2-factor authentication is mostly feel good.  Zeus is a good example of a trojan who knows how to get around 2-factor.

"I'm sorry, you entered the incorrect passcode."
<in the background it's logged in and is emptying your online wallet>

M

... or any browser plugin, or any other software on your PC, or github gets compromised, or ...

Did you know that Javascript lets you redefine the Number class such that every constant is always 42?
Things are not always what they seem, even if you use their code-audit plugin...

Armory supports true paper wallets.

Just because there's one method in which 2-factor authentication can be compromised, I wouldn't call it "mostly feel good".

Being able to break into your house and plant a trojan on your computer without you realizing it is much tougher than breaking in and just stealing your computer. Also, Coinbase doesn't require your 2FA code every time you log in, only when you make a withdrawal (or, if you'd prefer, only when you make a withdrawal over $100 in a day). If you're just sitting on, say, 20 BTC, or you don't withdraw more than $100 in a day, then you might not enter that 2FA code while the trojan is installed and undetected.

But yeah, it's a possible attack vector, which is why I said limiting the amount that can be withdrawn without 48-hours notice would be even safer.

My brokerage house is going to call me on the phone to verify things before I can make a $12,000 withdrawal from my IRA. No reason why online wallets can't do the same thing.

Breaking into one's house isn't necessary to compromise a computer.  Most computers can be compromised pretty easily *unless* the user takes surfing seriously and practices some basic security precautions (like don't use IE).

That's why I argue your PC is probably safer than an online bank.  Presumably most people here have at least someone of an idea how to keep their PC safe.

BTW, I agree on the limit per withdraw.  However... you can have a 1BTC limit per transaction, and then have to do 20 transactions.  Or the online system has an exploit that bypasses the limit.  As Steve Gibson says, Trust No One.  (TNO)

M

And you know that how?

M

Breaking into your house is trivial, but breaking into a house where there are 20BTC stored in an unencrypted wallet is pretty much astronomical odds..... there'd be less variance for the burgler breaking into 20 houses and stealing diamond rings.  As long as you're not advertising your real name and location in conjunction with your BTC address, I see no reason why this is something that one would reasonably fear.  (If you live in a high-crime area where break-ins commonly occur, and a computer is a likely candidate to be stolen just for its street value, you should make a copy of your encrypted private keys and put the copy somewhere safe, so if your computer is stolen then you will be able to recover them quickly and transfer the BTC to a new address.*) Whereas you can bet that there are literally hundreds of hackers (some intelligent, some not so much) trying to crack Coinbase, et al. on a daily basis.

*Actually, this is a good idea just for general security purposes, including protection against hardware failures.

You're less of a target.  Unless you advertise yourself... "hey, I do x, y, and z to protect my 100btc!"  and your facebook page is in your sig.



M

No, the people who have been "waiting a month" have not actually been "waiting a month".  They were last paid a month ago.  There is a difference.  Maybe they have a low hashrate.  Maybe they set their payout minimum to be very high.

The payout queue prioritizes people based on how recently they have been paid.  If you were last paid 24h ago, then anybody who was last paid 24h:01m or more ago, will be ahead of you in the queue.

So it is a bit of a trade-off.  If you set your payout threshold high enough that you will only be paid once a week, you will generally find yourself at the front of the queue when you hit your threshold.  If you set your threshold low enough that you expect to get paid daily, then you could easily find yourself at the bottom of the queue.  From my observations of the queue, I believe that most Eligius miners have set their threshold to be around once a day, given their hashrate.  

Of course, a good number of miners have a low hashrate, and therefore it could take weeks or even months to hit the minimum payout threshold.  These people won't be paid frequently, but when they hit their threshold, they will probably be paid in the next block mined.

That's why they store more than 98% of their funds offline in cold wallets. Even if the entire contents of all the hot wallets at Coinbase got emptied, customers would probably lose nothing.