
Hackers Have Stolen Millions of Dollars in Bitcoin Using Only Phone Numbers - seventyhorses
http://www.forbes.com/sites/laurashin/2016/12/20/hackers-have-stolen-millions-of-dollars-in-bitcoin-using-only-phone-numbers/#603fd1ab22db
======
averagewall
It's completely ridiculous for a service to offer 2FA with SMS and also
password recovery via SMS to the same phone number. It sounds like that's how
this guy got hacked. He was effectively using more like half-a-factor
authentication. He probably didn't realize because his email service didn't
clearly show him how it will grant access.

It would be great if online services showed a clear matrix of authentication
methods so you can see which combinations are sufficient and necessary to
access your account. Simply adding a 2nd factor is a bad idea because it means
if you lose either one, you're locked out of your account, so you also need a
3rd factor to protect you from yourself. I personally have 4 factors for my
gmail account - regular SMS 2FA, a friend's phone number for password recovery
and paper backup codes. This way, I can lose almost any two factors and still
have access. If I forget my password and also lose access to my friend's phone
for password recovery, then perhaps I'll be in trouble but Google doesn't make
it clear if they'll let you in using only your backup codes and 2nd factor
phone number.

~~~
bitmapbrother
It's even more ridiculous for a telco CSR to transfer his number to another
provider without doing any sort of proper validation beforehand. A simple
callback to ensure that the person calling was indeed the owner of the number
would have prevented all of this.

~~~
amag
In the process of transferring a phone number now and it seems to be
universally insecure. Sign a paper and you're done.

A simple automated SMS from your current provider that requires a "YES"
response would be a lot securer and shouldn't be hard to implement.

~~~
ewams
Don't forget number porting is recently new. The FCC started requiring
carriers do it in 2003. Since the telco's were forced to do it, you think they
are going to put any effort into it unless legally required to do so? They
don't care.

~~~
Thetawaves
Nearly every carrier has a customer provided pin attached to the customer
account that is used to verify porting requests.

Stop commenting on things you know nothing about.

~~~
nommm-nommm
There has literally been hundreds of cases reported in the media in the last
few years where the phone company ported a phone number either without
verification or with "verification" (easily found information) and the victim
had their accounts stolen. This has been a documented problem.

Phone companies seem to be starting to take the issue more seriously as of the
last few months due to the aforementioned bad press. Verizon just forced me to
create a PIN by Jan 24th, 2017. So I didn't have a PIN until less than a month
ago.

~~~
Thetawaves
The practice has been in place so long, even a lumbering giant like Verizon
requires it... Hahaha

------
pdeuchler
This happened to me about a year and a half ago, luckily I only lost a couple
bitcoins that I had in coinbase, it could have been a lot worse.

The major crux of this article is the paragraph where it talks about how
regulations essentially allow phone carriers to do whatever they want, with no
guarantees of security, no indemnity, and if anything goes wrong there's no
repercussions whatsoever.

There is literally nothing you can do to prevent this, any kind of "flags" or
"extra security" you request are entirely enforced at the whim of individual
call center personnel, and it only takes one person to ignore them. My case
was similar to the article, I had some basic security flags enabled on the
account but they were buried in notes from calls years ago and obviously no CS
rep is going to read through years of notes on every call.

In my case the attackers called Sprint customer service over 100 times over a
5 day span. On the day I was breached they called 12 times within 3 hours
before a weak link allowed them to transfer my number. No alerts to myself or
the account holder, no notifications, nothing. The first rep I called after
this occurred gave me great detail into the calls and what they had asked,
apparently some of the numbers even came from different European countries. I
immediately tried to escalate to their fraud department and was stonewalled
hard. The fraud people denied any pattern of calling into their support lines,
denied any transfer of my number (even though reps later happily helped
transfer it back from Google Voice), and denied any action on the part of
Sprint that caused this to happen.

Lawyers essentially told me I was out of luck, there was no recourse unless I
was willing to go to war in the courtroom and unfortunately I don't have
_that_ many old BTC.

It is absurd that such telecommunications backbones have such lax policies,
much less no repercussions when they screw up. This will continue to be an
attack vector until we force some sort of regulation that requires
extraordinary damages to be paid per case... something tells me even low fines
and slaps on the wrist won't incentivize the telecoms to provide _actual_
customer service.

~~~
jbmorgado
> _The major crux of this article is the paragraph where it talks about how
> regulations essentially allow phone carriers to do whatever they want_

So, in a word, phone carriers are actually _unregulated_ when it comes to the
relevant facts in here.

Isn't that a paradox then? Using bitcoin in order to deregulate the financial
system and then ask more regulation for phone carriers in order to protect
your unregulated bitcoin?

~~~
UweSchmidt
"Real" bitcoining doesn't use services like coinbase; the coins are on your
computer which you have to secure yourself. At least this is what you get told
in cryptocurrency forums when one of the exchanges get hacked.

~~~
jbmorgado
You didn't read TFA. There were no online exchanges involved, the bitcoin
wallet was in his computer.

~~~
UweSchmidt
Oh ok, then it's the other way 'round. "Security is not easy, if you can't
handle it better leave your btc on the exchanges." Either way, it's all by
design, if you lose your money it's your fault.

------
gregschlom
Another thing to keep in mind is that most phones will display the content of
SMS messages on the lock screen, even if the phone is locked. That means that
if your phone is stolen, hackers can easily take control of accounts such as
PayPal that use SMS verification as the only way of establishing one's
identity.

This exact scenario happened last week to a friend of mine, I wrote a little
article about it: [http://gregschlom.com/misc/2017/01/29/hacking-paypal-
account...](http://gregschlom.com/misc/2017/01/29/hacking-paypal-
accounts.html)

~~~
alexdumitru
That's one of the first things I setup on my Android phones. You can see that
I have notifications, but not their content.

~~~
djsumdog
That really needs to be the default.

~~~
ReverseCold
On Android _, it asks you when you set your passcode for the first time.

_ Super fragmented, but Nexus 5X had it.

~~~
emiliobumachar
My Sony Xperia also asked me at lock screen configuration. I could choose
either way, but could not ignore the question.

------
rahimnathwani
How was the hacker able to port the victim's number to another provider?

In the UK, the first step in porting a number is to request a 'Porting
Authorisation Code' from your current provider. They don't give you that over
the phone, but send you an SMS. So AFAIK you need to be able to receive SMS on
the number already, in order to transfer the number to another provider.

So, was this hack enabled by a weakness in the US number porting process?

(In China, where I live, number porting isn't possible. Getting a new SIM
requires you to physically present yourself and your passport or national ID
card. If passport, the passport number must match the passport number they
have on file, so a replacement passport wouldn't get around this requirement.)

~~~
emptythought
These SocEng attacks are to retrieve that code from the old provider. It works
the same way here

~~~
rahimnathwani
"It works the same way here"

here = UK?

------
aresant
I thought the story sounded familiar - Jered Kenna - this story's lead,
claimed to have lost 800 BTC in 2013 (1)

That story got him quite significant press at the time, I found thousands of
deviations of the original Bloomberg story - people LOVE the "darwin award"
story category.

I was going to crack a joke about this being a Paul Graham submarine strategy
(2) but it's just too sad and I believe him, 2FA is a mess.

(1) [https://www.bloomberg.com/news/articles/2013-04-10/meet-
the-...](https://www.bloomberg.com/news/articles/2013-04-10/meet-the-bitcoin-
millionaires)

(2)
[http://paulgraham.com/submarine.html](http://paulgraham.com/submarine.html)

~~~
eru
It's a shame that 2FA is often implemented via unsecure SMS.

The apps are actually more secure.

~~~
ploxiln
I agree, but it's worse than that, with SMS widely used for account recovery.

> But 2FA via SMS is ubiquitous because of its ease of use. “Not everyone is
> running around with a smartphone. Some people still have dumb phones,” says
> Android security researcher Jon Sawyer. “If Google cut off 2FA via SMS, then
> everybody with a dumb phone would have no two-factor at all. So what’s worse
> — no two-factor or two-factor that is getting hacked?”

The thing is, SMS is worse than a reasonably good password. So it's a bit
annoying that Google strongly encourages me to register my phone number with
my gmail account for recovery.

And many services, including Google, make it difficult or impossible to enable
TOTP without first registering a phone number. They really really push the SMS
route. Brings up the average security level for the average person, I'm sure.
Very annoying for me.

~~~
justinclift
This is interesting to me, as I live in an area with no mobile reception.

So (for me) it's a real PITA when places _require_ a mobile phone number and
there's no way to skip it. Obviously, can't use those services.

Does anyone know if Google Authenticator would run on a wifi iPad? As a
potential workaround for the "no mobile network" situation.

~~~
joatmon-snoo
No connectivity is required, it's TOTP on a 30-second interval. The tl;dr: is
that you have a shared secret (so if this ever gets leaked to an attacker,
yes, you're vulnerable) which is used in conjunction with current time (give
or take a few seconds) to generate a code you can use to confirm
authentication.

~~~
wonderfool
This may sound silly, but keep in mind that TOTP requires that both ends agree
on the current time. I learned this the hard way when my authenticator stopped
working consistently.

Apparently I had disabled my device's (the one with the authenticator app)
"automatically set time from NTP" feature. Over time this resulted in my
device's clock drifting X seconds away from the providers' clock(s), which in
turn resulted in my occasionally using codes that were already X seconds
expired.

~~~
eru
The counter based OTP is actually more secure, but Google doesn't go for them
with end-users, because they can go out of sync (eg if your kid is idly
flicking through a lot of them on your phone) and then have to be reset.

------
rfugger
Never attach a cold wallet to an online machine. Sign transactions offline and
transfer them to an online machine for uploading.

~~~
ScottBurson
Yes. The guy really got careless.

~~~
TwoBit
He had a 30 character password on his wallet. How the hell did they get past
that??

How the hell did they even get on his him computer in the first place? I don't
see how 2FA breaches could accomplish that.

edit: apparently you can have Microsoft make your online Microsoft cloud
password be tied to your machine login. That's such a bad idea. One Microsoft
customer support moron can effectively kill you computer. Also, even if they
got this guy's computer password, how the hell did they get into it remotely?
He made his computer visible for remote login on the Internet. I can't believe
that.

------
brilliantcode
pretty insane he was making 50 btc for mining in a day....he must've had a
sizable sum.

I really do not condone ripping people off or hacking but I have to admire the
tenacity of these hackers, nothing is out of bounds, every opportunity to
steal or rip people off is a naked call option where only their time is the
currency that can be lost with a failed heist.

It's the new bank robbers of our age but without films or hollywood
glamourizing it (yet) the same bank robbers.

Crime does pay but it's a shame smart talent is being used to destroy not
build. We can't point fingers at specific regions or countries with a
depressed economy and expect them to find honest work-they may not exist there
when government corruption has already robbed their citizens of the livelihood
they were owed. This is not a justification for criminal action but a mere
observation of the structural environment giving rise to such behaviours.

~~~
tyingq
This story was interesting:
[http://www.bbc.com/news/magazine-37735369](http://www.bbc.com/news/magazine-37735369)

I don't see how to stop it though. For areas of the world with few economic
opportunities, and little resources to chase you...the risk/reward profile is
just too tempting.

~~~
legodt
I remember reading online that to bait the valve half life 2 leaker/hacker to
come to the US for authorities to capture, valve sent the hacker a phoney job
offer. At the end of the day, all these smart tech workers want is to get paid
for their skills.

[https://www.wired.com/2008/11/valve-
tricked-h/](https://www.wired.com/2008/11/valve-tricked-h/)

[https://arstechnica.com/gaming/2016/06/what-drove-one-
half-l...](https://arstechnica.com/gaming/2016/06/what-drove-one-half-
life-2-super-fan-to-hack-into-valves-servers/) (better story)

~~~
brilliantcode
man I really got a new perspective on Gabe. Blatantly deceiving the German guy
to cause tremendous harm to his life by colluding with the Gestapo even when
Half Life 2 was a tremendous success and none of his precious monies were lost
in the process, in fact the leak only raised the profile for Half Life 2
resulting in more sales.

I definitely won't be buying Half Life 3.

TIL Gabe Newell is actually very narrow minded and not a nice guy. Hacking and
leaking is also bad but it's not clear that the action led to losses when Half
Life 2 was a phenomenal success. It's the deceptive tactic of pretending to
offer an olive branch and going back on your word. He should be fucking
ashamed of himself.

~~~
djrogers
Say someone broke in to your house, rifled through your stuff, and put
pictures of your personal things on instagram. Would you not want to press
charges?

~~~
brilliantcode
I'm sure you can see the night and day differences. Gabe just got free PR
exposure. He should've kept his fucking word and gave the guy a job but
instead he got soft.

Tony Montana said it the best: all you really have at the end of your life is
your word and your balls and how well you kept them.

------
vocatus_gate
This is why I would never store any substantial amount of bitcoin on ANY
online service, no matter how good their reputation for security.

If the amount is above say, $500 or so, it should be stored in something like
a Trezor, where only you have the keys to access it.

------
state
Related, but not directly to the article:

This post [1] from Kraken covers how to protect yourself from this kind of
attack. It's quite thorough. Interesting even if this isn't a concern for you
directly.

1 - [http://blog.kraken.com/post/153209105847/security-
advisory-m...](http://blog.kraken.com/post/153209105847/security-advisory-
mobile-phones)

~~~
dgudkov
> [http://blog.kraken.com/post/153209105847/security-
> advisory-m...](http://blog.kraken.com/post/153209105847/security-advisory-
> mobile-phones)

A 40-step instruction "how to make your google account secure" as a proof of
the sad state of internet security. No way my parents can do it.

~~~
state
It's so true. That post is both thorough and correct, and thoroughly
depressing. Luckily your parents probably don't have a lot of bitcoin to
protect.

------
pmorici
If you own any substantial amount of Bitcoin you should really be using a
hardware wallet these days to keep it safe from theft.

Ledger Nano s, Trezor, and KeepKey all stop this sort of attack.

~~~
niyazpk
Why hardware wallet? Why not store encrypted wallets online/somewhere?

~~~
rebuilder
A hardware wallet allows you to spend coins without exposing the private keys.
To spend e.g. a paper wallet, you have to swipe the keys on a computer. Yes,
that can be offline, but a HW wallet reduces the amount of possible mistakes
in this process.

~~~
slowmotiony
What if the hardware gets stolen or destroyed (or simply breaks)? Is there any
way to still get the access to that wallet back somehow?

~~~
pmorici
Yes, in the case of the Ledger Nano S for example when you set it up for the
first time it gives you a 24 word recovery seed that you write down and keep
in the safe place. The seed is created according to a Bitcoin standard (BIP39)
If anything happens to your hardware wallet you just buy a new hardware wallet
that supports BIP39 and you are back in business.

If you want to be really secure you can engrave your recovery seed into a
piece of metal that won't melt in typical house fire temps like brass.

~~~
slowmotiony
Thanks for the detailed answer, exactly what I needed! Would you recommend the
Ledger Nano S? It seems like it's half the price of Trezor for some reason.

~~~
pmorici
I have a nano, it does the job. Build quality feels cheap but like you said it
is half the cost of trezor. Keep key is a trezor clone trezor was first in the
space and I think there build quality is better

------
j3097736
>Windows account, which was the key to his PC.

The windows 10 experience

~~~
passivepinetree
Yeah that part was hard to read.

But Macs work similarly IIRC; if someone has access to your iCloud account,
they own your machine as well.

I think this is more of a comment on the cloud-centric-everything-must-live-
in-the-cloud-now mentality than anything else.

~~~
kn0where
Of course, macOS and Windows 10 both still give you the option of creating
user accounts independent of an Apple ID or MS account, which is what I do on
my macOS and Windows 10 systems.

But there's good reason these OSes tie local logins to online accounts. The
average user is more likely to get frustrated forgetting or not understanding
why their email password is not their login password, than the (comparatively)
rare scenario that someone will compromise the one-account-to-rule-them-all
and wreck all their data. My grandmother confuses her Gmail login with every
other online account because they all use the email address as a username.

Also, I'm continually amazed how little normal people care about the data on
their computers. I still have all my files from when I was 5 years old on my
main machine, but most people only care about bringing over whatever they're
currently working on when they get a new machine.

------
mannykannot
It seems unwise, in retrospect, to make the phone company a critical element
of a security mechanism, as it has no skin in the game.

~~~
cyborgx7
The whole phone number as primary authentication method seemed liked a bad
idea from the beginning, at least to me.

------
holtalanm
I know hindsight is 20/20, but with a wallet that valuable, it would have been
prudent to split that into smaller encrypted wallets of, say, $1000 apiece,
and only mount what was necessary (partition the external HD).

~~~
vocatus_gate
Or just use one of the many devices built for offline cold storage (Trezor,
etc).

~~~
TwoBit
Or move the majority of it to an index fund. Keeping bitcoin in a wallet on
your computer is like burying cash in your back yard.

~~~
Terretta
800 coins in BTC vs $64 in a fund...

Sort of misses the point when BTC was going from $0.08 a coin to $1000 a coin.

Most index funds don't offer a $64 to $800,000 trajectory even over 5 years.

------
bbcbasic
I am going to coin the term "Bitcoin Rodeo".

It refers to the fact that people get rich from bitcoin if they don't fall off
their bull by:

Losing their coins e.g. forgetting a password, throwing away a laptop.

Having their coins hacked from their computer by a Trojan or the mentioned
attack.

An exchange loses them or shuts down.

Due to greed you wait it out and bitcoin plummets to zero

Due to greed day trade your stash into the ground.

Due to fear sold your 1000 btc at 10$ each back in the day.

Etc.

~~~
PhilWright
And this is why Bitcoin is doomed to fail as a genuine currency. Imagine if
your bank said they had lost your money and tough luck on you. Or you bank
emails you to say they have been hacked and all your money is gone. Or the
bank just disappears offline and your money is gone. Or you forget a password
and so your bank says sorry, but that means all your money is gone forever.

Great system.

~~~
reddytowns
Apples and oranges. Your bank doesn't issue currency. Your bank could accept
bitcoin and run nearly the same as it runs today.

~~~
bbcbasic
Except that you wouldn't get much legal protection if someone runs off with
your bitcoin. A bitcoin transaction is irreversible and unfreezable, so there
is not a lot the bank or legal system can do to try and retrieve stolen funds.
And there is less of a trace to who the thief is.

As a result you probably aren't going to get the government failure guarantees
on bitcoin as you would for fiat. Let alone governments wont want you using a
different currency that they can't print.

~~~
reddytowns
No one can "freeze" cash, either, which is what currency is. A number in a
bank account can represent us dollars, bitcoin or whatever else. You're
talking about two different things here.

I agree with your point about government failure guarantees, however.

~~~
bbcbasic
I was talking about money in a bank account (i.e. an electronic record of a
bank's liability to it's customer), rather than cash.

------
dude01
I hate the forbes.com website, but a great story. Guy's phone number got
hijacked, then they reset his other accounts by sending codes to his phone
number on file. Maybe we need 3FA?

~~~
CodeWriter23
I still don't understand how jacking his phone yielded his wallet password.

~~~
CydeWeys
One of the accounts that ended up being compromised using his compromised
email accounts was his Microsoft account, which he used to log in to Windows
10. Presumably the attackers were able to connect remotely, or maybe download
his files out of the cloud, or something. They had the keys to the kingdom.

~~~
thewavelength
Anyway, the wallet was password protected. Still don't get it.

~~~
rebuilder
From what the article said, I understood the hard drive the wallet was on was
encrypted. Once mounted, the wallet would be accessible to anyone with login
access to the OS.

~~~
TwoBit
I don't understand how they got into his computer in the first place. No
amount of 2FA breaching could possibly get somebody into my Windows machine
remotely. And not having a password for his wallet makes nonsense whatsoever.
I'm thinking Forbes has something wrong.

~~~
rebuilder
Going by the article, gaining access to his Microsoft account was enough to
provide access to his Windows machine. I'm not sure I'd trust Forbes to get
this right, but a quick googling indicates that having access to the MS
account the main Windows user is linked to will let you recover the admin
password.

------
aresant
Coinbase offers FULL digital currency insurance against theft, underwritten
via a Lloyds of London Syndicate:

[http://www.coindesk.com/facebooks-ben-davenport-leaves-
bitco...](http://www.coindesk.com/facebooks-ben-davenport-leaves-bitcoin-
startup-bitgo/)

Lloyds isn't getting involved unless they have an incredibly high degree of
satisifaction in security processes, in fact they stripped Elliptic of their
first ever "vault" insurance shortly after awarding claiming they didn't like
the "publicity".

[http://www.coindesk.com/lloyds-back-bitcoin-insurance-
deal-e...](http://www.coindesk.com/lloyds-back-bitcoin-insurance-deal-
elliptic-vault/)

~~~
wyager
If you use coinbase, you don't own your bitcoins. Coinbase does, and they
pinkie promise to give them back when you ask.

Get a mobile wallet like Mycelium. It's very simple, and you back up your
wallet forever with a short string of words. You also retain control of your
private keys.

~~~
voltagex_
The difference being that Lloyd's isn't going insure your personal wallet.

How is using Coinbase different from holding a balance with any other bank?

~~~
MichaelGG
Coinbase unilaterally decided to hold my coins hostage until I submitted a
bunch of ID papers to them. This is for coins already in my wallet, not about
buying more or selling them and getting cash to my bank account.

~~~
sowbug
Do you think they were making sure nobody was stealing from you?

~~~
MichaelGG
I already had 2FA - they force it IIRC. They also refused to delete any of my
documents. It was related to connecting with my bank account. (Which they
removed, as my Canadian passport somehow means I am not allowed to use banks
in the US as a permanent resident.)

------
wyager
Why would you go through the rigamorole of encrypting something if it can be
undone with a text message?

If you want to store Bitcoin, use (in order of preference) a reasonably secure
computer (not an obviously poorly secured windows machine), a secure cell
phone (not a $50 backdoored Chinese android phone), or a hardware wallet.
Don't use cloud services, web wallets, or anything else that very obviously
sucks from a security perspective.

I would be more than willing to trust, say, $50,000 in Bitcoin to an iPhone
with a good passcode, running an SPV wallet. Above that and you probably ought
to put in the modest investment for a hardware solution.

------
pmontra
TLDR, don't bind anything valuable to a phone number. If a service wants you
to, pick an alternative.

------
bbcbasic
This is of course why bitcoin is a bad choice for most people, except for beer
money amounts. Despite a lot of security precautions from a savvy user,
someone made off with this stash.

Shame he didn't keep them in an exchange. Oh wait...

I always thought had I got in early in bitcoin I'd plan to sell off in
tranches at $1, $10, $100 value etc. Then at least when the coins get stolen
or worthless I'd have something to show for it.

My prediction: Bitcoin will become worthless in the long term once the crypto
is cracked by mathematics, a backdoor or quantum computing

~~~
LeoPanthera
Bitcoin is secured by relatively simple algorithms, mostly relying on the
SHA-256 hash. If this is broken, the internet has far bigger problems than
bitcoin becoming worthless.

~~~
ceejayoz
That's a hell of a strawman. No one claimed SHA-256 is insecure.

------
Buge
So if someone steals your microsoft account, they can remotely steal the files
on your computer?

And how did they crack a 30 character password? Was it written down somewhere?
Or extremely repetitive?

~~~
fragsworth
The hackers reset his password, and whatever dumb e-mail system the guy was
using lets you do this with only your phone.

~~~
Buge
What?

He had the bitcoins stored in an external encrypted hard drive. Then he
plugged the hard drive in, and they somehow stole them. They were encrypted
with a 30 character password. You can't do a password resent on encryption.
I'm asking how did they get the file from his external hard drive, and how did
they decrypt it?

------
facepalm
Couldn't somebody make a phone company with better security? It seems stories
about accounts being stolen via the phone company as weak link have been
around for several years now.

~~~
swiley
Why would you want to trust the phone company? This is a solved problem, use
IP and SSL. Of course you can't implement the really dumb "half factor" SMS
authentication this way (because it's shown for what it is.)

------
homakov
Please explain how Kanna lost bitcoins if only his accounts were hacked not
computer where the wallet is?

I dont get how 2fa is supposed to prevent local hack btw

------
franciscop
I wrote just 1 year back a similar article but about email:

[https://medium.com/@fpresencia/your-email-is-your-
password-5...](https://medium.com/@fpresencia/your-email-is-your-
password-5137f4850eec)

------
_nato_
The word hacker is giving me an identity crisis every time a headline like
this comes out.

[http://blog.ikura.co/posts/dear-mainstream-
media.html](http://blog.ikura.co/posts/dear-mainstream-media.html)

~~~
LeoPanthera
That battle was lost years ago.

------
niyazpk
Question about storing bitcoin. Can I encrypt my bitcoin wallet into a file
and store it in S3 (or anywhere in the cloud)?

Is there an app or service that does this without them having access to your
bitcoins?

~~~
wmf
Yes and yes. All wallet software that I know of has encryption. Or you can use
a brainwallet that is never stored in a file at all (although you might want
to keep a paper backup in case your brain has data loss).

~~~
ryan-c
> Or you can use a brainwallet that is never stored in a file at all

This is an incredibly bad idea. This publishes an unsalted, unhardened hash of
your password to the blockchain to be cracked by anyone. There are bots with
large precomputed tables that will instantly steal from especially weak ones.

~~~
wmf
You're right; I was thinking more of HD wallets where you don't choose the
seed.

------
libeclipse
Blockchain.info has excellent authentication. First a random identifier, then
an email to confirm you're logging in, then the actual account password, then
a 2fa code via Authy.

------
Kiro
> Now, there are more than 5,000. Computers supporting the network

Is this really correct? It sounds low.

~~~
Taek
It's more or less correct, though I think it may only count nodes with
forwarded ports.

Running a full node takes 100GB of disk space and some dozens of GB in
bandwidth every month. It consumes a lot of ram as well, and if you are
running a heavy OS you will often notice your computer is slower.

The cost of running a full node is one of the major reasons people oppose a
bigger block size. Most wanting bigger blocks don't run their own full nodes.

------
Axsuul
The lesson here is to always use an Authenticator app over SMS when possible.

~~~
sowbug
Just to be extra-clear, I think you mean "instead of," rather than the
ambiguous "over." (Though I'd prefer U2F to either.)

------
marcell
What is the tl;dr on why SMS is bad for 2fa?

~~~
dllthomas
If your password recovery also operates over SMS, it's actually 1fa.

------
dgrealy
So banks come in handy after-all.

I regularly get aggravated about the sensitivity of my bank's fraud screening.
I have to call them constantly just to spend my money. But, I am at least
reassured about how difficult it is to siphon money from the account.

