Bitcoin Forum

Hey,

just wanted to say that you can claim your MtGox account back:

https://claim.mtgox.com/

Seems that the MtGox staff will check every single account, oh boy.

Mine says "The password for this account is invalid, or this account is not currently under claim process."  I don't know if that means my account password was strong enough, because it definitely is the right password.  Anybody have this happen?

Not sure what his process is or what he considered strong passwords however I feel my prior password was strong enough for general use such as this while my Truecrypt and PGP passphrases are 27 characters long I don't see the need to input passwords longer than 8-10 characters on Gox if the hash is salted and protected. From a security standpoint when I deal with users if the requirement for long and strong passwords is to great they will just store those passwords in an unsafe manner (post it note on monitor). In this case I had to go with something a bit more complex than I normally use so thank you RoboForm but I suspect many users will end up creating a text file with all their passwords and probably name it "passwords.txt"

Now what gets me is how poorly banks are setup when it comes to password access. My primary bank will only take 8 alpha characters, no numeric or symbols and the last time I checked capitalization did not matter meaning they don't hash anything.

If they are going to verify each account based on proof using past IP address tables or balance inquiries they have a long road ahead.

It rejected what I would consider a very strong password ... I hope they understand that making passwords harder just encourages people to write them down, which is actually less secure in the long run.  You figure since they took so long to fix it; they would at least do it right instead of going nuts. FAIL.

mine also says "The password for this account is invalid, or this account is not currently under claim process."


I've been waiting since last night to log in, slept only 4 hours, WTF?

Mine also said that until I remembered the right old password.

Yes, it looks like that: "Your account recovery request is pending review by our staff."

With over 61,000 accounts that could take a while.

If they took only one minute to validate each account, that would be over 1000 man-hours, or over 42 days. Hopefully there is a team of workers or an automated system in development.

I claimed my account, but if MTGOX expects me to jump through any hoops, I'd request they close and delete my account (I never had a transaction anyway).

I am weary of them having access to ANY of my information (no offense to them, I just don't really want my day-to-day email spammed or worse).

Someone can't look at a written password over the internet.

I actually encourage people to use strong passwords and write them down.  I just make sure that they understand that the proper place to store the paper with the password is with their other small, valuable pieces of paper, in their wallet.

They can with a keylogger.

All the informations needed to claim the account are publicly available. This will be fun.

What??  ???

so because all the hashed passwords and emails were leaked. mtgox is going to authenticate accounts through emails...by entering the old password. and a new password...

soooo fucking stupid.

This goes far beyond, one account, a measly $1k, and a user database. this is means anyone who used the same password for their email could have the passwords to other accounts recovered to the email without knowing the original. so get access to the email. find where they have accounts. paypal, bitmarket, banks, this forum, their mining sites, dating sites, dwolla, liberty reserve, everything. they might of sent a an ecrypted zip of their wallet to themselves via their email. they might of had a very important conversation with someone. money pak numbers in emails. endless possibilities. amazon accounts, ebay, godaddy, ect ect ect. this spiderwebs out.

even lulzier is bitcoin is a community of people who mine by decoding hashes. someone with a killer mining set up could rainbow table the shit out of any encryption.  md5 encryptions can be easily cracked by morons via sites like md5decrypter.co.uk and the freebsdmd5 hashes by process's like this http://hansatan.com/?d=jtrguide

So theyre going to dictate the price at 17.50 when the exchange comes back.  who values this shit at $17 right now? someone bought a fuckload for penny each. and were supposed to buy at $17.50. i mean thats all fine and dandy for everyone getting out of bitcoins, but thats no good for the market in general.

mtgox is a buncha fuckups who lost lots of people alot of money, set back a revolution and wont take responsibility for handing out the database to an auditor for reasons unknown. i know what auditors do, no reason for him to have emails and logins. fucking morons down at mtgox have fucked up big time. They really need to pay for all damages and fuck off the internet.

It's in the accounts list.
If someone was dumb enough to use a simple password on both their Mt. Gox and email account, then all the attacker needs is that info.

Add to that the fact gmail shows the last visible IP's, the attacker can just gain a local proxy in your country after a quick WHOIS search and obtain a higher probability of recovering your account.

The username, email and old hashed password has been posted on the forum and not deleted even if i contacted 3 times the admin.

EDIT: The second step is allowing you to submit a proof of the ownership.

This doesn't change the relative security of written vs. unwritten passwords.

what's even worse, i put in a new password, and it says it is not secure enough.
It contains number, lower case letter, upper case letter, symbol, special character.
Are they asking for arabic characters combined with korean and russian characters??

Same issue here.

And now it says "The password for this account is invalid, or this account is not currently under claim process."
With no further instruction.
Are they forcing us to file case in small claims courts?
I really smell a huge lawsuit going their way.

Also, I've submitted a few support requests PRIOR to the attack, and NONE ever got a reply back.
So I guess I might be forced to file a suit

Interesting. I didn't get that, or any error—I was redirected to the same step 2/2 again. Actually submitted the form twice just in case...

Hmm, I had no problems going trough the claim procedure...
Submitted my bank account #, name, IP and the balance of my account in BTC.

Should be enough info to reclaim my account.

you realized that this was only step one, did you?
There is a second step where you have to provide further prove that you are the legit owner of the account you claim.


nobody is decoding hashes.

good luck. the unsalted simple md5() from the leaked list are dead accounts, where nobody logged in for months.
also good luck for trying to crack the ~60000 unix_md5() hashes, with ~60000 different salts. that requires you to generate 60000 different rainbowtables...very effective, lol.

Is mtgox under dos attacks or are there simply too many of us trying to connect? Probably the latter because it doesn't actually work and many people try again and again (like me, in the morning). Last time I was able to try I was still getting

"The password for this account is invalid, or this account is not currently under claim process."

And I had a fairly long and good password, I doubt somebody had the time to crack it, and it was "salted" (not an idle account)
so what does or this account is not currently under claim process. mean, anyway??

Mt gox websites are not loading.......  ???

Is this DOS? I honestly think it might be.

just because these people didnt have current mtgox accounts doesnt mean there not in danger even if they have NOTHING in there mtgox. all their online accounts are at risk. also considering one major account sell drove the price to fucking zero and the sold off like 400,000 coins. so it could be VERY effective to only take over a few accounts. i dont see why people try to downplay this. also i worded part wrong, but none the less a good mining setup, would still make the perfect hash decryption machine. and with email access one could obtain all the information mtgox wants us to use as proof of the account.

its down or incredibly slow.

welp bitcoin was fun.

Giving me the error:


The password for this account is invalid, or this account is not currently under claim process.

My claim was submitted.

Like the new MtGox logo.

Yeah, if I was them, I would be re-branding too.

I just tried again from home (previous attempt was from work). The page runs smoothly at 4:00 GMT ;).

Again, I didn't get that message, but the system seems to have recognized me:


After submitting a new form from this IP, now I have:


So I'm confident my request has been proceesed, even if not receiving any "Your request is pending review" message. Maybe my request will be automatically processed, taking into account that my original password was good enough. Who knows.

There are two different submit buttons! From what you are describing it seems that you have added a second prove to your list (submit button at the bottom) but did not send the actual request yet (upper submit button).
When your request was successfully added to the queue, the site won't show you that "Proof provided so far" list anymore. instead it will look like this:

http://img121.imageshack.us/img121/7381/claimsubmitted.jpg

Oh I see...  Thank you very much!!

I FIXED "The password for this account is invalid, or this account is not currently under claim process." 

They are referring to the new password, at least I think so, because I was using a 15 character "new password" and I was getting this, but then I used a 28 character one, and I was able to go to step 2!!!!

I applied for my account reactivation today, now I go to update it and it says "No user with email address ******@*********.com"

....wtf?  Yes there is!

I filed the claim over 24 hrs ago.  Should I have received an email by now?  Has anyone got confirmation that their claim was completed?

Easy way to generate a password:

Generate new address in your wallet. Use it as a password. Mark it as such in the wallet.

Bazinga.

Me neither - think IF something is wrong, you'll get one, if not you're able to log in tomorrow.

when i try to check my reques it says "No registered user found with email address"
Wth?

This is what i got from the support:


Hello,

Before 3:00 GMT on Friday June 24th you will receive an email from us advising that either


A) Your claim was successful and you can login to Mt.Gox once the site is up.

or,

B) We require more information to process and authorize your claim.


We appreciate your continued patience as we work to get everything back online.

Thanks,

MtGox.com Team

So we have to wait :-)

I got an "update" on my claim after 2 days, saying that I didn't provide enough proof and my account cannot be reclaimed. Even though I provided info on my what I remember to be my last balance, IP, *and* bank account I withdraw my funds to. How is that insufficient proof?

Thats strange.. got a positive reclaim status - listed last balance and last transaction status out of my btc client as proof only. Got a pretty good password either.. maybe that is why.

I got rejected as well, using very close approximate balance (I forgot some of the cents), Dwolla ID, and amounts of deposits.

This process is absurd if that wasn't good enough to get it.  There was only a way to add information (LR, IP Address, etc...), but not to modify existing information.  I just submitted another claim, but accidentally submitted after only putting in my Dwolla ID.

There should be an option just to return all funds to the last place they were sent (or even the first).  I just want my Bitcoins and money back.

I didnt recive anything from mtgox.... has everybody else managed to recover their account?
should I worry???
I agree that they should provide a option to send the BTC back to where it was sent from, so I dont have to wait for this recovery BS
thanx in advance!