3 ms·

As usual, if you can't trust the client machine, no solution is secure. Not even any mobile two way authentication.

• nly 13y ago
  That's true, but there are outright trivial things a lot of sites just don't do to limit the impact of compromise. I just sold some Bitcoin for example (I know right...) and the exchange doesn't require any special credentials for initiating trades or withdrawals: just the same password and 2FA code I use to login to my account. All the good stock trading sites I've used in the past have had separate trading passwords, it just makes sense.
  • MichaelGG 13y ago
    Do you often login to your Bitcoin exchange account without performing any write actions? If the majority if the time you're not logging into a read-only session, having an extra password seems rather pointless. If an attacker has compromised the 2FA system, they've most likely compromised your device.