Pages:
Author

Topic: How to use 2-factor auth on mtgox, even without a smartphone (Read 27435 times)

hero member
Activity: 715
Merit: 500
Bitcoin Venezuela
is there a way to use 2 factor auth on your bitcoin wallet?

Electrum will have this option soon
newbie
Activity: 14
Merit: 0
Hello,

I've generated an OTP auth on mtgox, and noticed it's not possible to retrieve the qrcode or secret keys once you've set it up. Since I don't want to only keep this on my phone (which could break or be stolen), I generated another OTP. Do you know if it's possible then to delete the first OTP on mtgox, since it's no longer used? In the case I use it by mistake in the future, it won't be properly backed up.

member
Activity: 84
Merit: 10
really useful post op, should have been on goxes site Smiley
legendary
Activity: 2506
Merit: 1010
does this work for BTC-e ?

In June, BTC-E added two-factor authentication:
 - https://btc-e.com/profile#security/2fa

So yes, any TOTP client such as this browser-based one will work with BTC-E's two-factor auth.

List of exchanges with two-factor authentciation:
 - http://bitcoin.stackexchange.com/questions/4113
sr. member
Activity: 531
Merit: 260
Vires in Numeris
Great abc - thanks.

I'm surprised that two versions - one on computer offline html and one on phone, are providing different keys and yet they both work.

legendary
Activity: 1330
Merit: 1000
legendary
Activity: 1330
Merit: 1000

retarded question does this work for BTC-e ?
hero member
Activity: 640
Merit: 771
BTC⇆⚡⇄BTC
Congratulations and thanks for the well done tutorial.

Cheers!
legendary
Activity: 1630
Merit: 1000
Does anyone know a good program to do this.

I found http://www.toms-world.org/blog/google_authenticator which lets me use mulitple sites which is really nice, but mtgox wont work. The whole program crashes on me. I tried adding the six equal signs like stated to make it a base 32 or w.e. but it didnt work. Any advice is appreciated.
hero member
Activity: 826
Merit: 1000
°^°
I also found that the HTML5 app works in Opera Mobile, so I now have Google Auth on my Nokia (Symbian) phone!

OM is slooow on Symbian. try a J2ME TOTP implementation!
legendary
Activity: 2940
Merit: 1333
Here's the Python script that I use.  It's based on one I found on StackExchange, but adapted to take command-line arguments, and to do the secret padding correctly.

If you give it just one argument it gives you the TOTP code (which most sites use), and if you give it a 2nd argument, it gives you the HOTP code, which isn't time-based.  That's the kind that bitfloor used.

Code:
#!/usr/bin/env python
#
# calculate google authenticator codes
#
# usage:
#
#  for Time-based One-time Passwords (TOTP), supply just one argument: the secret
#
#  for HMAC-based One-Time Passwords (HOTP), supply two arguments: the secret, and the counter
#      the counter should go up by one each time you generate a password
#
import base64, hashlib, hmac, string, struct, sys, time

def get_hotp_token(secret, number):
    h = hmac.new(base64.b32decode(secret, True), struct.pack(">Q", number), hashlib.sha1).digest()
    o = ord(h[19]) & 15
    return (struct.unpack(">I", h[o:o+4])[0] & 0x7fffffff) % 1000000

def get_totp_token(secret):
    return get_hotp_token(secret, int(time.time())//30)

def usage():
    sys.stderr.write("Usage: %s [ number ]\n")
    sys.exit(1)

argc = len(sys.argv)
if argc < 2 or argc > 3:
    usage()

secret = sys.argv[1]
secret += '======='[:7-((len(secret)-1)%8)]

if argc < 3:
    print "%06d" % (get_totp_token(secret))
else:
    number = string.atoi(sys.argv[2])
    print "%06d" % (get_hotp_token(secret, number))

Always remember to put a space at the start of your command line when running it so it doesn't get into the bash history file.  Alternatively create an alias in your .bashrc file so you can run it without having to type the secret each time (but then of course your secret is in the .bashrc file in plain text).
legendary
Activity: 3472
Merit: 1724
In case anyone didn't know, the Google authenticator is not limited to Android, iOS and BlackBerry devices there are a few unofficial google authenticators that will work on Symbian devices (e.g. a lot of Nokia's older phones), I'm using this one: https://code.google.com/p/lwuitgauthj2me/ on my 5800XM.

What you can do is copy the "secret" that is shown (it's just a string), or print out the QR code, so you have a backup of it so that you can re-load the code to a new device if you happen to lose your existing device.    Since you can't re-display the secret you are already using, you'ld need to remove OTP then re-add it and save a copy of the new secret code.

Thanks for the tip Wink
I would just add: keep the key in a safe place e.g. on a separate memory stick.
member
Activity: 119
Merit: 10
bump for a valuable thread that could save people a lot of hassle and money.
hero member
Activity: 518
Merit: 500
Thanks for the help with this and I use it on Gox, Bistamp and CampBX now..can't hurt to have that added layer of security
legendary
Activity: 1855
Merit: 1016
Mtgox gave this thread link when i asked about 2FA.
But they didn't told anywhere what will do to login if phone lost.

Thanks Stephen Gornick for good trick/idea.
legendary
Activity: 2506
Merit: 1010
I just implemented 2-factor authentication in gox and a few pools. What happens if I lose the device with my google authenticator on it? 

Each E-Wallet vendor may have differing practices. 

With Mt. Gox, I believe you need to re-verify your identity (sending in a new copy of your ID).  They might ask some questions, like how much was your balance, the amount of your last deposit, etc.

Google has a method to move the Google auth OTP stuff from one phone to the next, but I'm not sure if that helps with lost phones.

What you can do is copy the "secret" that is shown (it's just a string), or print out the QR code, so you have a backup of it so that you can re-load the code to a new device if you happen to lose your existing device.    Since you can't re-display the secret you are already using, you'ld need to remove OTP then re-add it and save a copy of the new secret code.
sr. member
Activity: 434
Merit: 250
I just implemented 2-factor authentication in gox and a few pools. What happens if I lose the device with my google authenticator on it? 
sr. member
Activity: 378
Merit: 250
Born to chew bubble gum and kick ass
Hello,

Newbie here asking for help setting up 2 factor auth on mtgox using a smartphone. A kind soul is kindly asked to help. The present state:

1. I have an account at Mtgox and want to add Google Authentication service in Mtgox in Security Systems.

2. I bought an Android phone yesterday.

3. I downloaded Google Authenticator into my phone and get the following sentences / commands on the phone after starting this app:

First screen

With 2-step verification , whenever you sign in to your Google Account you will need:
1. Your password (non-clickable)
2. A code that this app will generate for you (non-clickable)

Begin setup (clickable command which I click and arrive at):

Second screen that shows:

Add an account (non-clickable):
___________________
Manually add an account (non-clickable)
Scan a barcode (clickable; Q1: Is barcode reading app built-in Google Authenticator so that I do not need to download any other additional application?)
Enter provided key (clickable; Q2: Should I type Mtgosx's ''Auth Name'' or ''Standard Private Key'' or ''Secure Private Key''?)

Q3: Are ''scan barcode'' and ''add an account'' interchangable, meaning that performing any of the two will result in a success or do I need to both scan the barcode and enter the key?
_______________________
Available Google accounts (non-clickable)
[email protected] (clickable; Q4: is it advisable to create a new Google Account or is it okay if I use the existing one?)

Q5: Do I need to reveal my Google Account or this option is only for Gmail?

Thank you.
full member
Activity: 133
Merit: 100
Or use the google authenticator app on an offline computer.

the clock on an offline computer will vary over time, which will make your otp give a bad result.  update the time manually if the otp is gives doesn't work.
hey, i used this setup to add OTP to my bitstamp account (any additional layer of security they offer? its kinda lame that i cant even receive an email if there is a withdrawal, only a deposit..) well back to my original point, i added the OTP before march, usually i was logged on 2-3 takes, now after DST it takes 10-15 takes for me to log in.. what am i doing wrong? it does not make sense to chance the computer time back to what it was before summer time.
legendary
Activity: 1330
Merit: 1000

ok cool guess its safe then, thanks
Pages:
Jump to: