In addition to login, 2FA is typically required for irreversible and other sensitive operations like transfers, for exactly this reason (local malware, XSS, etc

In addition to login, 2FA is typically required for irreversible and other sensitive operations like transfers, for exactly this reason (local malware, XSS, etc, can steal cookies) This should be pretty much required for all services where users may have significant amounts of money at stake. And users need to be educated to actually enable it. Coinbase finally enabled 2FA for transfers (of more than $100/day) this week: http://blog.coinbase.com/post/73364231652/security-updates-on-coinbase http://blog.coinbase.com/post/73364231652/security-updates-o...