
    • rmbyrro 5y ago
      Isn't this equivalent to saying the entire health industry is fake and untrustworthy because of Theranos? I don't it looks kind of same to me, and sounds absurd.
    • KeAShizukuTio 5y ago
      Crypto bros versus banks that have been doing this for a 100 years.
    • matheusmoreira 5y ago
      > This company is literally at the apex of the crypto industry Cryptocurrency was not even supposed to have these pseudobanks called exchanges leading this space. It wasn't even supposed to be an "industry". People were supposed to mine cryptocurrency on their own commodity hardware and use that to transact amongst themselves.
      • HaZeust 5y ago
        Almost like its core mission statement was only led by the voluntary virtuosity of its participants - and wasn't as novel as previously thought. Huh.
        • imtringued 5y ago
          It's basically a digital gold standard and the gold standard hasn't lead to an enlightened society either. "Insanity is doing the same thing over and over again and expecting different results." For me there are really only two alternatives. Negative interest on cash or competition among currencies (free banking). All those people shouting that Bitcoin should become the global reserve currency don't actually understand that a global reserve currency is a terrible idea and are only in it for the money.
  • Scoundreller 5y ago
    Doesn’t really matter if your 2FA keygen algo got completely compromised.
    • mdoms 5y ago
      Of course it matters. Even if we assume someone figured out how to own the 2FA system, that knowledge doesn't magically make its way into the brain of every script kiddy capable of credential stuffing a login form. They're two totally different vectors with different surface area.
      • Scoundreller 5y ago
        My thought is that it’s not really 2FA, and 2FA means temporary tokens, and there’s a method to gain entry with just login+token, e.g. via password reset.
        • tialaramex 5y ago
          You can just make up whatever factors. If you want to deliver security then MFA is an interesting strategy that needs careful consideration and planning, you might end up building things like Security Keys so as to solve real threats. You might fix real problems (Google eliminated phishing) at your organisation. But if your goal is to bamboozle fools into giving you their real money in exchange for Itchy and Scratchy money that you may or may not then "lose" then you don't need all that hard work. Take whatever nonsense you cobbled together and say it's "Two factor" because that means "good" to people who don't know any better.
• eswat 5y ago
  > users had to re-add 2FA And you are not asked to do this while logging in again. It is assumed you know why you have to reauthenticate and that you have to re-add 2FA in your app settings…