Topic: MTGOX really is affecting me being able to feed my family (Read 4495 times)

Your habit of bumping old topics without adding much to the discussion is really annoying; please stop. Did you happen to notice the dates on the thread?

Yes you shouldn't invest money you need for food. Full stop.

Yeah.  I thought it was funny though.  I guess you needed 66 or more posts to get it.

Woosh!

Uhm... sha1("freeBFLSrofl!") = c23c4530a58dcb542c450bd411ca75ee8058f52a, so no.

Just cracked this hash from D&T: 030b02c46b7c238cb21ac04a7aadd1d937c5c2e2

Unhashed:  freeBFLSrofl!

Ass

Right!

Right click > View Source.  Hmm yup the javascript is hashing the password using SHA-1 function and the only data sent to the server is the SHA-1 hash.

Your point again?

By your logic nobody should use Bitcoin.  While the source code is open and available unless someone has read it themselves every single line they should never recommend Bitcoin to anyone else and even if they do recommend it they should only do so to people who are capable of reading the entire source code line by line.

Which is why Bitcoin is only used by Satoshi and 3 guys from MIT with masters degrees in computer science and cryptography.

Right?

Except most people will just enter their password there.
You can trust them all you want, but don't tell people to do it.

Yes.  Did you read the words in the screenshot you just provided?


For example here is a hash of my LinkedIn password.
http://www.leakedin.org/?check=04858397aa974628e2f20f62661034dfa7dcd233

Have fund spending the next thousand years trying to brute force it.

SHA-1 may be degraded but having the hash only doesn't really give you anything useful.

Hell here is a SHA-1 hash of my MtGox password ee5f21d188bb765b74c315cf4cda472e50f55c02
and here is SHA-1 hash of my BitcoinTalk password 030b02c46b7c238cb21ac04a7aadd1d937c5c2e2

Congrats you just collected 3 SHA-1 hashes.  That has got to be worth something.

Did you bother opening the homepage before trying to fix it?

FYPFY.

I doubt it.  It will just require Bitcoin "providers" (wallet developers, ewallets, exchanges, etc) to take security more serious.


A couple examples:
a) MtGox could check passwords against weak/known password list and exclude them
b) MtGox could require 2nd factor authentication for accounts over certain value (my broker does).
c) MtGox could implement a delay with notification (you get notification BEFORE the withdrawal occurs
d) MtGox could limit withdrawals to a specific list of whitelisted addresses.

In time hardware secured local wallets can make Bitcoin theft from local wallets much more difficult even if the wallet exists on a system which is infected with malware.



That will simply never happen.   Due to the nature of Bitcoin it is simply impossible to prove you didn't withdraw those coins to a new address.  No insurance company would offer a policy to cover that. 

Great password gathering website LOL

Well, I guess they won't be adding any LinkedIn connections either.  Or looking for love on eHarmoney:
Another 1.5 million passwords leaked
 - http://arstechnica.com/security/2012/06/eharmony-confirms-member-passwords-compromise/

Very interesting SG 

I'll never keep ANY money or coin at any exchange ever again because of this.I don't trust anyone in bitcoin any farther than I can throw them anymore....................

Those coins I lost were earned by mining,so I didn't lose any "out of pocket" cash at least.

This hacking crap WILL be the main thing that keeps bitcoin from going to the general population.Who besides software guru's & REAL puter nerds will understand how to secure either thier PC or logins to such an extreme level 

I'll still mine like crazy & reap those rewards,but as far letting any entity hold my earnings for any length of time,FORGET IT !!

Until there is a way to "backup" BTC like a bank does (reimburse for specific reasons),whether with insurance or something similar,BTC will be used mainly by launderers & drug dealers (Silk Road)................

Well, let's see after this LinkedIn security breach if anything changes.  3.4 million passwords have been cracked so far, though if the perpetrator has the corresponding e-mail addresses that hasn't been leaked yet.  But anyone in the list of 6 million with a password of 8 characters or less in length has probably had their LinkedIn password cracked by now, or will have before long.  At some point this will force "extremes of security" such as strong password requirements.



Incidentally, Capri200 either wasn't used or hasn't been cracked yet.
 - http://www.leakedin.org/?check=3d9ad3d4e34f82f0b0fd29de989d51acb737c1e8

He has a point there.  That's why (in the U.S.) when the banks have losses from identity theft they find it cheaper to either pass along the cost when they can (reverse transactions) or eat the remaining loss when they can't.  That's cheaper than the cost of customer training and lost customer satisfaction when trying to impose security procedures like a Yubikey, for instance.

I don't know the solution.  Now that there is Google authenticator on Mt. Gox, hopefully more people can secure their accounts.  Right now it seems the password crackers are just shooting fish in the Mt. Gox barrel.

  NP

I just want to figure out WHY this is happening Yes my PW might have been easy to break 

The answer can't be using yubikey(if you lose it,you lose anyhow) or lastpass or whatever.If everyone has to be that secure minded then BTC will NEVER go mainstream.80% of the american public (me included) is dumber than box of rocks & will never accept those extremes of security,on a personal level.There has to be a better way.............I know of 3 people that have been hacked on MTgox in the last week,not to mention how many have not been reported here on the forum.........Something is up & hope this community can help find it out.......

Thanks for the answers. The simple answer is that that is an extremely easy password that any dictionary cracking system would have found quickly. You may be interested in LastPass to generate secure passwords that are per-site and store them for you. However, LastPass is only as strong as your master password, unless you use it with a yubikey.

Personally,I'll only use MTgox for "at the moment trades",if I ever use them again,I'll never leave any coins or money in there again & I recommend everyone to do the same.

I was trading my cash for coins & vise versa,I made 15 BTC in 6 weeks this way,buy low sell high.I thought thier site was secure.I have an IT network guy coming over to scan my PC today,I'll let you guys know what we find.

Root cause detected (most likely):
 - https://passfault.appspot.com/password_strength.html#menu

Would be nice if Mt. Gox (and other exchanges) would warn if a weak password is entered.
 - http://en.wikipedia.org/wiki/Password_strength

Use secure passwords, and use KeePass or LastPass:
 - http://superuser.com/questions/432844/how-do-i-securely-store-and-manage-180-passwords

Well, that comment was describing how two factor authentication (which Mt. Gox offered first with Yubikey, and as of a few hours ago now supports Google Authenticator as well) is needed for using Mt. Gox, especially on Windows, but really all platforms, to be protected from these password-only thefts.

For a local wallet / BTC client there's no concept of two factor, and thus there needs to be a level of security appropriate for the risk.  For larger amounts, there's a secure method -- an air gapped system used for transacting.  When M of N transactions are implemented, that will help to lessen the risk of theft as well.

For now, what you have is probably much more secure than what most do, but it still is vulnerable if your host is compromised, say from a 0-day.  Or let's say some thieving software engineer at ATI slipped in a wallet stealer into their GPU driver binaries.  We'ld probably never know until after the wallets are gone.  (Your VM image probably wouldn't run the ATI binary driver so you'ld probably be safe from that specific vulnerability.)

Never used TOR
Never been part of a VPN
Private home network behind a router with firewall & AV installed (Avast),but use other AV's when necessary.
Never click on any emails from any one I don't know personally.

My old PW was Capri200,kinda simple but I won't forget it.I'm not a software guru or crypto phreak.No I did not use that PW anywhere else ever.

I use Win 7 64 bit.I have been building PC's for 12 years,so I'm not new to the PC enviroment,just a little naive I guess.I know all about phising emails & never click any links in emails or websites without thinking,if I need to do so I use a spare PC that I can "sacrifice" by reinstalling (I have 4 PC's in my room for gaming & surfing).

My situation is exactly like this one:

https://bitcointalksearch.org/topic/my-mtgox-account-got-compromised-what-can-i-do-84585

I would've posted there,but I didn't browse the threads far enough

Why are you using MtGox if you need to be able to withdraw on a timely basis?

Have you done ANY research on these companies? MtGox is notoriously slow with notoriously crappy customer service. The folks at Dwolla are confirmed scammer douchebags who change their TOS to rip people off.

The solution is to stop using MTGox.  Their constant lies about funding times and delay after delay is indicative of a larger problem that they are not admitting to (insolvency, outright fraud, using funds interest free?  Who knows).  But the fact is, they continually lie about what is going on and the "reason" why they somehow can't complete requests. 

They are a, in a nutshell, incredibly dishonest and people need to stop using them.  Find another exchange.

How do you go about two factor authentication, when using a local wallet / BTC client?

Personally I use an encrypted wallet, and run a client inside a VM which is on an encrypted truecrypt container which I only mount to run bitcoin. Still, everything occurs at my computer locally. Do you have something else in mind when you advocate two factor authentication?

I would like answers to my questions about network security. It seems that the recent claims of compromise are made by those that don't want to discuss whether their network is secure.

I want to know:
Have you used or are you using Tor?
Have you used or are you using a VPN?
Are you on a corporate network?
(And further to the above, has your company admin installed a company trusted root certificate on your box)
Have you ever clicked a link to mtgox in an email?

Also, since your password is unique for all sites, I'm sure you will have no problem sharing it with us for analysis since we can assume it has been compromised.

There's no point posting here asking for help if we can't have the information to help you.

But you are not. You can't buy an anti-stupidity software, you know?

Stop clicking links to phishing sites inside phishing emails.

One thing I have asked for in the past and never gotten a response from MtGox on is a IRREVOCABLE DELAY TIMER.
Make it optional but it could add security and prevent thefts like this.  Pretty simple concept.

User sets a irrevocable waiting period of sending coins.  
User understands when setting it that it can't be removed without waiting the same amount of time (i.e. if you remove a 60 min waiting period it takes 60 minutes before it is removed).

So it works like this:
1) Attack attempts to send coins.
2) MtGox accepts the requests and delays it x minutes (preset by user).
3) MtGox sends email (and SMS it is 2012) to user with amount of coins, address, and a CANCEL THIS IS FRAUD link.
4) If user clicks cancel link it DOESN'T require a password (as attacker may have changed it), the tx is canceled and account frozen
5) If tx is legit delay timer expires and funds are sent.

It allows users to set the level of security they want.  Users who want ability to instantly send coins can use default 0 min delay timer.  Cautious users could use a delay timer of 30 min.  Ultra paranoid could use a delay time of 240 min.  Combined with email and SMS notifications it becomes very difficult for an attacker to transfer coins off site.

Now using the same process the user could WHITE LIST certain addresses which don't need to be delayed.  Obviously adding an address to the whitelist requires the delay (as would changing email or SMS phone #).  User gets emails (w/ fraud link) for adding a whitelisted addess, changing delay timer, removing delay period, changing email/phone, and sending coins.


Maybe I should trademark the term "warm wallet" (i.e. it isn't a "hot wallet" or "cold wallet" but a "warm wallet")?

No I meant Windows.  I'm guessing it was Windows, and wanted a good opportunity to explain how one running Windows cannot make the statement "my PC is very secure".  And to recommend how anyone, particularly someone running Windows, with more than pocket change worth of funds on their exchange should be using two factor authentication.

I assume you mean: which version of Linux?

He said it's very secure, so obviously he's not running Mac OS X or Windows.

Which version of Windows are you running?

That sucks man I assume you changed your password in the mean time?

Did you *ever* use the previous password (the one that was comprimised) on any other website or service or phone or anything?

Was it an easy to guess or bruteforce password? Or rather, if you're sure you're not using that password any longer (which you shouldn't), what was it? Just curious, cause some people really seem to have a twisted ideas about the strength of their password.

Well,I lost $200,somehow my account was hacked (no password changed,I was able to login) & they bought coins with my cash & away they went.MTgox returned my email & said tough titties.

Thank you for your inquiry. We would recommend you to change your password as soon as possible. Unfortunately, bitcoin transactions are irreversible and we can not refund any amount of the stolen funds. As a business if Mt.Gox were to offer you a cash or bitcoin refund in compensation of this extremely unfortunate event, there would be a large increase in the number of hacking attempts to capitalize upon the possibility of financial reward.

As a further remedy, if you wish to retrieve your funds, we ask that you file a police report for the stolen goods. It is preferable for the police to inspect your computer, but not necessary. Once this investigation has occurred and a copy of the police report issued, please send a copy of it along with a notarized copy of your passport or Government issued photo ID to Mt.Gox and have the police contact us so that we can cooperate with their investigation by providing any requested information.

Please let us know how you wish to proceed, and again we apologize for the frustration and inconvenience caused.


Once the bitcoins are sent out, we are unable to retrieve them unless it is an Mt.Gox address and the address where your bitcoins were withdrawn to does not appear to be an Mt.Gox address and therefore, we are unable to get them back for you. Our apologies for the inconvenience caused and please let us know if you would require any further assistance regarding this matter.

So word to the wise: DO NOT keep a large amount of coins in your account.

I'll be using another exchange.

P.S. my PC is very secure.

Thank you so much team MTGOX for coming through thank you so much

You and many people yesterday has been "Cleared", we are continuing to push things forward.

We know that the situation is not ideal lately for some of our users, and I can't stress enough that it only affect a limited number of users, we are working like hell to fix this so please bear with us on this one.

Regards

My transaction went from preparing to confirmed! Thank you mTgox.
It's not at Dwolla yet though.

Thank you MTGOX support. I gave you my MTGOX username and right away you started to process some my dwolla withdraws after reading this thread. I can't explain to you how much this means to me that you are addressing this so quickly. This will help me extremely and wire bank wire transfers I'm sure will be done soon also.
dirtydiego
MTGOX AML verified member

Thank you very much for the info Stephen! I know I'm stupid for not learning from the first times I started noticing a problem not to invest but I guess I trust MTGOX will help speed up the process.  I have very much so enjoyed working with MTGOX as they have been wonderful this past few years. I never had a problem up until about a month and a half ago. I really don't want to switch ex-changers as they have always done me right. I shouldn't have started this thread to complain about an issues I know they are having right now. I apologize  to MTGOX and others who have read this thread as this is my second time complaining about this. Last time was because I had over 15k held up in withdraws for over three weeks but sure enough they did come through about 2-3 weeks later. Thanks to everyone for the advice, even if some of it was a little harsh but I understand why you would say these things. MTGOX did come through with 1 dwolla withdraw since this post which will help me a lot. This time I will learn not to invest in BTC if I can't handle the wait as I hate that I took a big risk to make money in BTC but this stupid risk I took has affected my family and really in hindsight I can't blame MTGOX as they have not robbed me or anyone that I know of. They made me aware of what was going on with the delays from the start and I just thought the delays would have been resolved by now as it states on their support page that they have been but it still has continued. I also realized that they are the biggest ex-changers and well I can imagine they are growing everyday with work and well this must also be an issue for them. Tangible Cryptography I PM'ed you and I really appreciate your very kind offer. I Really can't express to you how much in means to me. So again sorry if in the last month and a half I have a started a few threads about my issue. I'm sure you guys are sick of hearing about it but it was done out of desperation. But now I learned my lesson thanks to everyone in this thread that weighed in. 

You are right that smart people learn from others mistakes, but stupid people do NOT learn from their own mistakes and keep repeating them.  Making a mistake once then actually learning from it is not so bad... 


I also agree with what you are saying, but now as the bitcoin economy advances not all gox users are 'investors'.  While I use gox a whole lot less now (not at all since the Dwolla TOS change), people are even having problems simply depositing BTC, selling right away, then moving to Dwolla then back to their bank account. 

There are now plenty of users who sell items for BTC and need to change some of them back to USD for more goods (leaving the profit in BTC like me).  And they need a site like gox to be reliable and fast for business to work.  For me gox used to be fast, but the last cycle the BTC > GOXUSD > Dwolla > Bank account process took two weeks.  While I do not rely on this income to feed my family I can certainly see it being a problem.  I do not leave a balance with gox. 

FYI, Mt. Gox has offered to cancel Dwolla withdrawal requests if it hasn't gone through.

The places where Dwolla cash out / withdrawals are possible:

Mt. Gox
Intersango
Camp BX
#Bitcoin-OTC marketplace - http://bitcoin-otc.com/vieworderbook.php
and now
Tangible Cryptography - https://bitcointalksearch.org/topic/fastcash4bitcoins-update-fastcash4bitcoinscom-is-now-live-85395

of those, only Mt. Gox has the problem with 6+ day delays.

5%?  that's highway robbery.  2% for Dwolla, 3% for Paypal.  Just PM me.  You can have your funds within minutes.

More info here:
https://bitcointalksearch.org/topic/fastcash4bitcoins-update-fastcash4bitcoinscom-is-now-live-85395

Hey thanks for the offer! That would be awesome! I would give you up to 5% if you would trade for $200 worth of MTGOXUSD. Thank you soooooo much for the offer!

Yes I do but I haven't heard back from you guys yet. My MTGOX name is the same as this one. Thank you for posting and trying to help 

I'm sorry if I'm repeating. I trust MTGOX as I have done plenty of business with them before. I just made a bad decision and I guess need to own up too it for taking so long.

+1 I guess people will only realize this once they actually get in trouble.

Remember: Stupid people learn from their mistakes. Smart people learn from other people's mistakes.

Oh and regardless of whether Mt.Gox is trustworthy or not (I think they are), you should simply NOT put large amounts of money (either in USD or BTC) on a website. This is probably not related to TS's problem but I thought I'd mention it anyway. Put money in, buy bitcoins, transfer bitcoins to your wallet. Now it's safe.

I partly agree with you but if he is running a business that is solely turning profit for him via bitcoins being exchanged back to his local currency then surely you cant judge the man for having to use an exchange. Also perhaps he tried other exchanges but they were even worse with withdrawals and so he remained at mtgox.

Whatever the problem may be there is good chance he lives month to month from his bitcoins related business or mining thus having to exchange it and withdraw in a timely manner doesnt seem unrealistic to me, even if it is his living funds.

Dirty Diego I would hate for your family to not be able to eat.

I am willing to trade up to $200 Dwolla and/or $700 Paypal for MtGoxUSD or BTC so you can get funds quickly.

2% fee on Dwolla: (To Me: $102 MtGox , To You: $100 Dwolla)
3% fee on Paypal: (To Me: $103 MtGox , To You: $100 Paypal)

Tangible Cryptography "because you can't eat a Bitcoin"

+1, seriously.

TL;DR, as always, NEVER INVEST MORE THAN YOU CAN AFFORD TO LOSE.

Why do I have to keep repeating that every so often.

Hi Dirtydiego.

I am sorry to hear about your problem, do you have any open tickets?

Why on earth would anyone put money needed for living expenses in an exchange?  They can be hacked, their bank and other accounts can be frozen without notice, their databases can be lost, the owners night run off with everyone's money.  It's been said many times before -don't invest money you can't afford to lose or to which you need immediate access in the exchanges.

Their withdraw problems from wire transfers to Dwolla delays is just too much now. Why is it that I have to complain here bout them for them to do anything about my delays? As soon as I do it's like they do me a small favor and clear a little of the lot of money I have withdrawn but still has not shown up in my accounts. I'm fully verified with them and was thinking about becoming a trusted member but it just seems like it's not worth it. I used to have a great relationship with them as they used to be the best at Customer support and quickness of withdrawing but it's gone down hill the last two months and now I find myself with investments in BTC with MTGOX that I'm not getting my paid and not being able to support my family because of the amount of money they have held up of mine. Something needs to be done about this. Please magicaltux or anyone from MTGOX tell us the truth of what's going on.