I am really astonished about the level of abuse that some Forum members subject the people that get their accounts hacked for.
Someone posts that their account gets hacked and all of a sudden that person is called a lot of names ranging from stupid to much worse.
Is it not enough that he/she lost their Bitcoins?
I am also surprised that Mt Gox has such a high standing in the community that anyone that does not talk favorably about them get
their threads spammed and again are called names and worse.
Please, think before you post and dont post drunk.
/GoK
Topic: *MY* Mt Gox Account was Hacked - lost it all today... now what!? - page 3. (Read 9987 times)
January 23, 2013, 05:40:26 AM
January 23, 2013, 03:18:35 AM
title should read:
"I was surfing porn, downloaded a key logger and now I don't have anymore coins in my Mt. Gox account. "
"I was surfing porn, downloaded a key logger and now I don't have anymore coins in my Mt. Gox account. "
MY PRONSITE WAS HACKED
January 22, 2013, 09:28:28 PM
title should read:
"I was surfing porn, downloaded a key logger and now I don't have anymore coins in my Mt. Gox account. "
"I was surfing porn, downloaded a key logger and now I don't have anymore coins in my Mt. Gox account. "
LOL.
January 22, 2013, 08:26:41 PM
title should read:
"I was surfing porn, downloaded a key logger and now I don't have anymore coins in my Mt. Gox account. "
"I was surfing porn, downloaded a key logger and now I don't have anymore coins in my Mt. Gox account. "
January 22, 2013, 08:06:38 PM
I'll give a reward if I can find out who this person is so I can beat the **** out of them!
If there's anyone who should be beat, it should be YOU for this fucking misleading thread title!
MtGox DID NOT GET HACKED and all you're doing is stirring shit.
January 22, 2013, 12:14:30 PM
Even just offering the option to assign one pre-determined bitcoin address would provide an equivalent level of security, even if you did no PGP automation whatsoever. The pre-determined bitcoin address could either be a) withdrawn to directly, or b) for those who know how to sign messages, it could be used to sign a message that permits withdrawal to some other address. All of this could be evaluated in any environment already accustomed to working with bitcoin keypairs.
We could easily add the "limit to one bitcoin address" thing, but there is a problem with the bitcoin message signature process that makes it difficult to implement (last time I checked the bitcoin message signature uses a different way of signing compared to transactions to make shorter signatures, but it's been an issue).
This would still be a much easier problem to solve than, say, adding a dependency on PGP, given that all the necessary code can be lifted directly from the current build of bitcoind.
And signing aside, simply allowing one the option to restrict their account so that instant bitcoin withdrawals can only go to a single bitcoin address would be of trivial complexity and yet would result in an enormous leap in practical security. That may not work for some, but for others, it is so simple to understand as to be a meaningful confidence builder. If you ask people to write that bitcoin address on their AML docs as they send them in, you've got a bulletproof paper trail connecting the withdrawal address to the customer.
The unspoken underlying fear is that one might have their funds disappear and be in a "he said she said" war with Gox as to how the withdrawal actually occurred. If MtGox adopts policy and procedures that ensures that all withdrawals can be positively accounted for, and that instant withdrawals to arbitrary addresses are easy to limit, it literally reduces the customers negative fear of unauthorized withdrawal.
January 22, 2013, 10:44:44 AM
OP: Don't listen to people moaning about how we had been thinking we had a Mt.Gox breach even with a Yubikey in use and that turning out not to be the case it's just good that we've been told now and can stop worrying :-)
yeah, true, sorry JMcGrath for being a bit harsh before. Thanks for telling us you probably hadn't linked the yubikey.
January 22, 2013, 09:12:32 AM
You can use google authenticator on your box account. Its free for browser and smart phone.
That's what I resorted to when my yubi key never showed up.
That's what I resorted to when my yubi key never showed up.
The difference is that MtGox has no way to prove someone's use of GA or Yubikey actually took place. It is on MtGox's honor.
A system where MtGox could respond to allegations of fraudulent withdrawals by publishing a signed withdrawal request totally and instantly exonerates Gox against claims of being hacked, and is good for market confidence all the way around.
January 22, 2013, 06:02:50 AM
You can use google authenticator on your box account. Its free for browser and smart phone.
That's what I resorted to when my yubi key never showed up.
That's what I resorted to when my yubi key never showed up.
January 22, 2013, 05:18:29 AM
OP: Don't listen to people moaning about how we had been thinking we had a Mt.Gox breach even with a Yubikey in use and that turning out not to be the case it's just good that we've been told now and can stop worrying :-)
Sounds like this might have been a generic Ubikey and not the Gox one that has to be used with the site.
Remember though folks, if you're trading on Gox that means you're banking. And fast and highly frequent deposits and withdrawals I don't think are feasible
Sounds like this might have been a generic Ubikey and not the Gox one that has to be used with the site.
Remember though folks, if you're trading on Gox that means you're banking. And fast and highly frequent deposits and withdrawals I don't think are feasible
January 22, 2013, 04:38:08 AM
Even just offering the option to assign one pre-determined bitcoin address would provide an equivalent level of security, even if you did no PGP automation whatsoever. The pre-determined bitcoin address could either be a) withdrawn to directly, or b) for those who know how to sign messages, it could be used to sign a message that permits withdrawal to some other address. All of this could be evaluated in any environment already accustomed to working with bitcoin keypairs.
We could easily add the "limit to one bitcoin address" thing, but there is a problem with the bitcoin message signature process that makes it difficult to implement (last time I checked the bitcoin message signature uses a different way of signing compared to transactions to make shorter signatures, but it's been an issue).
Add optional "withdraw to one address only".
Add 48 hour delay before changing the addresses, during which you'd get two emails, and see a giant warning when you log in.
January 22, 2013, 04:35:00 AM
Even just offering the option to assign one pre-determined bitcoin address would provide an equivalent level of security, even if you did no PGP automation whatsoever. The pre-determined bitcoin address could either be a) withdrawn to directly, or b) for those who know how to sign messages, it could be used to sign a message that permits withdrawal to some other address. All of this could be evaluated in any environment already accustomed to working with bitcoin keypairs.
We could easily add the "limit to one bitcoin address" thing, but there is a problem with the bitcoin message signature process that makes it difficult to implement (last time I checked the bitcoin message signature uses a different way of signing compared to transactions to make shorter signatures, but it's been an issue).
January 22, 2013, 04:18:17 AM
If MtGox could make it so that you could add your PGP public key and then configure your account such that bitcoin withdrawals require PGP signature of a pre-generated message that contained the destination bitcoin address, MtGox would have undisputable conclusive proof in the event of a disagreement as to whether a withdrawal was authorized.
However: what's the difference of having ones password stolen and having ones pgp key stolen and passphrase key-logged?
The difference is the attacker wouldn't have the PGP private key.
January 22, 2013, 04:15:51 AM
If MtGox could make it so that you could add your PGP public key and then configure your account such that bitcoin withdrawals require PGP signature of a pre-generated message that contained the destination bitcoin address, MtGox would have undisputable conclusive proof in the event of a disagreement as to whether a withdrawal was authorized.
However: what's the difference of having ones password stolen and having ones pgp key stolen and passphrase key-logged?
The difference is the attacker wouldn't have the PGP private key.
January 22, 2013, 03:46:48 AM
If MtGox could make it so that you could add your PGP public key and then configure your account such that bitcoin withdrawals require PGP signature of a pre-generated message that contained the destination bitcoin address, MtGox would have undisputable conclusive proof in the event of a disagreement as to whether a withdrawal was authorized.
That's a good idea.
However: what's the difference of having ones password stolen and having ones pgp key stolen and passphrase key-logged?
In other words: mtgox even in this case has proof the withdrawal was authorized (albeit not as strong, it could be faked by gox) by means of a successful login with password.
So while this puts mtGox in a more comfortable situation, this is only better for the user if he protects his pgp key better than his password.
January 22, 2013, 03:42:25 AM
Thanks for the info guys, this really ruined my day! I am already screwed with bills and stuff and then I log in to find this... ugh
Could this have anything to do with my Yubikey being broken and reported lost? I never got a chance to actually use it on Mt Gox so I don't really know what happened there!?
Could this have anything to do with my Yubikey being broken and reported lost? I never got a chance to actually use it on Mt Gox so I don't really know what happened there!?
So you never linked your yubi-key to your mgGox account. Well, don't talk about your account "with yubi-key withdrawal protection activated" being hacked, then, dude.
Sorry 'bout your loss, but don't lie to us.
January 21, 2013, 10:41:49 PM
If MtGox could make it so that you could add your PGP public key and then configure your account such that bitcoin withdrawals require PGP signature of a pre-generated message that contained the destination bitcoin address, MtGox would have undisputable conclusive proof in the event of a disagreement as to whether a withdrawal was authorized.
We considered this, but the lack of proper PGP lib (the only few libs around will try to create stuff in $HOME and doesn't allow us to store/provide the public keys easily) or appropriate technical documentation on the signature format (it mostly says "read the source") forced us to delay this.
Even just offering the option to assign one pre-determined bitcoin address would provide an equivalent level of security, even if you did no PGP automation whatsoever. The pre-determined bitcoin address could either be a) withdrawn to directly, or b) for those who know how to sign messages, it could be used to sign a message that permits withdrawal to some other address. All of this could be evaluated in any environment already accustomed to working with bitcoin keypairs.
Either way, the benefit to MtGox is instant vindication of any questionable withdrawal that goes through. Further, the moment anyone releases a hardware bitcoin wallet, you can bet that this will end up supported as a bonus feature.
January 21, 2013, 08:49:48 PM
I'm sorry if my posts sound a little all over the place, I'm a little on edge here myself so I'll try to be as clear as possible...
* Yes I did have a Yubikey and *thought* I registered it
* I just spoke with Mt Gox and they are claiming that I never had a registered Yubikey
* They provided the IP Address of the person, but it comes up all over the world when I search it
* I know I tried to register my yubi when I got it so I *suspect* there is a fault where it is not "sticking" the first time around as you stated
* Yes I did have a Yubikey and *thought* I registered it
* I just spoke with Mt Gox and they are claiming that I never had a registered Yubikey
* They provided the IP Address of the person, but it comes up all over the world when I search it
* I know I tried to register my yubi when I got it so I *suspect* there is a fault where it is not "sticking" the first time around as you stated
Where did you get the Yubikey from? Could you have bought it from a third party that asked for your username/password and you sent it to them via email or on a website? Also what is the IP address of the attacker that Mtgox gave you?
January 21, 2013, 08:49:07 PM
If this guy was using a Ubikey does that mean that Ubikeys are not a reliable protection against Windows virii? It's easy to cloak logging apps and there's a lot of crackers around Bitcoin.
Can this guy assume his install is cracked?
How can he search for whatever may have caused the breach?
Is there a Gox grabbing trojan out there we know about?
Has he installed the Gox app on a phone? (I think that's a risk)
Can this guy assume his install is cracked?
How can he search for whatever may have caused the breach?
Is there a Gox grabbing trojan out there we know about?
Has he installed the Gox app on a phone? (I think that's a risk)
January 21, 2013, 08:46:11 PM
PGP sounds like a great additional feature, the more the better. Allow the end user to decide what is preferable to them.
Jump to: