The advantages of the current system are:
- Every user is forced to use it when withdrawing. From my experience most people don't use 2FA if it's an opt-in.
- It is easy to understand and you don't need (smart)phones, a Google Account or whatever.
- You can login and trade on insecure systems without risking that someone can withdraw everything a few minutes later.
- After 3 failed attempts to withdraw the account gets locked for one day and triggers an email notification.
- Lost Master Keys can be resetted (but with a waiting period, email notifications and a big warning message when you log in).
- An attacker cannot withdraw Bitcoins if he manages to steal a session.
Downsides are:
- If an attacker has access to the email account, 1Broker account and the user does not log in during the waiting period the 2FA mechanism fails. (Could be solved by increasing the waiting period)
- Lazy users may store their Master Key at insecure places.
The current system is not set in stone however. I'm always open for changes and ideas are welcome. IMHO it's currently more secure than an opt-in GAuth. (for the average user)
(Miracea is a male name I guess). And MPOE-PR is another person? However, this is really offtopic now.
