Give your trading account a security score in two minutes: run these 4 Coinbase checks, and replace SMS verification first
If your account gets hacked, is it more likely that someone broke through the wall—or that a door was left unlocked?
On November 10, Coinbase launched “Security Score” in its app. It rates your account from “Needs Attention” to “Excellent,” puts the most important action first, and lets you fix it with a tap. The official message is straightforward: most account hacks don’t happen because attackers break through the wall, but because a door was left unlocked—a phishing-vulnerable two-step verification method, an unfamiliar device, or a moment of panic during a scam call.
It scores 4 areas: sign-in, transfers, devices and sessions, and connected apps. These 4 checks aren’t exclusive to Coinbase; you can use them to review any exchange account:
1. Sign-in: What type of two-step verification are you using?
From least to most secure: SMS verification < authenticator app < security key (a physical, USB-style device). SMS is vulnerable to SIM-swap attacks: someone could get a replacement SIM for your number and receive your codes. Authenticator apps generate 6-digit codes that don’t go through your carrier, but if you type one into a fake website, it can still be stolen and used in real time. Security keys are tied to the website, so fake sites can’t get a valid signature. Coinbase says they offer the strongest protection against phishing. If you’re still using SMS, switch to an authenticator app tonight.
2. Transfers: Is there an extra lock on withdrawals?
Check whether withdrawal address allowlisting, a waiting period for new addresses, and two-step withdrawal confirmation are enabled. The goal: even if your password is exposed, funds can’t be sent immediately to an unfamiliar address.
3. Devices and sessions: Is there a device you don’t recognize?
Open “Device Management/Login History.” Sign out of old phones, computers at internet cafes, and sessions from unfamiliar locations. After that, change your password as well.
4. Connected apps: Who have you given API access or authorization to?
Delete API keys you don’t use. For the ones you still need, disable withdrawal permissions and bind them to an IP address. Many accounts are hacked not because of a password, but because an API key was forgotten and never revoked.
A hard-and-fast rule for spotting scam calls: Anyone claiming to be customer support who asks you to share a verification code or “transfer your coins to a safe account” is 100% a scammer. Legitimate platforms will never ask for your verification code, and there is no such thing as a “safe account.”
What are you using for two-step verification right now: SMS, an authenticator app, or a security key? Just name one in the comments.
Follow me for account-security checklists you can score yourself. I’ll update them when new security options become available, and I don’t recommend any specific platform.
#账户安全 #两步验证 #安全 #SecurityTips
If your account gets hacked, is it more likely that someone broke through the wall—or that a door was left unlocked?
On November 10, Coinbase launched “Security Score” in its app. It rates your account from “Needs Attention” to “Excellent,” puts the most important action first, and lets you fix it with a tap. The official message is straightforward: most account hacks don’t happen because attackers break through the wall, but because a door was left unlocked—a phishing-vulnerable two-step verification method, an unfamiliar device, or a moment of panic during a scam call.
It scores 4 areas: sign-in, transfers, devices and sessions, and connected apps. These 4 checks aren’t exclusive to Coinbase; you can use them to review any exchange account:
1. Sign-in: What type of two-step verification are you using?
From least to most secure: SMS verification < authenticator app < security key (a physical, USB-style device). SMS is vulnerable to SIM-swap attacks: someone could get a replacement SIM for your number and receive your codes. Authenticator apps generate 6-digit codes that don’t go through your carrier, but if you type one into a fake website, it can still be stolen and used in real time. Security keys are tied to the website, so fake sites can’t get a valid signature. Coinbase says they offer the strongest protection against phishing. If you’re still using SMS, switch to an authenticator app tonight.
2. Transfers: Is there an extra lock on withdrawals?
Check whether withdrawal address allowlisting, a waiting period for new addresses, and two-step withdrawal confirmation are enabled. The goal: even if your password is exposed, funds can’t be sent immediately to an unfamiliar address.
3. Devices and sessions: Is there a device you don’t recognize?
Open “Device Management/Login History.” Sign out of old phones, computers at internet cafes, and sessions from unfamiliar locations. After that, change your password as well.
4. Connected apps: Who have you given API access or authorization to?
Delete API keys you don’t use. For the ones you still need, disable withdrawal permissions and bind them to an IP address. Many accounts are hacked not because of a password, but because an API key was forgotten and never revoked.
A hard-and-fast rule for spotting scam calls: Anyone claiming to be customer support who asks you to share a verification code or “transfer your coins to a safe account” is 100% a scammer. Legitimate platforms will never ask for your verification code, and there is no such thing as a “safe account.”
What are you using for two-step verification right now: SMS, an authenticator app, or a security key? Just name one in the comments.
Follow me for account-security checklists you can score yourself. I’ll update them when new security options become available, and I don’t recommend any specific platform.
#账户安全 #两步验证 #安全 #SecurityTips
