2

If I use Google Authenticator for Coinbase, and someone sim-swaps my phone number and gains full access to my email account, can they drain my Coinbase account?

They would be in control of my email, sms, and phone calls.

5

It will depend on how Coinbase protects the account from the loss of the 2FA code. If you can get past the 2FA by saying "send me an email/text instead", then 2FA does not protect you at all in this case.

If the 2FA code cannot be bypassed so easily, then 2FA can protect the account better from SIM-swap attacks.

1
  • "If the 2FA code cannot be bypassed so easily" - The specifics of how to bypass Google Authenticator 2FA on Coinbase are documented on help.coinbase.com/en/coinbase/managing-my-account/… under "I no longer have access to my old mobile device." I leave it up to OP to evaluate if those steps constitute sufficient protection.
    – Brian
    Jun 14 at 20:09
-2

No, the Google Authenticator doesn't stop SIM swapping attacks since the Authenticator (or any other OATH-TOTP app) isn't related to your SIM card in any way. If somebody "steals" your SIM card with a swapping attack, the Authenticator doesn't add any protection.

The Google Authenticator adds a second factor to the authentication process: You need your "normal" password + the one-time password from the Authenticator to log into your service. For this, the Authenticator stores a secret on your device. An attacker can't get this secret with a SIM swapping attack.

1
  • 3
    The question is if the Coinbase account is protected. Not if TOTP would protect the SIM.
    – schroeder
    Jun 14 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.