News for hackers. Stuff that matters.

A comment on Adding Easy SSL Client Authentication To Any Webapp. Parent comment

Re:Adding Easy SSL Client Authentication To Any Webapp by nly on Saturday November 30, 2013 @07:06PM (#6825338)
That's true, but there are outright trivial things a lot of sites just don't do to limit the impact of compromise. I just sold some Bitcoin for example (I know right...) and the exchange doesn't require any special credentials for initiating trades or withdrawals: just the same password and 2FA code I use to login to my account.

All the good stock trading sites I've used in the past have had separate trading passwords, it just makes sense.

[ Parent | on HN ]
Re:Adding Easy SSL Client Authentication To Any Webapp by MichaelGG on Sunday December 01, 2013 @03:08AM (#6826582)
Do you often login to your Bitcoin exchange account without performing any write actions? If the majority if the time you're not logging into a read-only session, having an extra password seems rather pointless. If an attacker has compromised the 2FA system, they've most likely compromised your device.
[ Parent | on HN ]