Quote
Can I use my Mt. Gox Yubikey?
Yes. Be sure to select "Mt Gox Yubikey" in the Two factor authentication select box.
Yes. Be sure to select "Mt Gox Yubikey" in the Two factor authentication select box.
Topic: You are eligible for a free Yubikey! (Read 5773 times)
From the blockchain website:
The Yubikey output contains the serial number, an OTP, an incrementing counter, and possibly some other things that I have forgotten. It is not time limited, so you could generate (say) 15 OTPs in a row from an offline computer, and record them on a bit of paper for later use, as long as they were used sequentially. This would work, but it would be tedious to type in every time.
Got it, the counter. Thanks.
Does it actually protect you from key logger ? Mine gets installed as HID device.. i would imagine key logger could see the output ? same as a keyboard ??
Alright, yubikey will protect my account in case a keylogger is running on my computer. Is that all? How about the security of gox android app?
The idea behind it is that each password it generates can only used one time. Every time you press that button a new password is generated, and as long as the most recent one was used to log into Mt.Gox any old ones will be invalid. Someone will need physical access to your yubikey to log into your account.
However if you like to play around with your new yubikey and watch it type random passwords in notepad, an attacker could use one of these passwords to log into your account. Always make sure you log into your Mt.Gox account with the last password generated by your yubikey and do not generate any more yubikey passwords after you log in!
Good point. On a related note, how much ahead from the last used password does their server try going to match my input? If I use the otp once, log off, then generate a seqence of 15 OTPs offline, will gox keep going 16 times the next time I log in? Or does yubi broadcast a serial number with the OTP?
Got it, the counter. Thanks.
Does it actually protect you from key logger ? Mine gets installed as HID device.. i would imagine key logger could see the output ? same as a keyboard ??
Alright, yubikey will protect my account in case a keylogger is running on my computer. Is that all? How about the security of gox android app?
The idea behind it is that each password it generates can only used one time. Every time you press that button a new password is generated, and as long as the most recent one was used to log into Mt.Gox any old ones will be invalid. Someone will need physical access to your yubikey to log into your account.
However if you like to play around with your new yubikey and watch it type random passwords in notepad, an attacker could use one of these passwords to log into your account. Always make sure you log into your Mt.Gox account with the last password generated by your yubikey and do not generate any more yubikey passwords after you log in!
Good point. On a related note, how much ahead from the last used password does their server try going to match my input? If I use the otp once, log off, then generate a seqence of 15 OTPs offline, will gox keep going 16 times the next time I log in? Or does yubi broadcast a serial number with the OTP?
Does it actually protect you from key logger ? Mine gets installed as HID device.. i would imagine key logger could see the output ? same as a keyboard ??
Alright, yubikey will protect my account in case a keylogger is running on my computer. Is that all? How about the security of gox android app?
The idea behind it is that each password it generates can only used one time. Every time you press that button a new password is generated, and as long as the most recent one was used to log into Mt.Gox any old ones will be invalid. Someone will need physical access to your yubikey to log into your account.
However if you like to play around with your new yubikey and watch it type random passwords in notepad, an attacker could use one of these passwords to log into your account. Always make sure you log into your Mt.Gox account with the last password generated by your yubikey and do not generate any more yubikey passwords after you log in!
Good point. On a related note, how much ahead from the last used password does their server try going to match my input? If I use the otp once, log off, then generate a seqence of 15 OTPs offline, will gox keep going 16 times the next time I log in? Or does yubi broadcast a serial number with the OTP?
Does it actually protect you from key logger ? Mine gets installed as HID device.. i would imagine key logger could see the output ? same as a keyboard ??
Alright, yubikey will protect my account in case a keylogger is running on my computer. Is that all? How about the security of gox android app?
The idea behind it is that each password it generates can only used one time. Every time you press that button a new password is generated, and as long as the most recent one was used to log into Mt.Gox any old ones will be invalid. Someone will need physical access to your yubikey to log into your account.
However if you like to play around with your new yubikey and watch it type random passwords in notepad, an attacker could use one of these passwords to log into your account. Always make sure you log into your Mt.Gox account with the last password generated by your yubikey and do not generate any more yubikey passwords after you log in!
Does it actually protect you from key logger ? Mine gets installed as HID device.. i would imagine key logger could see the output ? same as a keyboard ??
Alright, yubikey will protect my account in case a keylogger is running on my computer. Is that all? How about the security of gox android app?
wow very fast delivery just 5 days
arrived today . Thanks Mtgox.
arrived today . Thanks Mtgox.
Also arrived in Holland. Thanks Mtgox. Though, it's not working for some reason. It's not generating a OTP. =/
Make sure the USB keyboard driver gets installed when you plug it in. It might take a few seconds to be detected. You can play with it in an instance of a text editor such as notepad. A short press means hold for half a second, you can't just tap it real quick. A long press means hold it for 3.5 sec or so, but if you hold it too long it might not go.Tried multiple USB input ports.
Edit: nvm.. its working now. Weird.
Also arrived in Holland. Thanks Mtgox. Though, it's not working for some reason. It's not generating a OTP. =/
Make sure the USB keyboard driver gets installed when you plug it in. It might take a few seconds to be detected. You can play with it in an instance of a text editor such as notepad. A short press means hold for half a second, you can't just tap it real quick. A long press means hold it for 3.5 sec or so, but if you hold it too long it might not go.Also arrived in Holland. Thanks Mtgox. Though, it's not working for some reason. It's not generating a OTP. =/
Make sure the USB keyboard driver gets installed when you plug it in. It might take a few seconds to be detected. You can play with it in an instance of a text editor such as notepad. A short press means hold for half a second, you can't just tap it real quick. A long press means hold it for 3.5 sec or so, but if you hold it too long it might not go.Also arrived in Holland. Thanks Mtgox. Though, it's not working for some reason. It's not generating a OTP. =/
Make sure the USB keyboard driver gets installed when you plug it in. It might take a few seconds to be detected. You can play with it in an instance of a text editor such as notepad. A short press means hold for half a second, you can't just tap it real quick. A long press means hold it for 3.5 sec or so, but if you hold it too long it might not go.
Also arrived in Holland. Thanks Mtgox. Though, it's not working for some reason. It's not generating a OTP. =/
Alright, yubikey will protect my account in case a keylogger is running on my computer. Is that all? How about the security of gox android app?
I got a free one from Gox too 2-3 months ago. They sent it straight from Japan in some cool Japanese envelopes with a crazy amount of tickboxes on it. (all the customs declarations)
I actually paid for mine, and I got 2 in the mail, one had someone else's name lol. Whoops. 
I got a free one from Gox too 2-3 months ago. They sent it straight from Japan in some cool Japanese envelopes with a crazy amount of tickboxes on it. (all the customs declarations)
Are we 100% sure this is from Mt.Gox and not a phishing expedition.
LoL....yes 100% sure. I didn't click the link in the email, I went to my browser and typed in the address. Logged in and gave my coupon code under buy a yubikey.
Are we 100% sure this is from Mt.Gox and not a phishing expedition.
I got one too.... Dunno if I'll use it (eggs/basket etc), but it's free 
My understanding was that a MtGox Yubikey was a Yubikey with an AES key put into it by MtGox. Actually, that's two AES keys - one for the short press (logging in), and one for the long press (withdrawing funds).
AES is a symmetric algorithm - in this case, I understand this to mean that MtGox and the key know the same secret number.
That said, I don't understand how can a third party make use of a MtGox Yubikey without knowing that number?
I believe that you can validate against a given authentication server without needing to know the secret.AES is a symmetric algorithm - in this case, I understand this to mean that MtGox and the key know the same secret number.
That said, I don't understand how can a third party make use of a MtGox Yubikey without knowing that number?
Jump to: