Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase Breach Notification

oag.ca.gov

Post reply on HN
Print view View original

201–210 of 287 posts

Re: Coinbase Breach Notification

#201

Post by wpietri »

mdavis6890 wrote: post #60
space_rock wrote: post #50

Earlier quoted context omitted.

Agree. Although I would like coinbase to move away from SMS 2fa

They already support other forms of 2FA, so I guess you mean they should turn off support for SMS. Keep in mind that for many users the alternative is no 2FA at all (they don't browse HN and Krebs), which is much, much worse. Coinbase should continue doing what they are doing, which is to support SMS, and educate and encourage users where possible to use something else instead.

Wait, why should they accept customer funds if they don't think they can keep them safely? If somebody is saying, "Let me hold on to your money for you," it seems like a minimum bar is them being pretty sure it's not going to go anywhere.

Re: Coinbase Breach Notification

#202

Post by mrb »

zitterbewegung wrote: post #92
mdavis6890 wrote: post #60

Earlier quoted context omitted.

They already support other forms of 2FA, so I guess you mean they should turn off support for SMS. Keep in mind that for many users the alternative is no 2FA at all (they don't browse HN and Krebs), which is much, much worse. Coinbase should continue doing what they are doing, which is to support SMS, and educate and encourage users where possible to use something else instead.

How about allowing users to turn off sms.

Coinbase does allow SMS to be turned off. I did that on my account. When SMS is turned off, and when a U2F security key is the only 2FA you configured, if you lose the security key the only way to recover the account is to contact their support department and provide a photo of yourself holding your ID.

Re: Coinbase Breach Notification

#203

Post by rglover »

keyb0ardninja wrote: post #186
rglover wrote: post #69

Reminder: if you don't own your keys, you don't own your cheese. Hardware: https://trezor.io/ https://www.ledger.com/

I must be missing something, but can someone explain what's the point of a hardware wallet? Why not just use a password manager? Hardware wallets seem to have so many downsides, as far as I can understand. You can keep multiple copies of your password manager's database (something like a kbdx file), but you won't have multiple copies of the hardware wallet. Therefore a single point of failure. If the wallet is stolen…

> If the wallet is stolen, damaged in a house fire, crushed by some accident etc. you're done.

This is incorrect. Hardware wallets typically come with a recovery seed. Even if the original device gets destroyed, the seed helps you to get access to your addresses/crypto. This covers against all of the scenarios you mentioned.

For example, I just updated the firmware on my device this afternoon. Before I did it, I'm double-prompted to make sure I have my recovery seed in case the update fails.

As for storing in a password manager, you certainly could. I used to print my wallets out back in the day. The hardware just makes the process a bit easier and makes mistakes on my part less likely.

Re: Coinbase Breach Notification

#204

Post by tyingq »

narrator wrote: post #177
pxeboot wrote: post #151

Earlier quoted context omitted.

This isn't really true. Google Voice numbers are managed by bandwidth.com and have been taken by attackers submitting fraudulent number portability requests in the past.

Don't you have to login to your Google account to port a number?

There's ways to intercept SMS messages without sim-jacking or number porting too.

https://arstechnica.com/information-technology/2021/03/16-at...

Re: Coinbase Breach Notification

#205

Post by edoceo »

wpietri wrote: post #196
Consultant32452 wrote: post #163

Earlier quoted context omitted.

Okta architect here. It's hard enough getting MFA to work in a large organization where technically illiterate people are surrounded by coworkers to ask who have all figured out their RSA tokens or Okta Verify enrollment. Trying to manage this for the general public would be an incredible undertaking. The cost benefit analysis probably does not make sense for a gazillion low balance users. It may make sense to enforc…

So to sum up, an organization promising to take people's money and keep it safe can't afford to do it except for people with a great deal of money. However, they're still going to accept smaller amounts of money. Did I get that right?

Unfortunately, yes.

Re: Coinbase Breach Notification

#206

Post by ensignavenger »

Consultant32452 wrote: post #163
ensignavenger wrote: post #147

Earlier quoted context omitted.

Coinbase and other sites (especially those that deal in money) should stop using SIM cards as a form of authentication. While carriers should probably do more to secure SIMs and phone #s, it has always been known that the system was never designed to be used as a security mechanism, and Coinbase using it as such is a security flaw that they are responsible for.

Okta architect here. It's hard enough getting MFA to work in a large organization where technically illiterate people are surrounded by coworkers to ask who have all figured out their RSA tokens or Okta Verify enrollment. Trying to manage this for the general public would be an incredible undertaking. The cost benefit analysis probably does not make sense for a gazillion low balance users. It may make sense to enforc…

Then we need to do a better job making the UX easier. I'm sure Okta is working on that?

Re: Coinbase Breach Notification

#208

Post by abecedarius »

wpietri wrote: post #196
Consultant32452 wrote: post #163

Earlier quoted context omitted.

Okta architect here. It's hard enough getting MFA to work in a large organization where technically illiterate people are surrounded by coworkers to ask who have all figured out their RSA tokens or Okta Verify enrollment. Trying to manage this for the general public would be an incredible undertaking. The cost benefit analysis probably does not make sense for a gazillion low balance users. It may make sense to enforc…

So to sum up, an organization promising to take people's money and keep it safe can't afford to do it except for people with a great deal of money. However, they're still going to accept smaller amounts of money. Did I get that right?

When I went looking for an online brokerage in the USA with a reasonable login process (i.e. 2FA, not by SMS ever) it seemed pretty hard to find one. (Maybe that's changed?) These brokerages handle amounts much greater than a software engineer's retirement savings.

Re: Coinbase Breach Notification

#209

Post by rStar »

miohtama wrote: post #191
tdeck wrote: post #182

Earlier quoted context omitted.

SIM swapping also allows you to intercept voice calls, which are encrypted and supposed to be secure. The idea that telcos have no responsibility to stop people from taking over the telephone number that customers pay for is completely absurd. Moreover, often the SIM swapping is done by employees of the Telco itself using company infrastructure.

No you are not correct. The whole underlying mobile phone network infrastructure is based on (failed) trust and is not secure. Though it is slowly being replaced. https://www.theguardian.com/technology/2016/apr/19/ss7-hack-... https://www.firstpoint-mg.com/blog/ss7-attack-guide/

replaced by a system which is similarly secure against all classes of attackers that anyone gives a crap about.
Post reply on HN