Topic: [UPD: взяли еще 24 ч, откроется 25 июня] MtGox откроется з&#10 (Read 7820 times)

так Phishing или Fishing?

Фи́шинг (англ. phishing, от fishing — рыбная ловля, выуживание

что это?

Фишинг — одна из разновидностей социальной инженерии, основанная на незнании пользователями основ сетевой безопасности: в частности, многие не знают простого факта: сервисы не рассылают писем с просьбами сообщить свои учётные данные, пароль и прочее.

Phishing?

уже дней 5 жду восстановления пароля.
ни отказа ни пожтверждения нет.

видимо пора писать на мыло им...

Действительно странно, что совершенно разные и не связанные между собой сайты ведут себя по разному. Очень, очень странно.

С btcex и TH все в порядке. Странно.

насчет "работает" есть сомнения

Так ведь сайт уже работает и вполне себе не тормозит.

I'm a programmer and from what I've heard and seen it looks like software behind MtGox is piece of shit not suitable for production.

It is one thing when security vulnerabilities are caused by rare bugs in code, and completely another thing when they are caused by negligence and disrespect to common practices.

    CSRF: Every form in every web application is by default vulnerable. Thus any professional web developer should be aware of CSRF problems (otherwsie EVERY application he works on will be vulnerable) and should take corrective measures. Which are simple, by the way: just check goddamn referrer! So if you see CSRF somewhere then either this is a sloppy coding or sheer lack of professionalism.

    SQL injections. They are not officially confirmed by MtGox, but people on irc claim that there were SQL injection problems (SQLi). This, again, shows that developers are lame because SQLi is a very serious issue but it is easily preventable: if you use parametrized queries/prepared statements and never modify queries themselves then SQL injections are simply not possible at all.

    Same thing XSS: if you use a templating engine like Smarty in PHP then XSS is not possible because it will 'escape' everything automatically. Naked PHP is very vulnerable, but people should know they are not supposed to build sites like they were 10 years ago.

    It looks like their trading software sucks. I've looked through a websocket API log at time of that large sell-off. Oh my... Yes, there was one large order to sell 500k BTC. I would expect that it would instantly fill it with existing bids (>= 0.01) and show current price with 0.01. But, now, it was slowly filling that huge-ass order for 36 motherfucking minutes, and it was not showing that 0.01 is the current price, so people had no idea of what is going on. (But this information was available through websocket feed.)

    Normally exchanges have automatic 'circuit breakers' -- if price goes too low trading automatically stops. If that was a case with MtGox we would have none of the mess if it would halt right after filling that huge-ass order: it would be easy to undo the damage and people would have no chance so withdraw.

    It was reported that withdrawal limit (no more than $1000 worth of BTC per day) was not properly implemented: a) you could withdraw more if you would do it many times per day; b) it takes current market price to estimate threshold for bitcoin withdrawal. If there is no smoothing/averaging it is vulnerable to 'large sell-off' attacks.

    Looking through websocket feed logs I've noticed that prices are sometimes represented as floats and sometimes as strings. E.g. 0.01 and "0.01". This means that there is some weak-typed fun going on inside and it can be a serious source of bugs. I think that weakly typed languages like PHP SHOULD NOT be used for financial software. Ideally it should be implemented in strongly and statically-typed language like Java.

    In their official announcement they said that account balances were very wrong. This indicates serious bugs or SQLi at work.

So it was not an isolated incident, software is simply full of bugs and is written in a sloppy manner. Any half-competent team would not allow software of this quality to be used in production: they would stop site and bring it back only when it is fixed.

Thus it looks like team behind MtGox is either extremely incompetent, or greedy, or both.

у меня через хром не логинится почему то, а через ie без проблем залогинился

По какому адресу можно зайти с логином, а не с емэйлом?

кто нибудь смог залогинится?

торговля еще не открыта а курс на http://mtgoxlive.com/orders немного меняется

странно у меня шустренько

я из-з тормозов даже залогинится не могу

походу зашевелились

ну и где? похоже опять нас нае*али

Куда интересно курс пойдет, кто как думает?

Поздравьте меня, я раздолбай. Забыл новый пароль от MtGox

Кто прошёл процедуру подтверждения аккаунта может зайти на него тут https://claim.mtgox.com/status.html  с новым паролем.

А как вы смогли посмотреть свой баланс? биржа всетаки открывалась?

We have found that balances on some older accounts look significantly incorrect when compared with the old database. At this time we do not know what caused the balances to be off, or how many of the older accounts are affected. We haven't touched the old backend or database, so we're going to import the accounts again once we have found what caused the off-balances.

No money is lost, we still have the records of all transactions that happened prior to the bitcoin sell-off. All funds deposited are still in our bank accounts, and we're going to try and get this resolved by 15:00 GMT.

Всё больше и больше проникаюсь уважением к вам и вашей практичности)) То вы "на всякий случай" держите ордера по 0.01, а сейчас оказывается, что и деньги с биржи вы успли вывести до её краха)

Мне только что подтвердили аккаунт.

Указывал старый пароль и номер LR-счета.

На акке, правда, все было по нулям (все вывел раньше).

возможно второй раз пройти процедуру восстановления пароля?
и какой пароль при этом использовать? (старый или указаный при первом восстановлении)

зато будет толпа жаждающая халявы и желающих купить их

Mt.Gox Account recovery service

Account recovery request submitted at 2011-06-21 16:17:31 GMT.

Your account recovery request has been accepted.

You will be able to access your Mt.Gox account once the site opens again.

Your account recovery request has been rejected.

Note that if you already had an accepted recovery request with this email, all other requests will be rejected.

Some hints when applying for your account

Make sure you provided your last balance, even if its approximate.
Send the account number(s) and amount(s) you used when depositing into your Mt.Gox account.
You can re-open your claim and submit more proof by clicking the button below.

Проблема в том, что баксов на бирже очень мало будет. В прошлые выходные деньги не поступали, в эти тоже не будут.

Автор, тему поправь, 3:00 GMT это 7:00 MSK (GMT +4)

Кто-нибудь уже получил данные для входа на биржу?

Форму восстановления заполнил, прошло уже 1,5 дня в мыло так ничего и не упало...