MtGox UPDATE - page 3. | Bitcointalksearch.org

joepie91

sr. member

Activity: 294

Merit: 250

Quote from: Bit_Happy on June 19, 2011, 05:33:39 PM

Quote from: joepie91 on June 19, 2011, 04:59:05 PM

Quote from: Bit_Happy on June 19, 2011, 04:51:26 PM

Quote from: joepie91 on June 19, 2011, 04:47:11 PM

And what about the users who had their accounts compromised in the past few weeks or so?

Many were trolls who lied, IMO.
A password hash does not allow you to login. The mysterious big account might have had a virus/key-logger on his PC.

I have had $200 vanish from my account. I have turned my PC upside down, including manual analysis and found no malware of any kind. I had a 20 character alphanumeric mixed case KeePass-generated random password. I was not a victim of the CSRF exploit as I could not reach the Mt. Gox site (thus wasn't logged in) at the moment the funds were stolen. Someone could easily break such a password by using a service like Amazon AWS - and it would actually pay off as you are trying to compromise accounts on a financial service that holds money. Not to mention that miners have hardware that is specifically suited for hashcracking.

Now tell me with a straight face that this was not related to the database leak.

Maybe I was mistaken, and sorry about your loss of money.
I wish I knew you in the real world, so then I'd know for certain your story is true.

I'm fairly easy to verify as being a real person. Google knows all etc.

Synaptic

member

Activity: 84

Merit: 10

Quote from: cypherdoc on June 19, 2011, 05:33:43 PM

Everyone's bitcoins are safe on the site. We still are holding all the coins safely in reserve. The vast majority of the coins are stored offline so they are impossible to compromise.

...and they've delivered on everything they've promised.

Except y'know, providing a secure exchange for BTC while holding 90%+ of the entire BTC market...

...yeah. How cute.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Everyone's bitcoins are safe on the site. We still are holding all the coins safely in reserve. The vast majority of the coins are stored offline so they are impossible to compromise.

if this is what they say about whats happening, i guarantee its the truth.

i've dealt with these guys extensively in the past several months and they've delivered on everything they've promised. be calm, everything's under control.

Bit_Happy

legendary

Activity: 2114

Merit: 1040

A Great Time to Start Something!

Quote from: joepie91 on June 19, 2011, 04:59:05 PM

Quote from: Bit_Happy on June 19, 2011, 04:51:26 PM

Quote from: joepie91 on June 19, 2011, 04:47:11 PM

And what about the users who had their accounts compromised in the past few weeks or so?

Many were trolls who lied, IMO.
A password hash does not allow you to login. The mysterious big account might have had a virus/key-logger on his PC.

I have had $200 vanish from my account. I have turned my PC upside down, including manual analysis and found no malware of any kind. I had a 20 character alphanumeric mixed case KeePass-generated random password. I was not a victim of the CSRF exploit as I could not reach the Mt. Gox site (thus wasn't logged in) at the moment the funds were stolen. Someone could easily break such a password by using a service like Amazon AWS - and it would actually pay off as you are trying to compromise accounts on a financial service that holds money. Not to mention that miners have hardware that is specifically suited for hashcracking.

Now tell me with a straight face that this was not related to the database leak.

Maybe I was mistaken, and sorry about your loss of money.
I wish I knew you in the real world, so then I'd know for certain your story is true.

Gandlaf

newbie

Activity: 59

Merit: 0

Quote from: jed on June 19, 2011, 04:10:29 PM

Everyone's bitcoins are safe on the site. We still are holding all the coins safely in reserve. The vast majority of the coins are stored offline so they are impossible to compromise.

If this was the first time difficulties of this kind had appeared with MtGox, I would be inclined to believe it, but arbitrarily freezing accounts or rolling back transactions seems to be the modus operandi for MtGox.

http://forum.bitcoin.org/index.php?topic=3712.680 (Essentially MtGox freezes 45000 USD over a dispute of the equivalent of USD 3000(at the time) in BTC. Reason: MtGox wants to investigate. Explanation is promised, but never given (the whole thing took place in Febuary))!

Interesting to note: As soon as the guy complaining threatens legal action, MtGox is sold to MagicTux(different person(?), different jurisdiction!), Complaint in the first days of march, MtGox signed over shortly after ( http://www.whois.net/whois/mtgox.com ).

The company named as running MtGox is Tibanne ( http://www.tibanne.com/contact.html ), their office location is in a very prime location in Tokyo, incidentally also provided as virtual offices ( http://www.abcn.com/offices-tokyo--f-cerulean-tower-26-1-2443 ).

MagicalTux(a.ka. Mark Karpeles) himself seems to be working as a server admin for a fairly dodgy news-blog in Tokyo ( http://en.akihabaranews.com/?page=about )

The only explanation I ever heard from MtGox in reference to any indication has been either FUD or ´trust us´.

My question is, given all that has occured: Why should anyone be stupid enough to do that? Especially given the fact, that this is not the first case of less than transparent behaviour by MtGox.

DamienBlack

jr. member

Activity: 56

Merit: 1

Quote from: MeSarah on June 19, 2011, 05:03:56 PM

Quote from: bittrader on June 19, 2011, 04:36:30 PM

Quote from: jed on June 19, 2011, 04:27:04 PM

All passwords will be disabled and you will have to reset your password with the email on file. If no email is on file then it will be handled manually.

I count almost 4,000 accounts with blank emails — and mine is one of them. How do you plan on handling them manually? How will you verify that whoever is claiming to be the owner really is the owner?

Thanks.

Associated bank accounts, that how. If you have a mind, use it!

I fear nothing. Say it! I fear nothing !!

You could also just call them and prove that you know roughly what the account history was like. About how much you own and for how long and whatnot. They'll get you figured out, no worries.

MeSarah

full member

Activity: 154

Merit: 100

Quote from: bittrader on June 19, 2011, 04:36:30 PM

Quote from: jed on June 19, 2011, 04:27:04 PM

All passwords will be disabled and you will have to reset your password with the email on file. If no email is on file then it will be handled manually.

I count almost 4,000 accounts with blank emails — and mine is one of them. How do you plan on handling them manually? How will you verify that whoever is claiming to be the owner really is the owner?

Thanks.

Associated bank accounts, that how. If you have a mind, use it!

I fear nothing. Say it! I fear nothing !!

klamathonsite

full member

Activity: 154

Merit: 100

yeah they got into my email just few minutes ago and then i found new email from mtgox they are still hacking the site.
so DONT TRUST MTGOX they took your info and if you have same mail and same password on Dwolla change it RIGHT NOW OOOH MTGOX!!! Liability i can see if going up higher and higher by the hour.

kokojie

legendary

Activity: 1806

Merit: 1003

Quote from: Bit_Happy on June 19, 2011, 04:51:26 PM

Quote from: joepie91 on June 19, 2011, 04:47:11 PM

And what about the users who had their accounts compromised in the past few weeks or so?

Many were trolls who lied, IMO.
A password hash does not allow you to login. The mysterious big account might have had a virus/key-logger on his PC.

Actually it does if SQLI attack were possible (which apparently it is at mtgox). All the server want is compare the password hash with the one it had in the db. If you bypass the login box and provide the server with the hash directly thru SQLI attack, the mtgox server would allow you to login.

DamienBlack

jr. member

Activity: 56

Merit: 1

Quote from: Bit_Happy on June 19, 2011, 04:51:26 PM

Quote from: joepie91 on June 19, 2011, 04:47:11 PM

And what about the users who had their accounts compromised in the past few weeks or so?

Many were trolls who lied, IMO.
A password hash does not allow you to login. The mysterious big account might have had a virus/key-logger on his PC.

It does if the password was weak and you brute force it.

joepie91

sr. member

Activity: 294

Merit: 250

Quote from: Bit_Happy on June 19, 2011, 04:51:26 PM

Quote from: joepie91 on June 19, 2011, 04:47:11 PM

And what about the users who had their accounts compromised in the past few weeks or so?

Many were trolls who lied, IMO.
A password hash does not allow you to login. The mysterious big account might have had a virus/key-logger on his PC.

I have had $200 vanish from my account. I have turned my PC upside down, including manual analysis and found no malware of any kind. I had a 20 character alphanumeric mixed case KeePass-generated random password. I was not a victim of the CSRF exploit as I could not reach the Mt. Gox site (thus wasn't logged in) at the moment the funds were stolen. Someone could easily break such a password by using a service like Amazon AWS - and it would actually pay off as you are trying to compromise accounts on a financial service that holds money. Not to mention that miners have hardware that is specifically suited for hashcracking.

Now tell me with a straight face that this was not related to the database leak.

mrenouf

newbie

Activity: 17

Merit: 0

http://oi53.tinypic.com/2mhzq6u.jpg

Durr

newbie

Activity: 28

Merit: 0

Quote from: lacedwithkerosene on June 19, 2011, 04:51:34 PM

So now you are acknowledging the situation and providing updates but what about an inclusion of a simple apology/saying "We're Sorry" to your customers, is that too much ? Huh

Big risk in acknowlidging you are wrong. So they won't say they are sorry.

It'd be like saying "Im guilty" in court.

lacedwithkerosene

member

Activity: 112

Merit: 10

So now you are acknowledging the situation and providing updates but what about an inclusion of a simple apology/saying "We're Sorry" to your customers, is that too much ? Huh

Bit_Happy

legendary

Activity: 2114

Merit: 1040

A Great Time to Start Something!

Quote from: joepie91 on June 19, 2011, 04:47:11 PM

And what about the users who had their accounts compromised in the past few weeks or so?

Many were trolls who lied, IMO.
A password hash does not allow you to login. The mysterious big account might have had a virus/key-logger on his PC.

unk

member

Activity: 84

Merit: 10

a trade in all conventional currency markets is not 'invalid' merely because it is made with stolen funds. the trades and the theft are two separate issues. people analogizing to the 'flash crash' are doing so without understanding financial markets fully.

s3052, some others, and i have been discussing the proper way to think about this here: https://forum.bitcoin.org/index.php?topic=19593.0

if mt. gox is indeed determined to do what is legally and ethically correct, it seems far too glib to assume that a 'rollback' of transactions is legitimate merely because funds were stolen and then sold. as an analogy, if someone stole us dollars and then bought bitcoins with them, would you be so quick to break the trades? it would seem ridiculous to do so, and i'm afraid it's potentially just as problematic on this side as if the theft happened on the other side. i'm not a lawyer, but i suspect you'll face legal exposure for breaking trades as well, given that you combine the roles both of a broker and an exchange.

in case it matters, i do not have a mt. gox account and would not be directly affected by a rollback. i'm just frustrated with the lack of transparency and have claimed for months that issues with exchanges may prove disastrous for bitcoin's wider adoption.

joepie91

sr. member

Activity: 294

Merit: 250

And what about the users who had their accounts compromised in the past few weeks or so?

jatajuta

sr. member

Activity: 365

Merit: 250

This is definitively the digital gold run of the century.

Welcome to the wild west. Cheesy

jhansen858

sr. member

Activity: 364

Merit: 250

Well people, there you have it,

They manned up, took responsibility, are going to make everything right, if necessary on a case by case basis.

What have we learned?

1) Don't put all your BTC in one basket if you don't want to not have unlimited access to it.
2) This isn't a game, if you cant take the drama, get the fuck out of the kitchen, go back to some safer investment like trading over your margins on the stock market.
3) Don't use easy to un-hash passwords that are the same for every site you use.
4) more control and regulation is needed on the side of the exchanges to limit the price swings much like the real stock market has now

elmom

newbie

Activity: 21

Merit: 0

What about the people that have complained that their email is wrong based on the leaked DB. Will you roll back the email addresses too? Someone said (on IRC) they had a hash in the DB corresponding to a password that was changed 19 days ago. And several accounts have been reported as compromised before today's events.

Topic: MtGox UPDATE - page 3. (Read 24209 times)