Source item

@dorvonlevi It seems to me that if an attacker has (1) the user’s password (2) can pass their 2FA and (3) can pass their KYC with a liveness check, then there’s very little measures you can take to protect the account because the user is complying with the attacker — except in the instance of clever, repeated phishing success PLUS liveness is obsolete due to ai. It’s also likely that crypto users behaviour is much more likely to look like an attackers behaviour. Crypto ppl more likely to be VPN users habitually, so risk flags that a bank might use are just less useful for coinbase.