Let’s assume you enabled 2FA on your GDAX\/Coinbase account. Currently, you cannot withdraw funds from GDAX to outside address or bank account without two-factor authentication (2FA).<\/p>\n
However, you can move the funds from GDAX to Coinbase account and from there you can then send them to outside address without 2FA!<\/strong> I consider this a security flaw and will demonstrate the issue in the example below.<\/p>\n If for example, you have a device (PC\/MAC\/Mobile, etc.) where you have activated “remember me for 30 days<\/strong>” feature to avoid providing 2FA everytime you log in, this device becomes a target for potential theft. Once someone will get an access to this device and steal your login credentials, they can then move the funds from GDAX to Coinbase and from there move it to an outside address to which you no longer have access<\/strong>. GDAX and Coinbase share the security settings (including login details), so attacker needs just your login details to access both platforms to action it.<\/p>\n Vulnerability above assumes that attacker will gain access to login credentials and to the device with active “remember me for 30 days”, so please make sure you have both secured very well if you happen to have this kind of set up.<\/p>\n @COINBASE: kindly fix it pls!<\/p>\n","protected":false},"excerpt":{"rendered":" Let’s assume you enabled 2FA on your GDAX\/Coinbase account. Currently, you cannot withdraw funds from GDAX to outside address or bank account without two-factor authentication (2FA). However, you can move the funds from GDAX to Coinbase account and from there you can then send them to outside address without 2FA! I consider this a security […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[23],"tags":[72,70,68,69,71],"_links":{"self":[{"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/posts\/358"}],"collection":[{"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/comments?post=358"}],"version-history":[{"count":7,"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/posts\/358\/revisions"}],"predecessor-version":[{"id":365,"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/posts\/358\/revisions\/365"}],"wp:attachment":[{"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/media?parent=358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/categories?post=358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pavelchmelar.cz\/wp-json\/wp\/v2\/tags?post=358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}