Can Coinbase be hacked?

[Sephera]

Can Coinbase be hacked if you use 2 factor Authentication, email address associated Gmail with 2 factor ID with SMS verification. Gmail is my regular account which I log into often.

I log in on my laptop which is fairly secure and smart phone android.

[WillMilk4Coin]

Not unless someone has both your password and your phone; otherwise, no.

[ArteL]

either you probably can hack your friend, if u know his/her closely (family, pets, etc)
what do u think about this issue?

ps dont deposit your passs in phones!!!

[Sephera]

Not unless someone has both your password and your phone; otherwise, no.

Ok thanks good to know. I am treading into BTC. Just hearing about all sorts of scams and hacking I just want to protect myself.

I would prefer 3 factor ID, password, yubiKEY, and google authenticator.

[ajax3592]

Not unless someone has both your password and your phone; otherwise, no.

Ok thanks good to know. I am treading into BTC. Just hearing about all sorts of scams and hacking I just want to protect myself.

I would prefer 3 factor ID, password, yubiKEY, and google authenticator.

Be warned any kind of online wallet is not safe, no matter how big the reputation of company, since you actually never have the wallet in your possession.

[Sephera]

Thanks I am just building up a few K for now. Once I build up more I will look into paper wallet and securing it.

[Kiki112]

everything can be hacked but it depends how hard is it to do so because some sites are extremly secured from such attacks

[WillMilk4Coin]

Correct, if we're talking about a server side attack (on Coinbase) then there could be trouble. As far as just access of use for your account, it is extremely secure with 2FA. As others have said, best case is not to keep any assets in the cloud.

Armory is highly recommended!

[DodoB]

Yes it can be hacked. every online wallet can be hacked,whatever they tell you. There were small compromises of CoinBase in the past and people lost bitcoins. offline wallets are probably the safest.

[cunixion]

coinbase has very good intentions to be hackerproof, they mention empleyees are security cleared. If they have implemented what they say, it is quite secure. It is best to be couscious though.

[panck4beer]

I log in on my laptop which is fairly secure and smart phone android.

SMS verification on smart phone may be problem, especially when you are connected to internet with it and browsing or playing variety of games - it can be compromised

[David7]

mobile sms can hack, password too.
But it is very expensive to hack sms.
hacking password is very much depends on its complexity.
And of course viruses - they like windows and windows like them.

[mjc]

Any place can be hacked.  Two factor auth will prevent you from bring hacked with a keystroke logger.  The hacker will need your password "Something you know" and the google auth app on your phone "Something you have" in order to access your account. 

[Arasce]

Though sites have been working hard to counter hackers, every sites may be hacked.
It would be better to store your funds in your offline wallet.

[mjc]

coinbase has very good intentions to be hackerproof, they mention empleyees are security cleared. If they have implemented what they say, it is quite secure. It is best to be couscious though.

Just because someone security cleared doesn't mean they know how to write secure code.  As a CEH & OSCP I regularly get through apps written by very security conscience developers/project teams.

MFA protects you from yourself and the likelihood that your system will be compromised.  

As for the security of the system, defense in depth and design and development with a focus on security goes a long way.  Were talking typical infrastructure security like Firewalls, IDS/IPS, WFA and the such are just not enough.  

Typically systems are built to meet the business need.  Business defines functionality, then use cases and test cases are written.  They tend to forget about the abuse cases, and that is when I can get in.  

What needs to happen in addition to all the infrastructure security, is that non functional requirements like security are considered from the beginning and developers are trained in defensive software development, designers trained in such things as threat modelling, business owners place as much focus on security testing as they do on functional, performance and UAT testing.  Then you stand a chance.

So, it's as secure as they allow it to be.  They will always claim it is secure, but the truth is in the pudding.  I have no idea if they are or they are not.  I certainly hope they are as I know many people rely on them.

[Itun]

Hypothetically, any website can be hacked.

The question is how hard is it to do so.

For big, trusted companies like Coinbase, I think it is very unlikely someone will figure out how to hack them.

[Harley997]

yes, of course, anything can be hacked. security is just a deterrent...... but your're fine, from the sound of it

if you have coins, withdraw to a wallet you control, though. no reason to leave em in a hosted wallet. that's asking for trouble

[mjc]

Hypothetically, any website can be hacked.

The question is how hard is it to do so.

For big, trusted companies like Coinbase, I think it is very unlikely someone will figure out how to hack them.

I think Sony was bigger and more trusted.

[mjc]

Not unless someone has both your password and your phone; otherwise, no.

Ok thanks good to know. I am treading into BTC. Just hearing about all sorts of scams and hacking I just want to protect myself.

I would prefer 3 factor ID, password, yubiKEY, and google authenticator.

That is still 2 factor.  Password is something you know.  The yubi key and google auth is something you have.  To get third factor you must include something you are (Bio metrics).

[Harley997]

Not unless someone has both your password and your phone; otherwise, no.

Ok thanks good to know. I am treading into BTC. Just hearing about all sorts of scams and hacking I just want to protect myself.

I would prefer 3 factor ID, password, yubiKEY, and google authenticator.

That is still 2 factor.  Password is something you know.  The yubi key and google auth is something you have.  To get third factor you must include something you are (Bio metrics).

biometric -- that's what i want!