3 ms·

crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it. But basically in this case, you didn't even need a

by kerng 5y ago

crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it. But basically in this case, you didn't even need a password to log back in, it was just an email to click a link, then FaceId/PIN and logged in and prompt to re-add 2fa. The app must store the password itself somehow and auto use it. Anyone know how the do auth on the app? For users in the US there is no way to change the password, because the webapp (which might have that feature) is not allowed to be used from US. Once I asked how to change password and support said I can change the PIN on phone and dont worry your funds are safe.

Shank 5y ago
> crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it. If you're speaking from experience as a user of their service, I strongly suggest that you use a different exchange. Gemini + Coinbase both have very easy-to-understand authentication systems. If you don't understand the authentication system, that's a good red-flag that you should take as a reason to move to a more trustable platform. (Just my two cents, as someone who works on authentication system architecture design.)
- tornato7 5y ago
  Agreed. As someone who has integrated with dozens of crypto bank APIs, I can tell you Gemini's authentication and security is top notch (second only to Fireblocks)
  - deleted 5y ago
    [deleted]
- kerng 5y ago
  Good point. Overall the user experience of crypto.com is really nice though. I mean the app is tons better then Coinbase and I think a big reason that crypto.com is growing tremendously. Users like it.
godot 5y ago
From my experience as a user, you don't have a password. They log you in via an email link, you have a PIN, and you have 2FA.
josephd79 5y ago
Do they use something like this? I've never used crypto.com https://magic.link/ https://magic.link/
giantrobot 5y ago
> it was just an email to click a link, An e-mail with a link to actually click? Does anyone else see those flashing red lights and hear that alarm klaxon? Please do me a favor and drop those assholes like a bad habit. They are going to cost you whatever assets of yours they have in their control.
- paulryanrogers 5y ago
  The fight to teach users to not click links in emails had been lost, IME. And if forgot passwords can be resolved via an emailed one-time secret then email is effectively a skeleton key anyway.

by kerng 5y ago

Shank 5y ago

> crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it. If you're speaking from experience as a user of their service, I strongly suggest that you use a different exchange. Gemini + Coinbase both have very easy-to-understand authentication systems. If you don't understand the authentication system, that's a good red-flag that you should take as a reason to move to a more trustable platform. (Just my two cents, as someone who works on authentication system architecture design.)

tornato7 5y ago
Agreed. As someone who has integrated with dozens of crypto bank APIs, I can tell you Gemini's authentication and security is top notch (second only to Fireblocks)
- deleted 5y ago
  [deleted]
kerng 5y ago
Good point. Overall the user experience of crypto.com is really nice though. I mean the app is tons better then Coinbase and I think a big reason that crypto.com is growing tremendously. Users like it.

godot 5y ago

From my experience as a user, you don't have a password. They log you in via an email link, you have a PIN, and you have 2FA.

josephd79 5y ago

Do they use something like this? I've never used crypto.com https://magic.link/ https://magic.link/

giantrobot 5y ago

> it was just an email to click a link, An e-mail with a link to actually click? Does anyone else see those flashing red lights and hear that alarm klaxon? Please do me a favor and drop those assholes like a bad habit. They are going to cost you whatever assets of yours they have in their control.

paulryanrogers 5y ago
The fight to teach users to not click links in emails had been lost, IME. And if forgot passwords can be resolved via an emailed one-time secret then email is effectively a skeleton key anyway.