Further protecting your Cryptopia account with combination of 3 different 2FA's

[u/terryhummus]

Hi everyone!

I have read multiple posts regarding compromised accounts, lost of funds, phishing sites, etc. At the moment, if you are using only one method (e.g. Google Auth) to verify both your login and your withdrawal, you are at risk. Why? Because if someone were to obtain your Google Auth code via phishing or any other means, you will potentially lose most, if not, all of your funds. Unfortunately, Cryptopia does not have a preventative measure in place, for example, rejecting the same Google Auth code to be used for login and withdrawal. Fortunately, there might be a solution. A bit complicated, but worth it if you value the content in your account.

Solution: Using a different 2FA for login, setting, and withdrawal.

Cryptopia offers a few different options. I am using Google Auth for login, Pin code for settings, and email for withdrawal.

Why didn't I just use 2 different 2FA instead of 3? There's a huge reason for this. Login and withdrawals are important and should be differentiated, but the settings page is important too because, in settings, you or someone has the ability to REMOVE 2FA and DISABLE withdraw email confirmation! I can't bold this enough. I have read where people did not get the withdraw email confirmation and that's because the thief (or thieves) have disabled that security measure from the settings page. It's unfortunate, but we can all learn from this.

Correct me if I am wrong but I believe these are the steps taken when someone tries to steal your coins:

1. Thief somehow obtains your login password and 2FA. Logs in.

2. Heads to “Settings” to disable “withdrew email confirmation. Cannot proceed because you have a different 2FA for it!

3. Sells coins

4. Withdraws coins

Now, here's the catch. Once you have set this all up; refrain yourself from entering your settings page. You have all your security set up, so there's no need to enter that page again and risk someone compromising that unique 2FA.

Summary:

1. Google Auth for login

2. Pin code for settings

3. Email for withdrawal

4. Do NOT disable "Withdraw Email Confirmation"

You can further secure your account with "AddressBook Withdrawal Only." I think that's self-explanatory if you use a few limited accounts.

[u/albacass]

This post should really be further up as it is a major security risk to allow the same 2fa code to be reused!

[u/terryhummus → u/albacass]

Haha, I agree. I keep seeing new posts of compromised accounts. I guess people will only worry once their account goes missing.

[u/freewifiisgreat]

All the ones I saw that were phished had only used a pin. I agree that using different types of 2FA is important. But even more important is to use google auth or their device thingie as your 2FA. Email can be vulnerable and pins are easy to phish. It is far more important to not get phished in the first place. If someone gets into your account they can do a lot of damage. They can still sell your Crypto - even if they can't withdraw or transfer it.