<p>Disclaimer: I work for 2FA company CryptoPhoto</p>

<p>Google Authenticator does not save you from phishing or MitM/MitB or malware like NeverQuest, Hesperbot, Zeus, Ice IX, Bugat V2, Carberp,  Citadel, Syscron, SpyEye, etc - or any APTs at all.</p>

<p>In addition: </p>

<ol>
<li><p>Google Authenticator (GA) is not open source (only same antique version no longer in use ever got released)</p></li>
<li><p>They store their bypass codes in plaintext on the server (any serverside break-in grants the attacker full ability to authenticate as you)</p></li>
<li><p>Their bypass codes have insanely low entropy (7 numeric digits only - guessable in a mere 5 million attempts on average)</p></li>
<li><p>Their app provides QR code enrollment - and the QR codes are generated by putting your (supposed to be secret) private key into the HTTP GET parameter of a google-owned URL: or in other words - regardless of where you enroll with GA, they're sending your private keys to google.</p></li>
<li><p>"HTTP GET" parameters get stored in log files (granting access to your secret keys to anyone who can get the logs - such as by hacking, or legal subpoenas, or intercept)</p></li>
<li><p>The GA app uses a 3rd party QR code scanner to read your secret keys.  This 3rd party tool is a supermarket barcode app, designed to send all scanned codes to their server.  This is all "closed source", so it's impossible to tell if they're recording your secret keys.  Even if they're not, the author (which is not Google, and not under their control) merely has to make an update to grab GA keys if he wants.</p></li>
<li><p>GA uses TOTP, which works with "shared secrets".  This is a horrifying mistake.  Again - anyone who can crack either end of the channel can forever impersonate the other end (read: a serverside breakin can own your client side auth).  I am gobsmacked google were so stupid on this one.  Asymmetric crypto was invented to stop that kind of problem - did they choose not to use it on purpose ?</p></li>
<li><p>In the limited source that's available, there is a race-condition error in their brute-force-prevention code: you're supposed to only be able to guess 3 codes, but if you open 2+ channels for guessing, only 1 of those channels gets blocked - all the other ones can keep on indefinitely guessing new codes without getting blocked.</p></li>
</ol>

<p>And of course - to state the bleeding obvious - most of the exchanges that have already been looted were also "protected" by GA, with many of the victim operators publicly announcing that the hackers just bypassed it.</p>

<p>It's cool that GA costs nothing, but that's pretty much all it's worth!</p>

CC BY-SA 3.0
2013-12-13T22:40:03.390Z
2013-12-13T22:40:03.390Z
Chris Drake
<p>They use 2 Factor ID at ZIGGAP which I found to be one of the best new exchanges out there.</p>

CC BY-SA 3.0
2013-02-25T10:33:59.510Z
Hello and welcome to the StackExchange. Please keep your answers on topic - singing praises about Ziggapp is tangential to what is being asked. Please specify which two-factor authentication methods are available in the site mentioned.
ThePiachu
CC BY-SA 3.0
2013-02-25T14:05:27.513Z
Moreover, please link it.
o0'.
CC BY-SA 3.0
2013-06-09T00:12:38.607Z
ZIGGAP is now ZIGGONE, as in no longer serving customers.
Stephen Gornick
CC BY-SA 3.0
2013-02-01T02:15:12.383Z
2013-02-25T10:32:30.027Z
2013-02-25T10:32:30.027Z
AusBTCTrader
<p>Bitcoin Currency Exchanges:</p>

<ul>
<li><a href="http://www.MtGox.com" rel="nofollow">Mt. Gox</a>: OTP using YubiKey or Google Authenticator
<ol>
<li>Options: [On Login] | [For WIthdrawals] | [For Changes To Security]</li>
</ol></li>
<li><a href="http://www.CampBX.com" rel="nofollow">Camp BX</a>: OTP/Google Authenticator</li>
<li><a href="http://www.BitStamp.net" rel="nofollow">Bitstamp</a>: OTP/Google Authenticator</li>
<li><a href="http://www.Bitcoin-24.com" rel="nofollow">Bitcoin-24</a>: OTP using Google Authenticator and for withdrawal SMS messaging</li>
<li><a href="http://www.bitcoin-otc.com" rel="nofollow">Bitcoin-otc</a>: GPG authentication with gribble bot</li>
<li><a href="http://BitMarket.eu" rel="nofollow">BitMarket.eu</a>: OTP/Google Authenticator</li>
<li><a href="http://Coinbase.com" rel="nofollow">Coinbase</a> - OTP/Authy or OTP/Google Authenticator</li>
<li><a href="https://www.fybsg.com" rel="nofollow">FYB-SG</a> (Singapore) - OTP/Google Authenticator</li>
<li><a href="http://polimedia.us/bitcoin/mpex.php" rel="nofollow">VirWoX</a> - OTP/Google Authenticator</li>
<li><a href="https://www.weexchange.co" rel="nofollow">WeExchange.co</a> - OTP/Google Authenticator</li>
<li><a href="http://btc-e.com" rel="nofollow">BTC-E</a> - OTP/Google Authenticator</li>
<li><a href="http://localbitcoins.com" rel="nofollow">Local Bitcoins</a> - OTP/Google Authenticator</li>
<li><a href="https://www.bitcoin.de" rel="nofollow">bitcoin.de</a> - OTP/Google Authenticator or Yubikey (but not Mt. Gox Yubikey)</li>
</ul>

<p>Other Exchanges:</p>

<ul>
<li><a href="http://polimedia.us/bitcoin/mpex.php" rel="nofollow">MPEx</a>: GPG authentication</li>
<li><a href="http://icbit.se" rel="nofollow">ICBit.se</a>: OTP/Google Authenticator</li>
<li><a href="https://btct.co" rel="nofollow">BTC Trading Corp</a> (BTC-TC): OTP/Google Authenticator or YubiKey</li>
<li><a href="http://Bitfunder.com" rel="nofollow">BitFunder</a>: OTP/Google Authenticator</li>
</ul>

<p>Other Services:</p>

<ul>
<li><a href="http://www.BitPay.com" rel="nofollow">BitPay</a>: OTP/Google Authenticator</li>
</ul>

<p>EWallets:</p>

<ul>
<li><a href="http://Blockchain.info/wallet" rel="nofollow">Blockchain.info/wallet</a> - Google Authenticator, e-mail verification, SMS, and YubiKey (but not Mt. Gox YubiKey).</li>
<li><a href="http://www.WalletBit.com" rel="nofollow">WalletBit</a> - SecureCard (or perhaps OTP/Google Auth has been added now?)</li>
<li><a href="http://Coinbase.com" rel="nofollow">Coinbase</a> - SMS text messaging-based two-factor, Authy (Android/iOS app similar to Google's)</li>
<li><a href="http://paytunia.com" rel="nofollow">Paytunia</a> - OTP/Google Authenticator or Yubikey (but not Mt. Gox Yubikey)</li>
<li><a href="http://www.bitZino.com" rel="nofollow">bitZino</a> - OTP/Google Authenticator</li>
<li><a href="http://just-dice.com" rel="nofollow">Just-Dice</a> - OTP/Google Authenticator</li>
</ul>

<p>Mining Pools:</p>

<ul>
<li><a href="http://maxbtc.com" rel="nofollow">MaxBTC</a> - Yubikey and Google Authenticator</li>
<li><a href="https://eclipsemc.com/" rel="nofollow">EclipseMC</a> - Supports Yubi/GA OTP</li>
</ul>

CC BY-SA 3.0
2013-02-01T13:56:08.057Z
Actually, to be extremely pedantic, blockchain.info does not support Yubikey, at least, not properly.
David
CC BY-SA 3.0
2013-02-20T16:19:06.040Z
@David would you care to elaborate?
o0'.
CC BY-SA 3.0
2013-02-20T17:22:01.270Z
I guess they changed it. They used to support mtgox keys by simply checking the key ID and not the actual OTP which defeated the whole point
David
CC BY-SA 3.0
2012-07-05T04:54:34.027Z
Blockchain.info also supports "email 2-factor auth". You are sent a code to a predefined email address whenever you try to open your wallet.
ripper234
CC BY-SA 3.0
2012-07-05T02:03:17.517Z
2013-12-22T21:55:06.087Z
2013-12-22T21:55:06.087Z
Stephen Gornick
<p>I see that Mt. Gox now supports the Google Authenticator app (on Android, iOS - iPhone, iPad, iPod Touch, and on Blackberry) for 2-factor authentication (in addition to support for Yubikey, of course).</p>

<p>What are all the various 2-factor (also referred to as multi-factor) methods available for Bitcoin-related sites (exchanges, eWallets, mining pools, other services, etc.)?</p>

CC BY-SA 3.0
2012-11-05T16:56:01.297Z
Good post - "A plea to exchanges ... lets do 2 factor right!": http://bitcointalk.org/index.php?topic=109424.0
Stephen Gornick
<security><authentication><two-factor>
Which Two-factor authentication methods are available at which exchanges?
Stephen Gornick
# Which Two-factor authentication methods are available at which exchanges?

(Asked by: username_0 on 2012-07-05)

I see that Mt. Gox now supports the Google Authenticator app (on Android, iOS - iPhone, iPad, iPod Touch, and on Blackberry) for 2-factor authentication (in addition to support for Yubikey, of course).

What are all the various 2-factor (also referred to as multi-factor) methods available for Bitcoin-related sites (exchanges, eWallets, mining pools, other services, etc.)?

**Tags:** security, authentication, two-factor

> **Comments:**
> **username_0**: Good post - "A plea to exchanges ... lets do 2 factor right!": http://bitcointalk.org/index.php?topic=109424.0  

---

## 3 answers

### Answer by username_0 on 2012-07-05. Score: 12 | Accepted answer

Bitcoin Currency Exchanges:

* [Mt. Gox](http://www.MtGox.com): OTP using YubiKey or Google Authenticator
  1. Options: [On Login] | [For WIthdrawals] | [For Changes To Security]
* [Camp BX](http://www.CampBX.com): OTP/Google Authenticator
* [Bitstamp](http://www.BitStamp.net): OTP/Google Authenticator
* [Bitcoin-24](http://www.Bitcoin-24.com): OTP using Google Authenticator and for withdrawal SMS messaging
* [Bitcoin-otc](http://www.bitcoin-otc.com): GPG authentication with gribble bot
* [BitMarket.eu](http://BitMarket.eu): OTP/Google Authenticator
* [Coinbase](http://Coinbase.com) - OTP/Authy or OTP/Google Authenticator
* [FYB-SG](https://www.fybsg.com) (Singapore) - OTP/Google Authenticator
* [VirWoX](http://polimedia.us/bitcoin/mpex.php) - OTP/Google Authenticator
* [WeExchange.co](https://www.weexchange.co) - OTP/Google Authenticator
* [BTC-E](http://btc-e.com) - OTP/Google Authenticator
* [Local Bitcoins](http://localbitcoins.com) - OTP/Google Authenticator
* [bitcoin.de](https://www.bitcoin.de) - OTP/Google Authenticator or Yubikey (but not Mt. Gox Yubikey)

Other Exchanges:

* [MPEx](http://polimedia.us/bitcoin/mpex.php): GPG authentication
* [ICBit.se](http://icbit.se): OTP/Google Authenticator
* [BTC Trading Corp](https://btct.co) (BTC-TC): OTP/Google Authenticator or YubiKey
* [BitFunder](http://Bitfunder.com): OTP/Google Authenticator

Other Services:

* [BitPay](http://www.BitPay.com): OTP/Google Authenticator

EWallets:

* [Blockchain.info/wallet](http://Blockchain.info/wallet) - Google Authenticator, e-mail verification, SMS, and YubiKey (but not Mt. Gox YubiKey).
* [WalletBit](http://www.WalletBit.com) - SecureCard (or perhaps OTP/Google Auth has been added now?)
* [Coinbase](http://Coinbase.com) - SMS text messaging-based two-factor, Authy (Android/iOS app similar to Google's)
* [Paytunia](http://paytunia.com) - OTP/Google Authenticator or Yubikey (but not Mt. Gox Yubikey)
* [bitZino](http://www.bitZino.com) - OTP/Google Authenticator
* [Just-Dice](http://just-dice.com) - OTP/Google Authenticator

Mining Pools:

* [MaxBTC](http://maxbtc.com) - Yubikey and Google Authenticator
* [EclipseMC](https://eclipsemc.com/) - Supports Yubi/GA OTP

> **Comments:**
> **username_6**: Blockchain.info also supports "email 2-factor auth". You are sent a code to a predefined email address whenever you try to open your wallet.  
> **username_5**: Actually, to be extremely pedantic, blockchain.info does not support Yubikey, at least, not properly.  
> **username_4**: @username_5 would you care to elaborate?  
> **username_5**: I guess they changed it. They used to support mtgox keys by simply checking the key ID and not the actual OTP which defeated the whole point  

---

### Answer by username_1 on 2013-12-13. Score: 2

Disclaimer: I work for 2FA company CryptoPhoto

Google Authenticator does not save you from phishing or MitM/MitB or malware like NeverQuest, Hesperbot, Zeus, Ice IX, Bugat V2, Carberp, Citadel, Syscron, SpyEye, etc - or any APTs at all.

In addition:

1. Google Authenticator (GA) is not open source (only same antique version no longer in use ever got released)
2. They store their bypass codes in plaintext on the server (any serverside break-in grants the attacker full ability to authenticate as you)
3. Their bypass codes have insanely low entropy (7 numeric digits only - guessable in a mere 5 million attempts on average)
4. Their app provides QR code enrollment - and the QR codes are generated by putting your (supposed to be secret) private key into the HTTP GET parameter of a google-owned URL: or in other words - regardless of where you enroll with GA, they're sending your private keys to google.
5. "HTTP GET" parameters get stored in log files (granting access to your secret keys to anyone who can get the logs - such as by hacking, or legal subpoenas, or intercept)
6. The GA app uses a 3rd party QR code scanner to read your secret keys. This 3rd party tool is a supermarket barcode app, designed to send all scanned codes to their server. This is all "closed source", so it's impossible to tell if they're recording your secret keys. Even if they're not, the author (which is not Google, and not under their control) merely has to make an update to grab GA keys if he wants.
7. GA uses TOTP, which works with "shared secrets". This is a horrifying mistake. Again - anyone who can crack either end of the channel can forever impersonate the other end (read: a serverside breakin can own your client side auth). I am gobsmacked google were so stupid on this one. Asymmetric crypto was invented to stop that kind of problem - did they choose not to use it on purpose ?
8. In the limited source that's available, there is a race-condition error in their brute-force-prevention code: you're supposed to only be able to guess 3 codes, but if you open 2+ channels for guessing, only 1 of those channels gets blocked - all the other ones can keep on indefinitely guessing new codes without getting blocked.

And of course - to state the bleeding obvious - most of the exchanges that have already been looted were also "protected" by GA, with many of the victim operators publicly announcing that the hackers just bypassed it.

It's cool that GA costs nothing, but that's pretty much all it's worth!


---

### Answer by username_2 on 2013-02-01. Score: -1

They use 2 Factor ID at ZIGGAP which I found to be one of the best new exchanges out there.

> **Comments:**
> **username_3**: Hello and welcome to the StackExchange. Please keep your answers on topic - singing praises about Ziggapp is tangential to what is being asked. Please specify which two-factor authentication methods are available in the site mentioned.  
> **username_4**: Moreover, please link it.  
> **username_0**: ZIGGAP is now ZIGGONE, as in no longer serving customers.  

---

