Many people have proposed a optional user defined waiting period.
I mean MtGox notifies you by email when a transaction occurs but if you account is compromised what good does that do.
Attacker attempts to make withdrawal.
User gets email w/ link to cancel to withdrawal.
User cancels. No funds lost and Mt.Gox gets early notification of a potential attack.
Withdrawal & Cancel loop on large number of accounts may indicating a more serious vulnerability.
Even if attacker changes password by having an cancel link in email prevents attacker from locking user out. Changing email and changing "withdrawal delay" could be on a 24 hour delay.
Yeah, I would like to see more security on Mt Gox based around email approval. There could be three options:
1) Require all withdrawals to get approval via email.
2) Require withdrawals to new locations (BTC address, Dwolla account, etc.) to get approval via email.
3) No approval needed (this would not be default, and would only be recommended for people with two-factor authentication).
Also, I love the Google based two-factor authentication that Bitcoinica uses. Much more appealing than a $30 Yubikey. If Mt Gox gave me the option to use Google Authenticator, I would enable that in a heartbeat.
