pull down to refresh

319 sats \ 3 replies \ @kepford 24 Dec \ on: How to Lose a Fortune with Just One Bad Click security
Do NOT use Google Authenticator! So many mistakes in this story but that one sticks out to me as one many may not be aware of.
attackers had used his Gmail account to gain access to his Coinbase account from a VPN connection in California, providing the multi-factor code from his Google Authenticator app. Unbeknownst to him at the time, Google Authenticator by default also makes the same codes available in one’s Google account online.
write
preview
57 sats \ 2 replies \ @k00b OP 24 Dec
As many people have said, IF you are going to use google authenticator, make sure it doesn't sync to the cloud.
reply
32 sats \ 0 replies \ @kepford 24 Dec
Yeah, for sure. But if there's a bug you are screwed. I like using an open source non-cloud solution.
These stories suck but it seems like the only way humans learn is through pain.
reply
11 sats \ 0 replies \ @itsrealfake 8h
the thing about Google is that it's always doing updates and opting in automatically
avoiding Google is a great policy
reply