Topic: WTF @ Mt.Gox?! (Read 6477 times)

HOTP clients are available for most smartphones. No SMS needed then, and free for the end-user. An alternative would be HOTP hardware tokens (Yubikey supports HOTP too, in one of it's two configuration slots).

Still doesn't improve your database security though

I would think the most secure way to handle a lost second factor would be to only allow that user to withdraw the funds on account to a previously setup destination. Once all the funds have been moved out they can remove the second factor and resume trading once the new funds are added.

What does this matter?  It would seem to be a benefit, not a problem.

You will be configuring the mobile number to receive your second factor login key, and deciding if it is a method that makes sense for you.

By allowing the users which factors to utilize, whether it be a single method, or multiple methods as a failsafe to not get locked out of their account.

Personally I would probably enable multiple secondary factors... because you will still always need to provide the password as well.


I do like the Yubikey solution.. especially since I have a number of fresh / unused Yubikeys at my disposal.

I would also enable the SMS feature, in case I didnt have my Yubikey handy..  It would be important for me to still have a method to get into my account... so I wouldn't miss an important trading opportunity, or need to go through another time consuming process to reclaim my account. Which could be time consuming.. and cause missed opportunities.

My password was already strong... so anything else is just an extra layer of security, even with the ability to add some flexibility and convienience.

Rich

I'd like to get your thoughts on this

http://forum.bitcoin.org/index.php?topic=21026.0

Was it really your account that got hacked?

One problem with SMS is that telephone numers for SMS also can be anonymously created.
At the end SMS will end up becoming like email, not more nor, less secure.
Also I don't know if I would be comfortable with having my phone number in your databases.

The leaked emails contained both my "public" and "private" emails, the private was a secretly guarded one only used for banking only.
Now I receive spam in BOTH accounts. I definitely don't feel comfortable sharing my real phone number.
I might use a fake phone number solely for the SMS authetication, but that defeats its purpose.

I would suggest going ahead with Yubico.
Also I think it would be nice gesture if all users who were registered up to the day of the crash would get a free Yubico key.
To the newly registered users (who weren't neither directly nor indirectly affected by the attack) would have to pay a fee to get it.

Well, that's my 0,00001 BTC

I don't want to be in a situation where I can't get into my account if I forgot or lose my second factor...  I'm hoping you allow some flexibility in this new system for us to decide which methods we would like to select during login.  If I need to get into my account, without my second factor, it would be nice to have the ability to choose one of the other 2nd factors during the logon process...  If I don't have my Yubikey, but I do have my cell phone configured, I would like to be able to still access my account.  If I don't have either of my 2nd factors.. Answering a short series of "Security Questions" should be allowed to be used to gain access. Something like the way that Paypal does it.. During the logon process a user can say "I don't have my Key right now" and still answer a couple of security questions only that user would know, as a backup method, to gain access to their account.

Of course each user could decide which factors are available for them...  This would allow users to balance not only the increased security of the new system, but also how convenient they wish it to be for themselves.

Maybe you can implement the SMS 2-Factor in house.. and find a way to avoid the "SMS flooding" scenario... like sending the SMS AFTER the correct password has been entered on the site.

Here is a list of the majority of International SMS carrier gateways.. It could be used as a starting point should you decide to roll your own solution..

att=@txt.att.net
at&t=@txt.att.net
bell=@txt.bell.ca
beeline=@sms.beemail.ru
bouygues=@mms.bouyguestelecom.fr
cricket=@sms.mycricket.com
d1=@t-d1-sms.de
eplus=@smsmail.eplus.de
etisalat=@email2sms.ae
fido=@fido.ca
lmt=@smsmail.lmt.lv
metropcs=@mymetropcs.com
mobistar=@mobistar.be
optus=0@optusmobile.com.au
orange=@orange.net
o2uk=@o2imail.co.uk
o2germany=0@o2online.de
rogers=@pcs.rogers.com
sfr=@sfr.fr
softbank=@softbank.ne.jp
sprint=@messaging.sprintpcs.com
starhub=@starhub-enterprisemessaing.com
sunrise=@mysunrise.ch
swisscom=@bluewin.ch
tdc=@sms.tdk.dk
telecom=@etxt.co.nz
telenor=@mobilpost.no
tele2=@sms.tele2.lv
telia=@gsm1800.telia.dk
telstra=@tim.telstra.com
telus=@msg.telus.com
three=@three.co.uk
tmobile=@tmomail.net
tmobileczech=@sms.paegas.cz
uscellular=@email.uscc.net
verizon=@vtext.com
virginmobile=@vmobl.com
virginmobilecanada@vmobile.ca
vivo=@torpedoemail.com.br
vodafonegermany=0@vodafone-sms.de
vodafonegreece=@sms.vodafone.gr
vodafoneitaly=@sms.vodafone.it
vodafoneuk=@vodafone.net

Yubikey is a good solution.  +1

i want my free subscription upgrade and trading or my 100 btc back

So there would be no monthly fee? Please verify.

- will the SMS method work for Customers outside USA? e.g. Germany?

Thanks

Sounds perfect to me. 

and while you're here... email confirmation of things like BTC address change for withdrawals, transactions beyond certain limits, etc... simple, but very effective

you also might want to evaluate a security card like the ones interactivebrokers.com uses, which you could generate on signup for the user to print.

this would be pretty effective security at no cost.
the hacker would have to eavesdrop on hundreds of logins until he can successfully login once himself.

Hi Everyone,

We are evaluating 2 methods at this time. SMS, and Yubikey.

The "free subscription" we're referring to is SMS verification. Unfortunately we're a prime target for SMS flooding if we make this a free service, as you can probably understand.

As for the Yubikey, you will pay for a key and the service itself would of course be offered free of charge, making it effectively a one time fee.

Of course you can say that your product is more secure for those who pay. Why shouldn't you be able to say so in a free market? This is completely normal in the grown-up world.

i hope they find back in the market and prove to be better than before

meanwhile i stay with http://tradehill.com

there seem to be no details yet, but if they plan on using a physical security device like brokers do this is a huge improvement and charging for it is entirely reasonable.

This just in: Kevin Day is a partner of mtGox, this whole Flash Crash / Rollback Stunt is just to sell more security subscriptions!

Thanks a bunch!