Topic: How to use 2-factor auth on mtgox, even without a smartphone - page 3. (Read 27435 times)
This
This type of professional documentation for account security should have been developed by all the high profile Bitcoin sites that use Google 2FA.
It's a statement about their professionalism that they don't take the time to do this.
Or use the google authenticator app on an offline computer.
the clock on an offline computer will vary over time, which will make your otp give a bad result. update the time manually if the otp is gives doesn't work.
So, bitcoins are now probably the most wanted target of hackers and trojan-botnet operators in search of easy profit. They are the most easily monetized score of digital theft, valued at face in BTC while credit card numbers are sold for pennies on the dollar.
Every time you download programs, or re-install windows using that iso you got a from a torrent, chances are ever greater that there is a trojan/virus. The chances are also good that it will go Fully UnDetected by most, if not all, Anti-Virus programs (botnet operators use a "FUD crypter" for this). If so, your mtgox password will be captured and added to the botnet database of login/password form submissions.
Then dude takes your mtgox funds.
A lot of that going on.
"MtGox account got cleared out"
- https://bitcointalksearch.org/topic/mtgox-account-got-cleared-out-85533
"All BTC disappeared from my Mt. Gox account"
- https://bitcointalksearch.org/topic/all-btc-disappeared-from-my-mt-gox-account-88368
Another:
- https://bitcointalksearch.org/topic/m.941759
And another:
"My mtgox account got compromised, what can I do?"
- https://bitcointalksearch.org/topic/my-mtgox-account-got-compromised-what-can-i-do-84585
And on other services as well. Here same thing happened to some GLBSE users:
- https://bitcointalksearch.org/topic/i-suspect-gpumax-was-compromised-and-passwords-stolen-84893
In none of these was the person using multi-factor authentication. Mt. Gox has had Yubikey support for a while. Mt. Gox accounts now support Google Authenticator:
- https://mtgox.com/press_release_20120605.html
But not you! Because you used 2-factor auth for withdrawals and dude only has your mtgox password, not your OTP private key.
Step 1:
Go to your mtgox security center and click "ADD NEW" under software authenticators.
Take a screenshot of this window, print it out, and lock it in a safe. Or copy/paste the secure private key and save it encrypted to a USB and lock that in a safe. Write it on a post-it, memorize it and then eat the post-it. Whatever you do, keep it secret but don't lose it.
Step 2:
If you have an android phone, install the google authenticator app for android. If you have an iOS device (iPod touch, iPad, iPhone), install the iOS app.
If you have neither, you can use this html5 google authenticator app. Download the zip file, extract it and open the index.html in your browser.
Now click the plus sign and add your secure private key. You are only running a local html5 app, so your secure private key is not being shared with anyone. You can even do this on an offline computer; you don't have to be online to use your secure private key to generate a one-time-passcode.
Step 3:
Use your generated one-time-passcode in the mtgox security center.
This passcode changes every 30 seconds. That's how long you have to type it into mtgox and "save" your new 2-factor auth system.
Step 4:
Add your new 2-factor method to "Withdrawal" to protect withdrawals.
Step 5:
Also add it to "Security Center". Otherwise, anyone with your login password can simply go to security center and remove your 2-factor auth protection.
Now a one-time-passcode is needed to remove 2-factor from withdrawals.
Step 6:
Your withdrawals are now protected.
CAVEAT on using the google authenticator html5 app:
Obviously, if you use your 2-factor "secure private key" on the same computer, it can be stolen along with the password. So pray that dude's trojan doesn't keylog everything, just login form passwords to sites like mtgox. Or use the google authenticator app on an offline computer. If you're ultra-paranoid, remember that your secure private key could be captured at set-up time when done on an insecure computer.
Also, the html5 app saves the secure private key to html5 localStorage, so click the (x) after use to remove it. Or clear it from the browser's cache/localStorage.
Every time you download programs, or re-install windows using that iso you got a from a torrent, chances are ever greater that there is a trojan/virus. The chances are also good that it will go Fully UnDetected by most, if not all, Anti-Virus programs (botnet operators use a "FUD crypter" for this). If so, your mtgox password will be captured and added to the botnet database of login/password form submissions.
Then dude takes your mtgox funds.
I lost roughly 2000 USD from my MT.Gox account at 08:40 JST on the 31th of may 2012.
A lot of that going on.
"MtGox account got cleared out"
- https://bitcointalksearch.org/topic/mtgox-account-got-cleared-out-85533
"All BTC disappeared from my Mt. Gox account"
- https://bitcointalksearch.org/topic/all-btc-disappeared-from-my-mt-gox-account-88368
Another:
- https://bitcointalksearch.org/topic/m.941759
And another:
"My mtgox account got compromised, what can I do?"
- https://bitcointalksearch.org/topic/my-mtgox-account-got-compromised-what-can-i-do-84585
And on other services as well. Here same thing happened to some GLBSE users:
- https://bitcointalksearch.org/topic/i-suspect-gpumax-was-compromised-and-passwords-stolen-84893
In none of these was the person using multi-factor authentication. Mt. Gox has had Yubikey support for a while. Mt. Gox accounts now support Google Authenticator:
- https://mtgox.com/press_release_20120605.html
But not you! Because you used 2-factor auth for withdrawals and dude only has your mtgox password, not your OTP private key.
Step 1:
Go to your mtgox security center and click "ADD NEW" under software authenticators.
Take a screenshot of this window, print it out, and lock it in a safe. Or copy/paste the secure private key and save it encrypted to a USB and lock that in a safe. Write it on a post-it, memorize it and then eat the post-it. Whatever you do, keep it secret but don't lose it.
Step 2:
If you have an android phone, install the google authenticator app for android. If you have an iOS device (iPod touch, iPad, iPhone), install the iOS app.
If you have neither, you can use this html5 google authenticator app. Download the zip file, extract it and open the index.html in your browser.
Now click the plus sign and add your secure private key. You are only running a local html5 app, so your secure private key is not being shared with anyone. You can even do this on an offline computer; you don't have to be online to use your secure private key to generate a one-time-passcode.
Step 3:
Use your generated one-time-passcode in the mtgox security center.
This passcode changes every 30 seconds. That's how long you have to type it into mtgox and "save" your new 2-factor auth system.
Step 4:
Add your new 2-factor method to "Withdrawal" to protect withdrawals.
Step 5:
Also add it to "Security Center". Otherwise, anyone with your login password can simply go to security center and remove your 2-factor auth protection.
Now a one-time-passcode is needed to remove 2-factor from withdrawals.
Step 6:
Your withdrawals are now protected.
CAVEAT on using the google authenticator html5 app:
Obviously, if you use your 2-factor "secure private key" on the same computer, it can be stolen along with the password. So pray that dude's trojan doesn't keylog everything, just login form passwords to sites like mtgox. Or use the google authenticator app on an offline computer. If you're ultra-paranoid, remember that your secure private key could be captured at set-up time when done on an insecure computer.
Also, the html5 app saves the secure private key to html5 localStorage, so click the (x) after use to remove it. Or clear it from the browser's cache/localStorage.
Jump to: