Two factor authentication (2FA) enabled mtgox / blockchain.info wallets safe even with weak passwords? whats the risk here, except loosing mobile phone?
other details,
- 2FA software -> Google authenticator
- google account is also 2FA enabled
Tell me more
×
Bitcoin Stack Exchange is a question and answer site for
Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.
|
|
||||
|
|
Blockchain.info does not use 2FA for encrypting the wallet and instead uses it only for limiting access via the web interface. If your system is compromised with a keylogger, and the attacker has access to the blockchain.info wallet (e.g., the backups sent via e-mail), for instance, then the attacker can perform a replay attack and spend the funds from the wallet. Also, if your system is compromised the attacker might be able to obtain the password and OTP code and use that for login by simply being first to login with those credentials. Mt. Gox implemented 2FA correctly, by requiring the OTP for each withdrawal request so that is less of an issue with them. Not all exchanges and EWallets with 2FA require that. So there still is better protection when when accessing your account only from a secure system, but those who live a little more dangerously can probably still keep their funds safe thanks to 2FA. Also, the 2FA device should always be separate from the device where the wallet is being accessed from. So accessing Blockchain for Android from a mobile in which the 2FA client is also running is not a secure configuration. |
||||
|
|
