Quote from: crypto-ky on November 21, 2017, 10:19:21 AM

Quote from: GabryRox on November 21, 2017, 12:38:33 AM

Quote from: almightyruler on November 20, 2017, 09:09:14 PM

Quote from: GabryRox on November 20, 2017, 07:37:54 PM

This may be somewhat true for some users but I actually had a different PW for my Cryp acct than any other exchange, so this does not apply to me.

I sympathise with you losing your funds, but the whole idea of 2FA is that it proves (at least with high confidence) that you have physical possession of the sole authentication device and therefore you are likely to be the rightful owner of the account. [2FA isn't perfect, of course. Email 2FA is useless if a hacker already controls your email, and SMS 2FA can be captured by porting your phone number to new account.]

A different password for each site will not help if you have something that has logged your keypresses, or nabbed your browser's password file. Anyone who has a copy of your "virtual" credentials can log in, from anywhere in the world. That's what 2FA is intended to prevent.

I do think you have raised a valid point about failed logins. Multiple attempts should lock out the account, temporarily at first, for a longer period each failure, then eventually semi-permanently. It does sound like you may be making some assumptions about brute forcing, though.

You made some fair points and you're somewhat right about the brute force statement. However, Cryptopia themselves are the ones that notified about the "multiple" attempts. Granted, there is no way for me to know exactly how many "multiple" means, but most certainly in implies more than 3, which should be the floor for beginning of acct locking protocols (as you described above). Since this clearly was either not in place at all or way too easily circumvented by the hackers, which on it's own is more than sufficient grounds for me being due full restitution from Cryptopia.

Although I have now switched over all 6 types security to Google Auth 2FA, this is still insufficient for the trading/withdrawal loophole I mentioned. Cryptopia admitted that the 2FA (PIN at the time) had temporarily thwarted the hackers from just sending all of the LTC they accumulated to an external LTC wallet. But, they used the trading loophole that i described to artificially dump an unknown shyt-coin at 3% its cost (to obviously another acct they owned). So bottom line, if a hacker somehow accesses your account, even their 2FA protocols will not protect from your account be liquidated. This is another huge security gap IMO. Not sure what the bigger, well-respected exchanges has in place to thwart this but there has to be a way.

You say you're not sure what bigger exchanges do to thwart this? I can answer that, nothing. Dumping happens all the time, legitimately. This is not something for the exchange to stop as it is what an exchange is for. For a hacker to get into your account, you did something wrong or had something of yours compromised, whether it is re-using your password elsewhere, getting caught by a phishing scam, left yourself logged in somewhere, had your phone hacked, had someone looking over your shoulder, it is your security that was compromised not the exchange. Cryptopia has more 2FA options than anyone else out there, including on login, that will further protect your account. I suggest you use the options available to you and properly secure your account. Oh, and Cryptopia does appear to lock your account after 3 failed attempts.

lmfao... thanks for your "expert" advice lol. Did you actually bother to read my prior posts? If you would have, you would realize that I actually did NONE of the things you mention regarding login faults. Nothing of mine was compromised and as stated, I actually had a different and unique password set since I wasn't sure of Cryptopia's legitimacy yet (ironic, i know). I doubt that you know what other exchanges have in place to prevent dumping, and your assertion that it can happen "legitimately" is further proof of that. In what "legitimate" case does someone sell $1000 in coin they just bought for $30? Maybe there are 1% chance of a legit reason for this that I cant think of but surely 99%+ of this is used to commit the crime I described. Again, as stated before I have all options now set with the best 2FA GA. However the dumping issue aside, the bottom line is that they did not have reasonable login protocols in place and that is how the hackers go into my account, so they are legally culpable for full restitution. If they really do block acct after 3 failed attempts as you say, then the hackers were somehow able to reset this counter so that they could continue to try after 2 bad attempts. This again would be completely the fault of Cryptopia due to leaving hacking vulnerability in their code to allow said resets.