372
2FA / MFA options
in progress
Activity Feed
Sort by
N
Nicholas
When this is implemented, please support multiple MFA devices at the same time. I like to use TOTP as the main option, and have fido U2F as a backup if I lose my app. Ledger supports acting as a Fido device so it is backed-up with your seed phrase. Don't go the lazy route and only support SMS for 2fa, it's outdated and insecure
P
Petur
P
Petur
in progress
This is now being actively worked on
P
Petur
Arte
Merged in a post:
Trustless Login & 2FA
C
Chad
Being that we are talking about crypto and thus finances here. It makes little sense that trustless logins are not in use. Whether that be using ONT.ID, unstoppable domain login, or other crypto ID solution.
Despite only being readable access, the information that is contained on here alone is enough to do massive harm.
Also, we are talking finances here, even the amounts of transactions are sensitive. 2FA is essential. Yubikey is an excellent option.
R
Raja shing Raja shing
Raja shing
M
Maan
Sxp
P
Petur
F
Fasdgs
Make it optional if you do. 2FA on something like Koinly is like wearing a hazmat suit so you dont get a cold. Stop the 2FA on everything trend. This is not your bank account, its a transaction history app. There is no sensitive data. If you are actually going to add it, do not make it compulsory.
P
Philip D'Ath
Fasdgs: Koinly contains everything required to experly phish you. All your wallet addresses. Every transaction. What you bought when and for how much. What crypto exchanges you use. It also offers implied information, such as the fact that you are a crypto user. It tells an attacker who active you are (do you trade daily, or just buy once every 6 months). Koinly has your name and your email address.
Koinly has very sensitive information that could cause a lot of harm to you if it got into the wrong hands.
F
Fasdgs
Philip D'Ath: Yea sorry to break it to you but literally everything you interact with these days have that information and HEAPS MORE. This is paranoia to the fullest. There is nothing anyone can do with information stored on Koinly, and if they can, then you've got a lot more problems than 2fa here. With this logic, you should put 2fa on every single website you interact with that has even nothing but your e-mail.
They can do optional 2fa as I said for the paranoid, but anyone with basic understanding of online safety will be just fine without it. Leave 2fa for websites containing ACTUAL sensitive info.
Those with a brain understand that a bigger problem of the 2fa-filled future is losing access to said 2fa. (looking at password managers protected by 2fa...). Stop the paranoia. Please.
P
Philip D'Ath
Fasdgs: I do personally believe you should secure every web site you use that stores sensitive information about you with 2FA. I class (name, email address and transactional information) as sensitive information. You feel differently. That's fine.
F
Fasdgs
Philip D'Ath: Agree in concept hard-disagree on reality. What will happen is "A" website will require Authy. "B" website wont work with Authy but will with some other random 2fa tool. "C" website will work with any. This is the world we are in now.
Password manager + randomized password generator is sufficient. Secure additionally 2fa to vital accounts like bank crypto-exchange etc. Koinly is not vital. Thats my take-away. Maybe in the future I will agree with you, but currently it is all a big unnecessarily complicated hassle for minimal reward.
P
Philip D'Ath
Fasdgs: That is not the world we are in. MFA "codes" use the standard TOTP algorithym. It doesn't matter if you use Google Authenticator, Microsoft Authenticator, Authy, Bitwarden, etc - they will all produce exactly the same codes.
Personally, I used Bitwarden for everything. I like how they never have access to your plain text data, and you can sync your password+MFA database between all of your devices. It really couldn't be simpler. Most of the time it is 3 mouse clicks to log into websites that have username+password+MFA.
J
Jeff Caruana
I'm honestly shocked this feedback was 6 months ago and security seems to still not be important for Koinly. Going to share this to Reddit forums to ensure more people are aware to avoid until 2FA is available.
Load More
→