Hacker News Reader

Usually they do the SIM swap first, use SMS to recover email, then use email+SMS to recover Coinbase. I agree that Coinbase could do more.

Like supporting TOTP?

Like forcing TOTP

The fact that Coinbase offers 2FA via an app is already potentially more secure than most US banks.

It would be far better if Coinbase defeated to TOTP for 2FA.