Hacker News Reader

Comment by kerng | Hacker News Reader

crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it.

But basically in this case, you didn't even need a password to log back in, it was just an email to click a link, then FaceId/PIN and logged in and prompt to re-add 2fa. The app must store the password itself somehow and auto use it.

Anyone know how the do auth on the app?

For users in the US there is no way to change the password, because the webapp (which might have that feature) is not allowed to be used from US.

Once I asked how to change password and support said I can change the PIN on phone and dont worry your funds are safe.

View on HN

> crypto.com is a little mysterious when it comes to authentication honestly. I still have not understood it.

If you're speaking from experience as a user of their service, I strongly suggest that you use a different exchange. Gemini + Coinbase both have very easy-to-understand authentication systems. If you don't understand the authentication system, that's a good red-flag that you should take as a reason to move to a more trustable platform.

(Just my two cents, as someone who works on authentication system architecture design.)

Agreed. As someone who has integrated with dozens of crypto bank APIs, I can tell you Gemini's authentication and security is top notch (second only to Fireblocks)

Good point. Overall the user experience of crypto.com is really nice though.

I mean the app is tons better then Coinbase and I think a big reason that crypto.com is growing tremendously. Users like it.

From my experience as a user, you don't have a password. They log you in via an email link, you have a PIN, and you have 2FA.

> it was just an email to click a link,

An e-mail with a link to actually click? Does anyone else see those flashing red lights and hear that alarm klaxon? Please do me a favor and drop those assholes like a bad habit. They are going to cost you whatever assets of yours they have in their control.

The fight to teach users to not click links in emails had been lost, IME. And if forgot passwords can be resolved via an emailed one-time secret then email is effectively a skeleton key anyway.

Do they use something like this? I've never used crypto.com

https://magic.link/

Reply on news.ycombinator.com