4 ms·

Which is why they recommend a security key or a TOTP auth instead of SMS. https://help.coinbase.com/en/coinbase/getting-started/verify-my-account/how-do-i-set-

by m00x 4y ago

Which is why they recommend a security key or a TOTP auth instead of SMS. https://help.coinbase.com/en/coinbase/getting-started/verify-my-account/how-do-i-set-up-2-factor-authentication https://help.coinbase.com/en/coinbase/getting-started/verify...

supermatt 4y ago
And yet they still support SMS. Coinbase CHOOSE to use that security mechanism because it is quick and easy for them to onboard new business. They could, quite easily, restrict access to other mechanisms. Instead Coinbase have decided that it is a sufficiently secure form of identification by which they will assume authorization for payment initiation. If this users SMS was hacked, then the user didnt authorise payment, and coinbase incorrectly assumed that it was based on their own lax security requirements. If this was regulated in the same way as a Bank, an EMI or a PISP then Coinbase would definitely be at fault here. I hope the legal system sees it in the same way and this guys assets are returned.
- jkepler 4y ago
  My bank still forces me to rely on 2FA via SMS. I would live to find a US bank that would let me use a OTP 2FA app. Any suggestions?
  - filoleg 4y ago
    Same question, with a caveat that I would prefer a larger bank specifically. The only 2 large banking institutions I have been working with (Chase and Wells Fargo) do not support OTP 2FA afaik (last time I checked was about a year ago). I think WF might support dedicated hardware 2FA tokens, but you gotta order it from them, and I would rather prefer to use only one device (my phone + printed our backup recovery keys in physical storage + Google/Microsoft Authenticator backup in the cloud). Otherwise, it is all just good old SMS 2FA, and I am not ok with it.
adrr 4y ago
Chase, largest bank in the US, doesn't support TOTP yet there ar no articles how someone lost almost $100k by a sim card attack. Coinbase inability to detect and mitigate a sim card attack is on them and their lack of security.

by m00x 4y ago

supermatt 4y ago

And yet they still support SMS. Coinbase CHOOSE to use that security mechanism because it is quick and easy for them to onboard new business. They could, quite easily, restrict access to other mechanisms. Instead Coinbase have decided that it is a sufficiently secure form of identification by which they will assume authorization for payment initiation. If this users SMS was hacked, then the user didnt authorise payment, and coinbase incorrectly assumed that it was based on their own lax security requirements. If this was regulated in the same way as a Bank, an EMI or a PISP then Coinbase would definitely be at fault here. I hope the legal system sees it in the same way and this guys assets are returned.

jkepler 4y ago
My bank still forces me to rely on 2FA via SMS. I would live to find a US bank that would let me use a OTP 2FA app. Any suggestions?
- filoleg 4y ago
  Same question, with a caveat that I would prefer a larger bank specifically. The only 2 large banking institutions I have been working with (Chase and Wells Fargo) do not support OTP 2FA afaik (last time I checked was about a year ago). I think WF might support dedicated hardware 2FA tokens, but you gotta order it from them, and I would rather prefer to use only one device (my phone + printed our backup recovery keys in physical storage + Google/Microsoft Authenticator backup in the cloud). Otherwise, it is all just good old SMS 2FA, and I am not ok with it.

adrr 4y ago

Chase, largest bank in the US, doesn't support TOTP yet there ar no articles how someone lost almost $100k by a sim card attack. Coinbase inability to detect and mitigate a sim card attack is on them and their lack of security.