Hacker News Reader

In case of Blockchain.info, wallet decryption happens in browser. The server sends you an encrypted wallet if you know user ID and provide 2-FA code. Without the code, anyone who knows your user ID will get the encrypted wallet and bruteforce it offline. With 2-FA they'd have to hack into your email or phone to get the code or hack into your email or computer to get your encrypted backup.

View on HN

My interpretation of offline is if someone had access to their stored data (ex: blockchain.info is hacked, database is leaked, etc). In that case then 2-FA is pointless. It's only valid when interacting with them as an online service.

Usually you send your password to a service, but in this case encrypted data is "leaked" to a person requesting it. 2-FA prevents from giving this data to strangers (and won't help if the service is hacked, yes)

Reply on news.ycombinator.com