suchmoon
Legendary
Offline
Activity: 3780
Merit: 9009
https://bpip.org
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 04:06:55 PM |
|
a code that is only available on a phone that no one knows the number. It is not 2fa. and gives a six digit number every 60 seconds .
Sounds like TOTP, which is not linked to your phone number, it's just an app that generates the code, doesn't send anything over the network, the server generates the same code to verify against. If the server is not compromised, this is reasonably safe, much safer than SMS code anyway.
|
|
|
|
Torque
Legendary
Offline
Activity: 3668
Merit: 5233
|
I am not quite sure how they ported the phone.
I suspect they used tracfone had the cell number hoped by getting the email
that the email linked to tracfone and to coinbase was the same
so if they hack just the email
they could try to port the cell to their carrier.
then get into coinbase change password and use 2fa to allow withdraws and alter the email
... Best to buy a burner phone set up google to microsoft auth.
the coinbase account does not know that phone number so no one can port it over to another network.
Sorry that it happened, but I cannot figure it out from your description. coinbase did have some SMS troubles last May or so, maybe it is somehow related. The ported phone would jeopardize both methods (text or Authenticator), wouldn't it? what's the "email linked to tracfone"? why there is such a thing? Phone a the ported phone was a tracfone. I do have an email/phone account so they could have ported the phone from trac phone to Verizon mobile by entering my cell number They could have hacked the email using recovery to the phone. This gave them the phone and the email. they use that to go after the coinbase they change the password. they find that no changes in the account or withdrawals can be done without a code that is only available on a phone that no one knows the number. It is not 2fa. and gives a six digit number every 60 seconds . They could have been say with draw .25 btc and putting in random six digit numbers as I was driving home ( I think they get locked out after 3 wrong numbers). so I could have lost .25 btc if they got lucky. I think my error was the email recovery was linked to the cell which let them get into the email. That email is 22 years old I changed the password. I am playing with fake hacking of the now drained (by me) coinbase account to see if they just needed the have the phone number ported to be able to change the coinbase password. I also had the account set to need the auth app for any withdrawal (thank goodness) found this on coinbase signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago password reset completed web 198.54.133.76 United States about 20 hours ago password reset requested web 198.54.133.76 United States about 20 hours ago signin failure api 187.11.158.232 Brazil 3 days ago signin failure api 187.11.158.232 Brazil 3 days ago all of the above is bad shit this looks like first shot they took signin failure api 2605:xxxx:xxxx:xxxx:xxxx:xxx:xxxx:c91f United States 7 days ago each signout session was likely 3 trys at moving the btc. random codes are 1,000,000 numbers so they had say 18 of 1,000,000 of grabbing the btc I am genuinely sorry to hear about this philipma. I'm also glad and relieved to hear that no coins were stolen. What am I about to say next, I hope you don't take as rubbing it in or anything. You have to decide what works best for you. But I can honestly say that if you had had your coins on a hardware wallet like a Trezor, none of that would have happened (provided you set it up correctly, have your security protocols right, and don't fall for the phishing scam of going to a fake Trezor website, etc.). I'm seriously baffled after all the talk and confirmation over the years about how great and solid hardware wallets are, that people still refuse to investigate and use them. In fact, if someone has a legit link of someone getting their coins stolen from a Trezor that wasn't a phishing scam, please link to it. I'd be curious to read it. So far I have come across zero.
|
|
|
|
cAPSLOCK
Legendary
Offline
Activity: 3766
Merit: 5146
Whimsical Pants
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 04:14:26 PM |
|
a code that is only available on a phone that no one knows the number. It is not 2fa. and gives a six digit number every 60 seconds .
Sounds like TOTP, which is not linked to your phone number, it's just an app that generates the code, doesn't send anything over the network, the server generates the same code to verify against. If the server is not compromised, this is reasonably safe, much safer than SMS code anyway. This is a pretty good TOTP solution. Been around for a long time... Not owned by a FAANG company. Works well... multi device. https://authy.com
|
|
|
|
suchmoon
Legendary
Offline
Activity: 3780
Merit: 9009
https://bpip.org
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 04:22:44 PM |
|
This is a pretty good TOTP solution. Been around for a long time... Not owned by a FAANG company. Works well... multi device. https://authy.comTBH I'm not a big fan of them pushing online backups and multi-device options and even desktop versions. The only backup should be a hard copy, it should be treated like a wallet seed. Losing your 2FA when you lose your (presumably locked/encrypted) phone is a feature, not something that needs to be fixed by making multiple copies of it and increasing the attack surface exponentially. But then again, people screw up all the time, so not sure what's worse - increased risk due to multiple copies or the risk of people being idiots and not backing it up on paper.
|
|
|
|
cAPSLOCK
Legendary
Offline
Activity: 3766
Merit: 5146
Whimsical Pants
|
I am genuinely sorry to hear about this philipma. I'm also glad and relieved to hear that no coins were stolen.
What am I about to say next, I hope you don't take as rubbing it in or anything. You have to decide what works best for you. But I can honestly say that if you had had your coins on a hardware wallet like a Trezor, none of that would have happened (provided you set it up correctly, have your security protocols right, and don't fall for the phishing scam of going to a fake Trezor website, etc.).
I'm seriously baffled after all the talk over the years about how great and solid hardware wallets are, that people still refuse to investigate and use them.
In fact, if someone has a legit link to someone getting their coins stolen from a Trezor that wasn't a phishing scam, please link to it. I'd be curious to read it.
The importance of hardware wallets (really digital keyring/signing device, but alas, 'wallet' sells better) is hard to overstate. This is INSTANTLY what I tell folks who are new to Bitcoin. Get yourself a hardware wallet... and the Trezor really is a great suggestion. If the person holds a significant amount of Bitcoin, I then encourage them to get 2 more devices, and when they become comfortable set up a 2 of 3 wallet. The most important advantage in them is hard to see at first: Secure XPRV (seed, XPUB etc) generation. Hardware wallets are the ONLY foolproof way to make a bitcoin seed. So far there is no other way that is safe, that also is not prohibitively difficult/risky. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FH9dohIM.png&t=665&c=UoYznGTSJtOWVw)
|
|
|
|
cAPSLOCK
Legendary
Offline
Activity: 3766
Merit: 5146
Whimsical Pants
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 04:26:48 PM |
|
This is a pretty good TOTP solution. Been around for a long time... Not owned by a FAANG company. Works well... multi device. https://authy.comTBH I'm not a big fan of them pushing online backups and multi-device options and even desktop versions. The only backup should be a hard copy, it should be treated like a wallet seed. Losing your 2FA when you lose your (presumably locked/encrypted) phone is a feature, not something that needs to be fixed by making multiple copies of it and increasing the attack surface exponentially. But then again, people screw up all the time, so not sure what's worse - increased risk due to multiple copies or the risk of people being idiots and not backing it up on paper. TOTALLY. Both the first line, and the second. It's the age old "Can I store my private key on the cloud if it is encrypted?" argument. And the correct answer is NO. ![Wink](https://bitcointalk.org/Smileys/default/wink.gif) But like everything it's all tradeoffs. What tradeoffs are we willing to make? One other thing... you can DISABLE the online backup, though the presence of the connection is still there, I guess...
|
|
|
|
cAPSLOCK
Legendary
Offline
Activity: 3766
Merit: 5146
Whimsical Pants
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 04:28:56 PM |
|
It's a very informed and competent piece, written by a history professor. All historians notoriously have a deep understanding of cryptography, game theory and networks. The article even quotes well known bitcoin experts, such as prof. Stolfi. /s I could upload a copy somewhere without a paywall, and will do so if requested by someone I like ![Tongue](https://bitcointalk.org/Smileys/default/tongue.gif) My advice though: Spare your time - it's utter BS. https://archive.md/IhQl9Good for a laugh. It could easily be an article about anything, if you completely ignore what the thing is and just say that it has no value. Pepperoni pizza is worse than a ponzi - you eat it and it's gone and you can't get the money back. Good grief. They cite Jorge.
|
|
|
|
Gachapin
Legendary
Offline
Activity: 1036
Merit: 2052
bitcoin retard
|
I didn't know he said that. Thanks for sharing @tertius993! That changes my view on his stance. For me it means he has invalidated his model already. (I rarely accept new goal posts.) Having some influence, he should def. be more careful with his statements. His model is quite forgiving though. If I understand it correctly, the 2022-2023 horizontal 100k line is just the average between the Halvings. In that case we'd have to wait a bit longer, before we can state that the 100k average was not met, during this cycle. Now he's saying that as long as the price trudges along the "lower bound" aka $40-50K, it's still valid. But look at his chart, it could literally still do that and go sideways until mid-2024.
Right.. 40k-50k until mid-2024 would def. invalidate S2F, as the average of 100k would not be met. An EOY parabolic run was expected by the majority, so the market was inclined to go another direction.
Isn't this the trap that the n00bs fall into literally every bull run tho? Haha that's true. However some expectations are still met every cycle, even for noobs. For example that after each halving we get a new ATH within the new cycle. Would be a real shocker if that changes next cycle. ![Cheesy](https://bitcointalk.org/Smileys/default/cheesy.gif) And it wouldn't even mean that we stopped "going up forever Laura" It's interesting to watch, how in every cycle there are price prophets popping out by striking a few accurate predictions and then become the go-to-guy for fortune telling. Out of them PlanB offers some rather realistic and comprehensible models (S2F, S2FX) though. I like that. But I prefer to differentiate between his persona and his models.
|
|
|
|
philipma1957
Legendary
Offline
Activity: 4242
Merit: 8460
'The right to privacy matters'
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 04:42:00 PM Merited by JayJuanGee (1) |
|
I am not quite sure how they ported the phone.
I suspect they used tracfone had the cell number hoped by getting the email
that the email linked to tracfone and to coinbase was the same
so if they hack just the email
they could try to port the cell to their carrier.
then get into coinbase change password and use 2fa to allow withdraws and alter the email
... Best to buy a burner phone set up google to microsoft auth.
the coinbase account does not know that phone number so no one can port it over to another network.
Sorry that it happened, but I cannot figure it out from your description. coinbase did have some SMS troubles last May or so, maybe it is somehow related. The ported phone would jeopardize both methods (text or Authenticator), wouldn't it? what's the "email linked to tracfone"? why there is such a thing? Phone a the ported phone was a tracfone. I do have an email/phone account so they could have ported the phone from trac phone to Verizon mobile by entering my cell number They could have hacked the email using recovery to the phone. This gave them the phone and the email. they use that to go after the coinbase they change the password. they find that no changes in the account or withdrawals can be done without a code that is only available on a phone that no one knows the number. It is not 2fa. and gives a six digit number every 60 seconds . They could have been say with draw .25 btc and putting in random six digit numbers as I was driving home ( I think they get locked out after 3 wrong numbers). so I could have lost .25 btc if they got lucky. I think my error was the email recovery was linked to the cell which let them get into the email. That email is 22 years old I changed the password. I am playing with fake hacking of the now drained (by me) coinbase account to see if they just needed the have the phone number ported to be able to change the coinbase password. I also had the account set to need the auth app for any withdrawal (thank goodness) found this on coinbase signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago signout session web 198.54.133.76 United States about 20 hours ago password reset completed web 198.54.133.76 United States about 20 hours ago password reset requested web 198.54.133.76 United States about 20 hours ago signin failure api 187.11.158.232 Brazil 3 days ago signin failure api 187.11.158.232 Brazil 3 days ago all of the above is bad shit this looks like first shot they took signin failure api 2605:xxxx:xxxx:xxxx:xxxx:xxx:xxxx:c91f United States 7 days ago each signout session was likely 3 trys at moving the btc. random codes are 1,000,000 numbers so they had say 18 of 1,000,000 of grabbing the btc I am genuinely sorry to hear about this philipma. I'm also glad and relieved to hear that no coins were stolen. What am I about to say next, I hope you don't take as rubbing it in or anything. You have to decide what works best for you. But I can honestly say that if you had had your coins on a hardware wallet like a Trezor, none of that would have happened (provided you set it up correctly, have your security protocols right, and don't fall for the phishing scam of going to a fake Trezor website, etc.). I'm seriously baffled after all the talk and confirmation over the years about how great and solid hardware wallets are, that people still refuse to investigate and use them. In fact, if someone has a legit link of someone getting their coins stolen from a Trezor that wasn't a phishing scam, please link to it. I'd be curious to read it. So far I have come across zero. most of my coins are in hardware wallets. I just happened to have the large sum on coinbase prepping to spend on mine expansion. Since there are four of us and we are buying a large amount of gear I had four shares of coins prepped to convert to fiat to buy the order. tracfone confirmed the phone was ported to verizon. it was a locked tracfone which should not have ported over yet it did. I did notice three attempted logins to my email over the last few months. I am glad I required all coin withdrawals to use the auth. app . and that it was on a different unknown to anyone phone number. as jjg said other moves are doable on an account secured the way I did but my coinbase does not have coinbase pro. I fucking hate all 2fa bs as it weakens my security. I intentionally only use a pc. zero phone access to pay anything. I am strictly old school. but these fuckers force shit on you. synched accounts etc. If i was setup that way I could have lost a lot.
|
|
|
|
Torque
Legendary
Offline
Activity: 3668
Merit: 5233
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 04:46:14 PM |
|
most of my coins are in hardware wallets.
I just happened to have the large sum on coinbase prepping to spend on mine expansion.
Oh, sorry for the bad assumption. Glad to hear that you use hardware wallets. Personally if I'm going to liquidate a large amount of btc, it gets moved to an exchange and sold within minutes of hitting it. I just can't trust leaving any amount there for any longer than what is required to do the sale transaction. Also as others have said, SMS 2FA is terrible and is vulnerable to getting compromised. Digital 2FA auth app on a dedicated, isolated device (turn on/off wi-fi only to sync 2FA) is the only way to go.
|
|
|
|
philipma1957
Legendary
Offline
Activity: 4242
Merit: 8460
'The right to privacy matters'
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 04:54:30 PM |
|
most of my coins are in hardware wallets.
I just happened to have the large sum on coinbase prepping to spend on mine expansion.
Oh, sorry for the bad assumption. Glad to hear that you use hardware wallets. Personally if I'm going to liquidate a large amount of btc, it gets moved to an exchange and sold within minutes of hitting it. I just can't trust leaving any amount there for any longer than to do the sale transaction. yeah that is my norm. but with my bro-in-law getting sick with dementia and running back in forth from NJ to NY to NJ the coins had not cleared when I left to go to his home. They cleared and the hack started while I was at his home. I have no phone or pc access to coinbase at his place. (to be more secure) so it was just leave him at 3:30 pm 45 minutes into the breach and hope they did not get past my last line of defenses. Got home by 6:15 pm and had
|
|
|
|
ChartBuddy
Legendary
Offline
Activity: 2296
Merit: 1801
1CBuddyxy4FerT3hzMmi1Jz48ESzRw1ZzZ
|
![](https://bitcointalk.org/Themes/custom1/images/post/lamp.gif) |
December 22, 2021, 05:01:28 PM |
|
|
|
|
|
Gachapin
Legendary
Offline
Activity: 1036
Merit: 2052
bitcoin retard
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 05:02:08 PM |
|
The importance of hardware wallets (really digital keyring/signing device, but alas, 'wallet' sells better) is hard to overstate. This is INSTANTLY what I tell folks who are new to Bitcoin. Get yourself a hardware wallet... and the Trezor really is a great suggestion. If the person holds a significant amount of Bitcoin, I then encourage them to get 2 more devices, and when they become comfortable set up a 2 of 3 wallet. The most important advantage in them is hard to see at first: Secure XPRV (seed, XPUB etc) generation. Hardware wallets are the ONLY foolproof way to make a bitcoin seed. So far there is no other way that is safe, that also is not prohibitively difficult/risky. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FH9dohIM.png&t=665&c=UoYznGTSJtOWVw) That's so important. I give the same advice to any new hodler. I tell them to skip Ledger though, with their shitty in house security (aka "data leak") and their quasi closed source "secure element" design. However, HWs really bring people to actually using Bitcoin. I mean, I have met countless guys who hold five figures in "crypto" on exchanges and haven't even sent one transaction in their life. Yes.. we could argue about the quality of RNGs in HWs, but you can always choose a passphrase to add some security.
|
|
|
|
Torque
Legendary
Offline
Activity: 3668
Merit: 5233
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 05:09:01 PM Merited by tertius993 (5) |
|
However, HWs really bring people to actually using Bitcoin. I mean, I have met countless guys who hold five figures in "crypto" on exchanges and haven't even sent one transaction in their life.
Probably because they are terrified of screwing up, of fat-fingering and sending to a wrong address, or somehow losing all their coins completely. And what veteran even doesn't sweat a little bit, waiting for those first confirmations to start showing up? Especially with a large transaction. And I can completely relate, as that is how I felt in the beginning too. It really is a shame that the "ease of use" factor of bitcoin has not been improved really at all in 7-8 years. By now it should be as easy, secure, and painless/fearless as using your online bank account. It's still a HUGE impediment to global mass adoption.
|
|
|
|
JayJuanGee
Legendary
Offline
Activity: 3836
Merit: 10792
Self-Custody is a right. Say no to"Non-custodial"
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 05:11:17 PM |
|
Good use of the term crypto in this context. 1 Question for the Advanced minds: If FIAT Currency crashes to 0 do you think Bitcoin is going to survive such an event?
![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fimgr.search.brave.com%2FX3Kmai--e0x9eLwSqK55eeJns2ggvd55jcwlc4eYarw%2Ffit%2F923%2F865%2Fce%2F1%2FaHR0cDovL2ltYWdl%2FczYuZmFucG9wLmNv%2FbS9pbWFnZS9waG90%2Fb3MvMzg5MDAwMDAv%2FLUx1ZmZ5LVNhdmUt%2FTGF3LUZyb20tRG9m%2FbGFtaW5nby1kb25x%2FdWl4b3RlLWRvZmxh%2FbWluZ28tMzg5MjUy%2FNzYtOTIzLTg2NS5w%2Fbmc&t=665&c=vSqGtzGDK2sGfg) Yonko we are Coming ! Fiat crashing to zero seems quite an outlier scenario (especially if you were to believe that to be in the cards in any kind of near-term future and before a lot more desperate acts from the current status quo financial incumbents), and anyone framing the matter in such extremes seems likely to be missing a whole hell of a lot of way the hell more likely scenarios in which bitcoin is both already winning (and seemingly pretty clearly so) and likely to continue to win with quite a bit of resoluteness and material meaning.. even if we might not know details regarding how smoothly the whole transition from fiat to bitcoin plays out in terms of the transition between different systems (largely two in the case of transitioning from fiat to bitcoin).. and yeah of course, there could be a lot of violence too, and for sure there are going to be casualties, too.. , so there could be some need to prepare for various kinds of acts of desperation from various no coiners or those who try to get on the bitcoin train way too late.. Actually, now we are still really quite early in spite of so many attempts to frame the matter to the contrary.. so it is likely a time to be actually taking preparatory actions in terms of accumulating BTC and/or maintaining your BTC stash in a kind of safe status that you are able to retain decent quantities of it during our ongoing transition from fiat to BTC (which could also take 50 years to play out, even if there might be periods of rapid changes in the midst that could come in the coming years, too) rather than sitting back and watching, complaining and/or considering that bitcoin might just fall into your possession without your having to have had taken any significant/meaningful personal actions to facilitate such acquisition and maintenance of a bitcoin stash, beyond mere begging.
|
|
|
|
Gachapin
Legendary
Offline
Activity: 1036
Merit: 2052
bitcoin retard
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 05:16:52 PM Last edit: December 22, 2021, 06:38:56 PM by Gachapin |
|
Personally if I'm going to liquidate a large amount of btc, it gets moved to an exchange and sold within minutes of hitting it. I just can't trust leaving any amount there for any longer than what is required to do the sale transaction.
THIS!! Sadly, many had to learn it the hard way, me included. I never stored too much on exchanges, but I still lost coins on GOX and (temporary) on Stamp. Stamp refunded everything, without issuing stupid tokens or so. That's why Stamp gained some of my trust, and that in times when you couldn't trust any exchange even a bit. I still use Stamp
|
|
|
|
cygan
Legendary
Online
Activity: 3276
Merit: 8552
icarus-cards.eu
|
|
|
|
|
tertius993
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 05:21:13 PM |
|
However, HWs really bring people to actually using Bitcoin. I mean, I have met countless guys who hold five figures in "crypto" on exchanges and haven't even sent one transaction in their life.
Probably because they are terrified of screwing up, of fat-fingering and sending to a wrong address, or somehow losing all their coins completely. And what veteran even doesn't sweat a little bit, waiting for those first confirmations to start showing up? Especially with a large transaction. And I can completely relate, as that is how I felt in the beginning too. It really is a shame that the "ease of use" factor of bitcoin has not been improved really at all in 7-8 years. By now it should be as easy, secure, and painless/fearless as using your online bank account. It's still a HUGE impediment to global mass adoption. Completely agree - the learning curve is too steep and the potential for a serious c*ck up too large for the average Joe or Jane. While we are on it the other thing that annoys me is all the dust that is scattered all over the place. Mining pools, exchanges, wallets and who knows where else with individually tiny amounts that were too small to move and are doubtless lost for ever. These will become significant.
|
|
|
|
JayJuanGee
Legendary
Offline
Activity: 3836
Merit: 10792
Self-Custody is a right. Say no to"Non-custodial"
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 22, 2021, 05:46:14 PM Merited by LFC_Bitcoin (8) |
|
Not today ChartBuddy, not today.
Pump it to $50,000 damn!
Does not seem to want to go. Until it does. ![Wink](https://bitcointalk.org/Smileys/default/wink.gif) "Pay us £33 per month to read these terrible opinions." No thanks. For sure, the title itself seems to be caught back in years gone by.. before a lot of those arguments had already been clearly rebutted..... .. sometimes there is a convoluting of the ideas of crypto and bitcoin to help to give some credible evidence to the arguments, but still we should be calling out such ongoing convolution of concepts/terms - even though the convolution does not seem to be getting any better.. but there are likely going to continue exist a variety of ways to distract people into various get rich quick possibilities, and surely they are not completely unbacked..... .. but yeah, why not attribute various negative happenings to bitcoin.. what else is new in terms of ongoing tricks to contribute to normies failing/refusing to accumulate bitcoin or to attempt to cause them to sell too much too soon. For sure, those of us who have been studying bitcoin for a while can appreciate some of these disinformation patterns and NOT get tricked out of our coins.. or tricked into stacking insufficient quantities of coins.
|
|
|
|
|
|