2FA feature is needed, ASAP, for all transactions and account recovery

As a recent victim of the MyAlgo hack who lost funds due to an unauthorized transaction, I suggest some additional security be added to Pera wallet.

My understanding of the mechanics of all this is limited, so just bear with me as I suggest a possible solution to a technical problem without knowing the level of implementation difficulty. Many applications require a second form of authentication beyond “something you know” - the nature of 2FA is to require “something you know” as well as “something you have” - for example, a physical RSA token, or a physical ledger device that must be used to secure each and every transaction, whether that is a login attempt, an account recovery, or whatever.

The simplest form of this is to require a rotating code be sent to a specific device or endpoint - either an SMS text to a mobile phone, or an email with a key sent to a linked email account. I prefer using SMS to a mobile device, because an email address is I think at least theoretically just as easy to compromise as the recovery passphrase of a wallet, but let’s ignore that for now.

What would it take to add a feature to Pera that would require a rotating key challenge for every transaction - login, account recovery, account creation, and sending (but maybe not receiving). If an account is created in Pera, then it seems that the application should be able to enable a 2FA feature that would send a rotating key to an SMS or email endpoint, and require that key to match to proceed with any transaction. This is an optional feature on many financial or otherwise secured applications. Particularly for a cryptocurrency environment, where there is no “FDIC” or fraud protection at all, as you would get with a bank account or a credit card, surely there must be an optional additional layer of security that requires something you have to allow any given transaction to proceed.

If this would require a smart contract to be enabled for every single transaction with 2FA so enabled, or if it could be implemented purely as a feature within the Pera wallet itself, I’m not sure - but one way or another, this needs to be thought through and implemented as a response to the MyAlgo hack.

If 2FA were required, then these unauthorized transactions could have been initiated, but they would not have proceeded, unless the threat actors were also able to somehow obtain access to the linked 2FA email account or SMS text number. I’m sure that could be done one way or another, but it would be at least twice as difficult, and potentially orders of magnitude more difficult to do at the scale we have witnessed. A handful of unprotected accounts would still have been affected, but it is unlikely that ANY 2FA protected account would have been affected, because the attack vector exposed (obviously) the unsecured recovery passphrase of accounts that had been linked to an irresponsible third party - but that would not have exposed the 2FA email address required to authenticate a transaction, or if it had, it almost certainly would not have exposed the password to that account, which is required to access the rotating pin.

A sophisticated implementation would allow email or text/SMS auth, or an authenticator app such as Google or Microsoft Authenticator, which could then be enabled to require either the rotating key value, or biometric validation (face ID, etc), in order for transactions of any kind to proceed.

Please criticize this suggestion freely with technical “gotchas”, but then consider at a higher level that something like this needs to be implemented regardless of the technical difficulty - again, even if it requires an additional smart contract or other paid service in order to facilitate the 2FA feature, it really is critical that Pera do something to address the blatant vunlerability of a simple “passphrase hack” in the future.

Just my 0.02.


the main issue is the storage where you store your private key… i believe it is technically not possible to implement this storage to be two factor authentication.

first of all, you should store your private keys at hardware devices dedicated for this purpose. Ledger device is one of these devices.

If you run a business not even ledger device might help you, as there is for example 3 directors in your company, and if the only person is selected to sign transactions there is always risk that he run away with the money.

therefore for corporations there is only one solution… multisig account, ideally with all signatures to be required by the hardware device.

So, 2FA feature is needed for who? What does it solve? How are the private key stored?

Lets assume now that you have 2 factor authorization in myAlgo, and myAlgo is hosted at GoDaddy. Because of bug at goDaddy another customer may write to their website anything he wants.

When you come to myAlgo, hacker will ask you one password (google authentication code), then he ask you password to decode the secure storage, then he send the mnemonic to his server, and performs the operation for you. 2FA nor 3FA would not save you as user passed all security measures on attacker’s web.

2FA may save you in the case that you sleep with some girl over night and she puts your finger to your mobile to unlock it and to transfer funds somewhere. Google authentication on the same device will not help you in this case as well…

What may help you is to setup 3 accounts, and use multisig. Keep one at home, put one to one mobile, put second on second mobile, and with threshold 2 you can make transactions.

But if someone would have an idea how to convert fingerprint or face into the password, perhaps the data storage might be encrypted with this password, and later with other password. Perhaps there is some solution, but as far as i know the fingerprints or faces can change so the mechanisms works with some fault tollerancy thus every try is little different.

As @scholtz , 2FA right now does not really give you a secret key (apart maybe if you use WebAuthn, which could be an option). In that case, you would rely on a server having an actual secret key that would sign transactions only if validated by 2FA.

Then the account would be a multisig or logicsig account.
One solution being a 2-out-of-3 multisig where the user writes down 2 mnemonics on paper, the software wallet has one of those two mnemonic/secret keys, and the extra server has the last sub-key.
For normal operations, you would use the software wallet self-custodied subkey and the server subkey.
The server only approves transactions after 2FA.

But if the server goes down, you would still be able to use your 2 paper subkeys.
So the system is still fully self-custodied. The extra server provides convenience.

But as @scholtz mentioned, this only increases security if the software wallet infrastructure is properly separated from the extra server, ideally run by two different teams or even two different companies. If it’s run on the same AWS VM with the same credentials, I have a hard time believing it would really help: a break-in in the server already allows to do the full attack.

That being said, if properly implemented and secured, I think it could be good for individuals.
Companies would still need more advanced key management.

A two-key multisig, installed on two different applications (e.g., Pera and Defly) on two different phones is for all intents and purposes a 2FA


A simple PIN code to verify your transactions before they complete would be my ask. Just like with a normal bank. Definitely something which needs adding though.

Why not simply buy a cold wallet and sync your Pera with one, like Ledger? That way, ALL txs will require authorisation via something only you have, and your seed phrase is securely stored and out of reach on your Ledger device (or whichever cold storage of your choosing).

@Porter @scholtz Yes, PIN code verification (or usage of Google authenticator for that matter) could be done.

Scenario: 2 of 3 multisig account.
Key usage: key1 is stored in a safe place by the user, key2 is in the wallet of the user,
key3 is stored by a 3rd party. When you register on the 3rd party’s web site, the third party asks your mobile number, and then uses it for 2FA: before signing the tx, sends to your telephone a PIN. If you enter this PIN into the 3rd party’s web wallet,the txn is signed by the 3rd party, too, and sent.
Variation of the theme: the 3rd party sends you a Google Authenticator code, and you use it on the web site as 2FA.

@scholtz Let’s make such a system (together :-)). It is essential part of the infrastructure.
See also: ETH social security wallets.

1 Like

Don’t forget that blockchain is a decentralized technology and that wallets access it in a decentralized way.

Entrusting the consent of a transaction to a third party reduces decentralization and exposes the wallet owner to control over his activity.

And if the third part closes ? or fails ? or for any reason does not sign the transaction?

Security protection is a personal matter, if 2FA is not mandatory then I’m ok with it.

1 Like

if you want a third party to be in control of your money, use an Exchange. The Algorand protocol has everything you need to handle multiple authentication factors without losing decentralization, plus there are hardware wallets like Ledger, which have a second factor (the physical button)

1 Like

@beaconet You have complete control of your account, as you have 2 out of the 3 keys. The 3rd party only makes tx signing much easyer.

@mmorselli The third party would not control your money, as it has only one key of out of the 3, and for signing a tx 2 would be required.

@Maugli However, you share information with a third party. It also complicates the user experience.

Unfortunately there is no definitive solution, there will always be a weakness.

Security and usability are inversely proportional.

@beaconet No, there is no definitive solution, but we could do definitely better than now.
Imagine that your salary is sent to an Algorand account in USDc and then simply stolen…

@Maugli Yea,but there are currently many protection systems on Algorand.

I’m just wondering what it is that a cold wallet does that Pera couldn’t do in software, with the appropriate applications on your phone. Just like I used to have an RSA physical token to access my work VPN and remote connect, now I simply use a software “fob” instead. The cold wallet can get lost or broken. There is no “backup”. If my child spills some water on it, then it is roasted along with any funds I have therein. Well implemented computer systems have durability, redundancy, and security. I specifically do not want to depend in any way on a hardware “wallet”.

No corporation on earth would use a hardware wallet that can be lost, damaged, dropped, slip out of someone’s pocket, accidentally fall into a pool, pond, hot tub, the ocean, or otherwise be lost. When you ask “2FA feature is needed for who?” - the answer is - everyone. Literally, every single person who uses cryptocurrency for any financial transaction should be pushing to figure out how to implement software 2FA on the wallets and their transactions. The recovery passphrase is not enough, because it is too easy to compromise, and provides absolute control over the funds. If this problem isn’t solved, then every time a widespread scam like MyAlgo happens, we will watch as the number of users who trust the system withers away.


I have created first simple attempt: https://2famsig.k8s.aramid.finance/swagger/index.html

The serever can be configured with mnemonic…

User can load the server account https://2famsig.k8s.aramid.finance/Multisig/GetAccount
and use it in his msig

User can setup 2FA by calling Multisig/SetupGoogleAuthenticator

When he loads it to his Auth app, he can get the PIN.

Which he can use in methods




Docker image: https://hub.docker.com/r/scholtz2/algorand-2fa-multisig/tags

1 Like

I see there 3 issues now…

  1. Every user is using same account in his multisig account (i did not have time to solve long term storage of mnemonics per user)

  2. There is DDOS / BruteForce volunabirity … i guess the 1 million pins can be tried within 10 seconds

  3. Multisig is not supprted/tested by latest C# Algorand Nuget GitHub - FrankSzendzielarz/dotnet-algorand-sdk: Algorand SDK for .Net Framework to interact with the Algorand network @FrankS … Do you want to cooperate on this? :slight_smile:

1 Like

I have updated the code a bit now…

Issue # 1 and # 2 is solved by adding the ARC14 authentication, and calculating the Account seed from the hash of the authenticated address and internal password.

1 Like

If it’s a true 2FA, the third party has the power to freeze your money. This is too much power in a system that is supposed to be decentralized

If you mean Ledger, you can derive the mnemonic (25 words) ALGORAND of each account from the seed (24 words). It takes less than 10 lines of code. Losing the wallet and being unable to get a new one doesn’t mean losing your funds, just those addresses will be “burned,” because they will become normal hot addresses

1 Like