Hacker News Reader

Comment by presty | Hacker News Reader

yes, they literally logged everyone out, removed 2FA, and on the new login, users had to re-add 2FA

Wouldn't this also allow an attacker to add his own 2FA?

Doesn’t really matter if your 2FA keygen algo got completely compromised.

Of course it matters. Even if we assume someone figured out how to own the 2FA system, that knowledge doesn't magically make its way into the brain of every script kiddy capable of credential stuffing a login form. They're two totally different vectors with different surface area.

My thought is that it’s not really 2FA, and 2FA means temporary tokens, and there’s a method to gain entry with just login+token, e.g. via password reset.

You can just make up whatever factors.

If you want to deliver security then MFA is an interesting strategy that needs careful consideration and planning, you might end up building things like Security Keys so as to solve real threats. You might fix real problems (Google eliminated phishing) at your organisation.

But if your goal is to bamboozle fools into giving you their real money in exchange for Itchy and Scratchy money that you may or may not then "lose" then you don't need all that hard work. Take whatever nonsense you cobbled together and say it's "Two factor" because that means "good" to people who don't know any better.

This is hilarious. This company is literally at the apex of the crypto industry and this is the kind of mistake they make. Yeah, immutable smart contracts written by their fellow proponents will also save the world lol

Calling crypto.com anything near "apex of the cryptocurrency industry" is a very broad lie. Crypto.com is for people who just "wanna invest in crypto and get rich", others who are actually involved in the space (developers, companies and others) are nowhere near crypto.com as they have proven time and time again they are not serious about anything, even the basics like security.

I would argue that by you giving the torch to crypto.com as the company that caters to casual users that "just wanna invest and get rich", it is indeed one of the apexes of the industry. A product successfully marketing a fringe and specialized technology to the average consumer is just that.

Is it? I'm not sure of numbers of total accounts but anyone who knows anything about crypto is suspicious of crypto.com as a platform and I don't know anyone who uses it when things like coinbase are available. They just bought an expensive URL and spammed a bunch of ads. If that makes them the apex of the industry I guess CALL THE GENERAL AND SAVE SOME TIME is the apex of the car insurance industry.

The two car insurance companies I see the most adverts from are State Farm and Geico - and yes, it looks like those two are the apex of their industry: https://www.valuepenguin.com/largest-auto-insurance-companie...

This is a common play in several industries. Art of Shaving markets itself well to casual people interested in traditional shaving products but they take regular products, mark them up by a lot, rebrand and then upsell. Nobody claims Art of Shaving is the apex of shaving. Best Buy does similar marketing in regard to electronics, but Best Buy certainly isn't the apex of electronics retailers. What makes you think cryptocurrency companies would be any different?

I would say Best Buy is an apex electronics retailer. Why wouldn't you?

Yes, but not the apex of the "electronics industry".

But that's not the industry he said.

Aren't they one of the largest exchanges?

EDIT: They're #3 (bigger than Coinbase). Only OKX and Binance are bigger[1].

1. https://www.coingecko.com/en/exchanges

No!

Coinbase is a large exchange...

I checked.

Crypto.com is the #3 exchange and bigger than Coinbase[1].

1. https://www.coingecko.com/en/exchanges

I don’t think that’s true..bigger than Binance? By what metric?

Coinbase doesn't have to be bigger than Binance to be "a large exchange" - we're not talking about "largest exchange" if you read the message.

It's definitely more established than crypto.com though.

Do you think crypto.com is larger than Binance?

Sorry completely misread, I thought you were saying it's the biggest

I have an ex colleague working there as lead dev: knowing him, no, they re not at the apex lol

> This company is literally at the apex of the crypto industry

Cryptocurrency was not even supposed to have these pseudobanks called exchanges leading this space. It wasn't even supposed to be an "industry".

People were supposed to mine cryptocurrency on their own commodity hardware and use that to transact amongst themselves.

Almost like its core mission statement was only led by the voluntary virtuosity of its participants - and wasn't as novel as previously thought. Huh.

It's basically a digital gold standard and the gold standard hasn't lead to an enlightened society either.

"Insanity is doing the same thing over and over again and expecting different results."

For me there are really only two alternatives. Negative interest on cash or competition among currencies (free banking). All those people shouting that Bitcoin should become the global reserve currency don't actually understand that a global reserve currency is a terrible idea and are only in it for the money.

Isn't this equivalent to saying the entire health industry is fake and untrustworthy because of Theranos? I don't it looks kind of same to me, and sounds absurd.

I'd say Coinbase is the company at the apex of the US cryptocurrency industry.

crypto.com is a two bit player in comparison.

Crypto bros versus banks that have been doing this for a 100 years.

> users had to re-add 2FA

And you are not asked to do this while logging in again. It is assumed you know why you have to reauthenticate and that you have to re-add 2FA in your app settings…

Reply on news.ycombinator.com