Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase Breach Notification

oag.ca.gov

Post reply on HN
Print view View original

241–250 of 287 posts

Re: Coinbase Breach Notification

#241

Post by DennisP »

ed25519FUUU wrote: post #187
Ansil849 wrote: post #173

What I'm getting from this is that Coinbase was/is using SMS-based 2FA? Using anything short of mandatory U2F means the responsibility of this breach firmly falls on Coinbase's shoulders. It's like if you found out your bank uses single-bolt doors for its vault.

The fact that there’s no OTP option even available is what bothers me. Let the power users use OTP if they want it. When OTP is available I always remove my phone and use that. Sim swap is such a common attack these days.

Coinbase supports Google Authenticator, and also hardware keys like Yubikey.

https://help.coinbase.com/en/coinbase/getting-started/verify...

Re: Coinbase Breach Notification

#242

Post by knownjorbist »

pgwhalen wrote: post #236
knownjorbist wrote: post #228

Earlier quoted context omitted.

To ask a different question of traditional banks - where can you do what you can do in DeFi today in traditional finance - without either being an investment bank or a HNW individual?

I think you garbled some words, can you rephrase the question?

Does that help? You cannot walk into a bank and ask to put your money to work in the same way that they are already putting your money to work just by holding it in an account with them. At least, not for average people.

Re: Coinbase Breach Notification

#243

Post by DennisP »

thinkharderdev wrote: post #170
tfang17 wrote: post #89

Another reminder that text-based 2FA is not secure.

Secure/not-secure is not a binary distinction. And SMS-based 2fa is still more secure than password alone. One thing I've become painfully aware of recently is how all MFA is rendered pretty insecure by various "fallback" processes. I recently switch jobs and realized I had a few accounts using my old work phone as SMS 2fa number. In every case it was ridiculously easy to call a CSR and get 2fa disabled from their en…

Fallback processes are the way SMS can make things worse. Report a lost password, verify yourself with your SIM-swapped SMS, maybe apply a little social engineering. I'd rather have just a strong unique password than use SMS. (And of course I'd much rather have good 2FA.)

Re: Coinbase Breach Notification

#244

Post by pgwhalen »

knownjorbist wrote: post #242
pgwhalen wrote: post #236

Earlier quoted context omitted.

I think you garbled some words, can you rephrase the question?

Does that help? You cannot walk into a bank and ask to put your money to work in the same way that they are already putting your money to work just by holding it in an account with them. At least, not for average people.

You can't act as an "automated market maker" in traditional finance, I'll give you that (to pick one example of something possible in DeFi).

What I really mean is what can do you in DeFi that is connected with the real world? In other words, what can you do other that doesn't fall into the category of using your money to make more money with no effect on the material world?

Examples of things that traditional finance enables that connect to the real world:

- Get a student loan (you get an education)

- Get a car loan (you get a car)

- Get a home loan (you get a house)

- Insure your car or home (perhaps including insurance in finance is a bit broad, but I think it's appropriate)

- Have some claim on the future cash flows of a company that makes real things (public equities)

Obviously traditional finance isn't some bastion of providing "real world" value and resistance to over-financialization. But DeFi seems like pure financialization so far. I suppose the first step is to enable payments (arguably the definition of money is a payment system), but it doesn't seem like that has caught on very much either.

Re: Coinbase Breach Notification

#245

Post by nybble41 »

SV_BubbleTime wrote: post #237
nybble41 wrote: post #95

Earlier quoted context omitted.

There are hybrid systems which offer the best of both worlds. For example, the open source Muun wallet uses a 2-of-2 key system[0] in which Muun only has access to one of the two keys so, unlike a traditional bank or a custodial exchange like Coinbase, they can't spend any funds without your signature. Your Muun wallet app also only has one key, so authentication with the Muun service is necessary to complete transac…

Let me ask you something quick and think about it for a second. Could a scam system be made that seemed to work, be advertised, and otherwise identical up until the point of failure as muun?

That's a reasonable concern. You can easily verify for yourself that the recovery process works, and you can audit the source code for the Android client (and build it from the audited code) to ensure that it handles the keys as advertised. If this were your typical proprietary system then I might be worried, but Muun is pretty transparent.

The biggest potential point of failure, if you installed pre-built binaries from a third party such as Google Play or the Apple App Store, is that it could be updated to a new version which leaks the wallet-side private key. Which is a potential concern with any wallet software you don't audit for yourself. Of course you're also trusting the system software provider (i.e. Google or Apple) to run the application properly, as with any software running on their respective operating systems.

Personally I trust it with funds comparable to what I would normally keep in a wallet for daily use, not a safe or a bank vault. For larger amounts where the inconvenience of cold storage is justified I use a hardware wallet (Trezor).

Re: Coinbase Breach Notification

#246

Post by YeBanKo »

sneak wrote: post #137
YeBanKo wrote: post #114

One thing that cryptocurrencies achieved is they introduced a private key authentication at scale. For a moment, there was a hope that we can move to private key authentication mechanism. But, unfortunately, it was quickly rolled back by introduction of custodial wallets and we got pulled back into world of passwords.

sneak’s law: users can not (and a tiny subset of users that actually know how to, will not) securely manage* key material. *manage: generate, transmit/sync, authenticate, back up Discussion: https://youtu.be/9k4GP3Evh9c I actually operate a business that exists solely as a result of this fact. If you give a user a key, they will lose it. If they’re a customer, you need to have a back up plan for what happens when the…

> users can not (and a tiny subset of users that actually know how to, will not) securely manage* key material.

True. And the is also true for password. Sure, generation is different and a way to authorizing a transaction is different, but otherwise form usage perspective password can be viewed as a primitive case of a private key. And industry made a huge progress in password authentications: password managers, OTP, biometric authentications, WebAuthn, etc. Specifically password managers and biometric authentication mechanisms can be re-used for private keys as well.

Having multiple wallets, multisig authentication and smart contracts allows to have recovery paths, while making sure that varios custodians can only perform certain transactions and in a transparent way.

Re: Coinbase Breach Notification

#247

Post by nroets »

tdeck wrote: post #182
miohtama wrote: post #169

Earlier quoted context omitted.

Telcos have no responsibility to stop SIM fraud. Telcos have communicated the last 30 years SMS is not secure (travels as plain text) and should not be used for 2FA. If companies have ignored this advise then it is on them.

SIM swapping also allows you to intercept voice calls, which are encrypted and supposed to be secure. The idea that telcos have no responsibility to stop people from taking over the telephone number that customers pay for is completely absurd. Moreover, often the SIM swapping is done by employees of the Telco itself using company infrastructure.

The incumbent telcos would love a regulatory framework where they must store address info and other personal data of their clients: Clients would then be much less likely to switch.

International tourists will also be less likely to get a local SIM card and then pay exorbitant roaming charges.

(Here in South Africa, clients must provide proof of their residential address. Some telcos even insist on verifying the thumbprints of their clients)

Re: Coinbase Breach Notification

#248

Post by zalebz »

Kaytaro wrote: post #162
sneak wrote: post #136

Earlier quoted context omitted.

> you have to admit that you are far more likely to be compensated in the event of an attack if you are using a large exchange This is only a recent phenomenon, and I don’t think it holds for all “large exchange[s]”.

Yeah, Mt. Gox used to be considered a large exchange, the largest at the time in fact.

I just recently found out about a great cybersecurity podcast called Darknet Diaries (and having been binging it ever since). Episode 9 covers Mt Gox and it goes into detail of timeline of the developers and the numerous breaches. Highly recommended.

All that is to say that Coinbase and Mt Gox were operating in completely different leagues of sophistication.

Re: Coinbase Breach Notification

#249

Post by bb88 »

BitwiseFool wrote: post #18

> "We will be depositing funds into your account equal to the value of the currency improperly removed from your account at the time of the incident. Some customers have already been reimbursed -- we will ensure all customers affected receive the full value of what you lost. You should see this reflected in your account no later than today." I sympathize with the "Not your keys, not your coins" crowd, but you have to…

There's still no FDIC insurance -- and never will be.

If people make a run on the BTC Bank, and your value drops by 40%, CoinBase isn't going to refund you the losses.

Re: Coinbase Breach Notification

#250

Post by nemo1618 »

keyb0ardninja wrote: post #186
rglover wrote: post #69

Reminder: if you don't own your keys, you don't own your cheese. Hardware: https://trezor.io/ https://www.ledger.com/

I must be missing something, but can someone explain what's the point of a hardware wallet? Why not just use a password manager? Hardware wallets seem to have so many downsides, as far as I can understand. You can keep multiple copies of your password manager's database (something like a kbdx file), but you won't have multiple copies of the hardware wallet. Therefore a single point of failure. If the wallet is stolen…

The point is that your keys never reside on a general-purpose, internet-connected computer. It greatly reduces the attack surface.

As for SPoF -- hardware wallets are initialized with a seed phrase. You can make as many copies of the seed phrase as you like. You don't even need to load them onto a new device if yours is lost or stolen; the phrase alone is sufficient to re-derive the keys on any computer (although you will sacrifice some security if you decide to recover that way).

Post reply on HN