|
Title: Mtgox's 2 Factor Authentication: Yubikeys Post by: csshih on July 06, 2011, 01:21:45 AM Hey All,
I just wanted to post some pictures of the Yubikey I got from Mtgox - Mark is currently running a beta test to ~50 people to work out the bugs. http://www.incoherentphotography.com/uploads/SS-2011-07-05_17.56.02.jpg the QR code and serial are obfuscated for security purposes ;) http://www.incoherentphotography.com/uploads/SS-2011-07-05_17.57.58.jpg purchasers will get a nice Mtgox lasered one, I believe. sorry about the image, my camera is out for repair. http://www.incoherentphotography.com/uploads/SS-2011-07-05_17.59.55.jpg The yubikey is recognized as a USB input device. All I have to do is touch the contact (the glowing part) and it'll enter in a code, and press enter. If you have yubikeys enabled on your account, you are greeted with this message AFTER you log in with your username and password. http://www.incoherentphotography.com/uploads/SS-2011-07-05_18.01.54.jpg I was able to log in using nothing in the yubikey authentication box until I used the yubikey for the first time. Pressing only enter would kick me back log-in screen (I would have to enter in username and password again) What I observed: 1. Keys cannot be used twice 2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid. 3. I'm not sure when the keys expire after generation. More to come as I poke around more. Edit: Oh yeah, Mtgox will be selling them for 29.99 shipped. BTC accepted, of course. ;) Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: Superform on July 06, 2011, 03:16:42 PM cant wait.. mt gox really is lifting its game
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: datguywhowanders on July 06, 2011, 05:05:10 PM Very interesting. Thanks for the post and please keep us informed as you run it through initial tests.
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: cypherdoc on July 06, 2011, 05:41:40 PM yes, i installed mine yesterday and it works as you described. i'll add that Mark said yesterday that Withdrawal will be added shortly.
when you speak of "keys", do u mean the series of letters entered into the OTP box by the Yubikey? how do you know how many of them there are? i also noted they're just alpha and was surprised it didn't generate numerics in the password as well. whats the purpose of the QR code? i don't understand what you mean by the following. can u expound on each of them please?: "1. Keys cannot be used twice 2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid. 3. I'm not sure when the keys expire after generation." Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: Jine on July 06, 2011, 11:12:23 PM Funny! :) I actually my self ordered a YubiKey just a couple of days ago - arrived today.
We're implementing it at Bitcoins.lc as we speak. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: MagicalTux on July 07, 2011, 12:17:22 AM yes, i installed mine yesterday and it works as you described. i'll add that Mark said yesterday that Withdrawal will be added shortly. when you speak of "keys", do u mean the series of letters entered into the OTP box by the Yubikey? how do you know how many of them there are? i also noted they're just alpha and was surprised it didn't generate numerics in the password as well. whats the purpose of the QR code? i don't understand what you mean by the following. can u expound on each of them please?: "1. Keys cannot be used twice 2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid. 3. I'm not sure when the keys expire after generation." The code input is made of letters only, and only some letters to be keymap-independent (this way even if your computer is configured for azerty or qwerty, it'll work fine). The string is in fact hexadecimal (yubico calls this "modhex", modified hexadecimal) and is a 22 bytes string made of 6 fixed bytes, and 16 bytes which are various informations encrypted with AES128. The auth server has a copy of the 128bits key used on the yubikey, and will try to decrypt the string. It'll then check counters in there and will only accept the code if its counter is higher than the last seen code. It means:
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: Jine on July 07, 2011, 01:04:31 AM A question to you MT - are you using your own key/validationserver?
I've gotten a couple of questions if It's possible to use the same key for both Bit LC and MTGox - and it all depends on if you're using yubicloud or not. In either way - the MTGox-keys are based upon YubiKey 2.2 if i see correctly - which supports double identities - so it should not be a issue anyway. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: TheMartin on July 07, 2011, 03:52:27 AM Thanks for the info:
If you have yubikeys enabled on your account, you are greeted with this message AFTER you log in with your username and password. http://www.incoherentphotography.com/uploads/SS-2011-07-05_18.01.54.jpg Will this yubikey be used for login only or to authenticate orders too? I think only the latter would be safe when doing a BTC withdraw for example on a corrupted PC Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: danf on July 07, 2011, 07:59:10 PM A question to you MT - are you using your own key/validationserver? I've gotten a couple of questions if It's possible to use the same key for both Bit LC and MTGox - and it all depends on if you're using yubicloud or not. In either way - the MTGox-keys are based upon YubiKey 2.2 if i see correctly - which supports double identities - so it should not be a issue anyway. Yubico replied to my tweet to Mt. Gox: Quote I think MtGox use their own validation server and not the YubiCloud. John. You can see the tweet here (https://twitter.com/Yubico/status/88462229392998400). Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: MagicalTux on July 08, 2011, 12:04:27 AM For information it is now possible to order the yubikeys on mtgox, after logging in.
We are currently evaluating the possibility of selling half-locked keys that would be usable with yubicloud, and with other yubikey-enabled websites, which may be less secure as a rogue site could use your login token to login on mtgox instead of validating it with yubicloud. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: Oldminer on July 08, 2011, 01:05:42 AM Hey MT, is there a shipping fee for international buyers or is it included in the cost?
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: MagicalTux on July 08, 2011, 02:58:01 AM Hey MT, is there a shipping fee for international buyers or is it included in the cost? The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: JoelKatz on July 08, 2011, 03:03:04 AM What scheme is Mt. Gox using? Are they using Yubikey's verification servers? Do they generate the key and burn it into the token themselves? Or can the user program the token?
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: error on July 08, 2011, 03:21:28 AM This really needs a smartphone app. :)
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: haydent on July 08, 2011, 03:32:35 AM Hey MT, is there a shipping fee for international buyers or is it included in the cost? The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax. what happened to the offer to give these away you made on onlyonetv bitcoin show when your site was hacked. you said they would be free to peeps who had trades reversed, ie inconvenienced.. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: MKW2012 on July 08, 2011, 04:10:16 AM Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: haydent on July 08, 2011, 05:33:20 AM Hey MT, is there a shipping fee for international buyers or is it included in the cost? The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax. what happened to the offer to give these away you made on onlyonetv bitcoin show when your site was hacked. you said they would be free to peeps who had trades reversed, ie inconvenienced.. i stand corrected, they are free if your account was affected like mine ! http://image.bayimg.com/bajgkaada.jpg Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: JoelKatz on July 08, 2011, 05:41:52 AM This really needs a smartphone app. :) If Gox lets you program your own Yubikey, you can do the same thing without a Yubikey. The algorithm is public and well-documented. It's basically just AES.Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: Randall Flagg on July 09, 2011, 12:04:45 AM Woah ! nice gift this is from MtGox !!! Ordered mine, but bye bye anonymity ahah
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: MagicalTux on July 09, 2011, 06:16:12 AM What scheme is Mt. Gox using? Are they using Yubikey's verification servers? Do they generate the key and burn it into the token themselves? Or can the user program the token? We use our own AES keys (two random AES key by user) and burn the tokens. We will provide in the future an option to unlink a token and retrieve the keys & programming codes. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: drrussellshane on July 09, 2011, 06:24:34 AM Hey MT, is there a shipping fee for international buyers or is it included in the cost? The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax. what happened to the offer to give these away you made on onlyonetv bitcoin show when your site was hacked. you said they would be free to peeps who had trades reversed, ie inconvenienced.. i stand corrected, they are free if your account was affected like mine ! http://image.bayimg.com/bajgkaada.jpg That's cool. I'm still locked out of my account! :( Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: csshih on July 09, 2011, 10:13:42 AM hope that is fixed soon.
The only issue I have with my yubikey is that it keeps disappearing on my desk. ::) Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: jasonk on July 09, 2011, 10:22:01 AM hope that is fixed soon. The only issue I have with my yubikey is that it keeps disappearing on my desk. ::) User error! ;D Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: csshih on July 09, 2011, 10:23:34 AM hope that is fixed soon. The only issue I have with my yubikey is that it keeps disappearing on my desk. ::) User error! ;D yes, "ID 10 T" error here. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: error on July 09, 2011, 06:28:03 PM I had nothing to do with it!
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: haydent on July 10, 2011, 12:07:15 AM What scheme is Mt. Gox using? Are they using Yubikey's verification servers? Do they generate the key and burn it into the token themselves? Or can the user program the token? We use our own AES keys (two random AES key by user) and burn the tokens. We will provide in the future an option to unlink a token and retrieve the keys & programming codes. sounds good. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: csshih on July 10, 2011, 11:52:54 AM Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: Reckman on July 11, 2011, 04:53:59 PM Will the trading api still work if your account has a yubikey associated with it?
Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: MagicalTux on July 11, 2011, 10:20:05 PM Will the trading api still work if your account has a yubikey associated with it? Yep, except for withdraw. Once things are setup (this week) you'll be able to generate API keys for your account and define rights for each key, and stop using your login/pass to access the API. Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: phelix on January 08, 2012, 10:32:46 AM you might want to change your process such that you enable the yubikey login only after ensuring that the key arrived and the user got hold of it. I would suggest to make a yubikey entry from a logged in user necessary to activate yubikey authorization.
otherwise you will lock out customers with slow snail mail... at least waiting only two days until lock down is way short ::) Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: rjk on January 08, 2012, 12:10:50 PM you might want to change your process such that you enable the yubikey login only after ensuring that the key arrived and the user got hold of it. I would suggest to make a yubikey entry from a logged in user necessary to activate yubikey authorization. They already do this... Until you get your Yubikey and use it for the first time, just hit enter at the Yubikey prompt to bypass it.otherwise you will lock out customers with slow snail mail... at least waiting only two days until lock down is way short ::) Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: phelix on January 08, 2012, 02:17:54 PM you might want to change your process such that you enable the yubikey login only after ensuring that the key arrived and the user got hold of it. I would suggest to make a yubikey entry from a logged in user necessary to activate yubikey authorization. They already do this... Until you get your Yubikey and use it for the first time, just hit enter at the Yubikey prompt to bypass it.otherwise you will lock out customers with slow snail mail... at least waiting only two days until lock down is way short ::) sweet it works just fine ;D thanks! would have been nice to know up front, though - rtfm? no answer from gox for 40 hours ??? good thing I did not sell anything... Title: Re: Mtgox's 2 Factor Authentication: Yubikeys Post by: rjk on January 08, 2012, 02:25:54 PM you might want to change your process such that you enable the yubikey login only after ensuring that the key arrived and the user got hold of it. I would suggest to make a yubikey entry from a logged in user necessary to activate yubikey authorization. They already do this... Until you get your Yubikey and use it for the first time, just hit enter at the Yubikey prompt to bypass it.otherwise you will lock out customers with slow snail mail... at least waiting only two days until lock down is way short ::) sweet it works just fine ;D thanks! would have been nice to know up front, though - rtfm? no answer from gox for 40 hours ??? good thing I did not sell anything... |
