Quote from: bitsire on November 02, 2017, 04:33:29 PM

Quote from: jfgreen on November 02, 2017, 02:09:05 PM

Quote from: dahemmer on November 02, 2017, 08:41:28 AM

Quote from: dahemmer on November 01, 2017, 03:49:05 PM

Quote from: jfgreen on November 01, 2017, 04:29:31 AM

This could be a huge security issue allowing users to access wallets with private key without logging in; Even though the team is trying to secure a successful token distribution with multi level verification between email and telegram the security issue lies in the fact a users machine could have key loggers, malware, or spyware.

if a machines computer is infected the url and private key is logged recording the exact website the key is used for.

being this secure you don't even have the 2fa working yet and your issuing tokens?

The solution should require user to login and implement 2fa in order to access the web wallet and tokens; this way if a hacker does have the private key at lease he can't access the web wallet without logging in.

Can you please report back on this.. If you lose your coins the team is sure not going to reimburse any token holders.

Two-factor authentication is working, but it's indeed not activated for web wallets. I will address your concern to the team and will get back to you.

According to the security team, there is no need/use to activate two-factor authentication for the wallets. The secret key should be sufficient. I suppose they can't just activate two-factor authentication on the web wallets, as it would require everyone to have a BOScoin account, even exchanges who are creating wallets on the fly.

Right; but until you release your official client where people can store their funds on other than a web wallet, the web wallet should require ALL users initially to login and set with 2fa so they can access web wallet.

Again any machine that has malware and keylogger I wish you the best..

THEY are not responsible if YOUR machine has malware. Learn some damn self accountability millennial!

Hello,

I do not agree with you.
They are responsible of the security of their website, and need to secure it properly.
It's true that a 2FA auth for the wallet website would be nice especially for those who invested 10, 20, even $40K in bitcoin in the project.

What you're saying it's like: "The Uber taxi service is available in most African countries or the Philippines. Uber knows exactly were are located the most dangerous areas in some cities. Uber can very easily integrate these "no-go zone" on there Gps-API so that users and drivers will be safe. But no.. Uber is not going to do it because THEY are not responsbile if YOUR city has very dangerous areas."

Your opinion doesn't make sense.
BOScoin wallet needs a better protection. They are responsible of the security of their website.

Regards,
Evolvion