Quote from: Xiaoxiao on September 06, 2014, 10:23:47 PM

Quote from: wasserman99 on September 06, 2014, 10:22:08 PM

Quote from: haploid23 on September 06, 2014, 09:15:16 PM

You might have clicked on a phising link a while back and the scammer just waits dormant until you have a large transaction. Why didn't you activate 2FA? It would prevent this kind of stuff. You can even give out your user name and PW, but no one will be able to withdraw unless they have your personal device.

2FA does not work quite that well (at least not all the time). There are always potential ways around 2FA on websites. I would consider it to be reckless if someone is careless about their password simply because 2FA is enabled. 2FA should only be an additional security method, not the only security measure.

What way does one get around 2FA? Could someone brute force 2FA such as google AUTH ?

Various sites have had ways to get around to needing to input the 2FA code, or being asked for the 2FA code. I vaguely remember an example of a website allowing a user with 2FA enabled for someone to login via the API with just the username and password.

In theory it would also be possible to have 2FA disabled if you were to contact customer service and claim you are having difficulty receiving text messages with your 2FA device (social engineering).