The risks of farming on Chia nft plots

So slap 2fa on it? ( 20 chrs ).

2fa usually means two different band communications. In order to do that, you need to have something that will provide the second band (e.g., email / SMS), and blockchain doesn’t have such capability.

Also, maybe you have noticed, but recently 2fa is just a codeword to have you use google app that will read your phone IMEI.

The pure amount of crypto accounts that were not hacked due to 2fa is enormous!

Are you saying that the 2fa was provided by blockchain, or rather by some other service (extra wallet, pool, …)?

I am also not debating the value of 2fa, but rather the abuse that google is doing with it. There is no need to have a special google app to provide 2fa, The second band can be either email or SMS, and both are equally strong, and both can also be hacked on the service side (Larry had such hack done on the service side - diverted SMS).

Also, part of the thing about those accounts with 2fa not being hacked could be that those people are also more security conscious (don’t have “password” be their password).

Every exchange, every online wallet should have 2fa.
I’d bet most do

As you’ve said email etc work fine.

No many many times ppl have abused exploits and 2fa has thwarted specif accounts being affected / funds withdrawn.

Agreed in general - my favorite combo is Microsoft Authenticator on an iOS device. MS Authenticator is a google 2fa clone and can scan the same QR codes, do the same stuff, etc. Microsoft and Apple are both big enough so that you know they aren’t doing anything intentionally nefarious OR they’d pay a hefty price if caught. Both companies also treat us as consumers - they both sell software/hardware as their product to us, the consumer. But Google’s consumer is other big companies like MS and Apple and anybody else who wants to advertise - WE are the product. I’d rather be a customer than an employee. :slight_smile:

I guess, you give too much credit to Microsoft :slight_smile: Potentially, the main reason you see less such crap coming from Microsoft, as they were sued starting early on for virtually every infraction. On the other hand, somehow google / facebook were mostly spared of such lawsuits (here in US). Still, as you stated, I would also go with Microsoft any day.

As far as 2fa, again that is purely about a second band verification. Therefore, email gives you an advantage that you are least likely being tracked (as long as email client doesn’t notify the sender, neither open [tracking] images). SMS pins you to a phone number. Where app has your IMEI, as such your physical phone, and potentially the phone history (if you switch SIMs). Sure, your email can be diverted, your SMS can be diverted, and I am not sure what an app would say if used from a different phone (add that phone to a list of your physical IDs?). However, all that is rather service provider hacking, not so much your client hacking (at least, that is my understanding).

The advantage of email for me is that I can create thousands of aliases for my primary email, and give each service a different one. This way it is harder to aggregate your data (comparing to SMS or IMEI sucking app). Also, when using those aliases, it is easier to see who potentially leaked your info.

1 Like

Not in any way intended to defend Google…but Microsoft and Apple don’t exactly have good track records either when it comes to privacy :sweat_smile:

BTW, sms for 2fa is really not that secure at all

Actually Google Authenticator is an implementation of time based one time passwords based on open standards. That’s why there are many compatible apps.

Of course transferring a the second factor through a side-channel that could be compromised at many points is superior to using a standard based approach that does not require such an insecure side-channel…

If you are concerned about security, use a separate device not connected to the internet or anything else to run the authenticator app.

i agreed, A bad actor, on the other hand, can compel your NFTs to leave or join a pool (which would disrupt your farming), modify the reward address, obtain a login link to the pool you’re farming in, and so on. Isn’t this alarming?