Bitcoin Forum

Any one else get this from MTGOX?
Thank you for your support and for using MtGox.

We appreciate your presence and would like today to give you
a free Yubikey. Considering recent problems with hacked accounts,
hacked computers and more, we see the Yubikey as a good step
toward better security.

You can read more on the Yubikey from the Yubico website:
http://www.yubico.com/ - note that the yubikey we sell is only
usable on MtGox.


To receive your free yubikey, you just need to login on mtgox.com,
click "Order a Yubikey" in the menu, choose if you want either a
yubikey with our logo or not, and on the next page enter the
following code:

Yep I got one. This is most likely going to get moved by the way.

How right you are.  ;)

On an on-topic note, I got one too...

I thought I was old school enough to get one :/

I sent off for mine as well.

And the "following code" is ?

+1

GOXED-GOXED-GOXED-GOXED

It might help if you read the rest of the email...

I have been on gox for a while, but did not get one either.  :(

;D


BTW, I got one too

I got one also.  I have been on there for quite a while.  Perhaps it is volume related as to whom gets a key?

It's not volume-related, and being "old school" has nothing to do with it either. Free Yubikeys are given to people who had a transaction rolled back back when prices dropped to $0.01

I received this email but I can't see where is this "Order a Yubikey" in the menu... Can anyone help?

Just click the Add Yubikey button wich is located in the security area.
Here you are able to buy a Yubikey where you enter the coupon code.
I acknowledge it's again pretty vague from Mtgox since the 'Order a Yubikey' button doenst exist in the security area.

I also got a email.
Not sure why they do this now.
Maybe they notice btc-e, bitstamp, bitfloor and intersango are pulling volume away.
And since they don't want that they are acting they feel sorry for the people who where in the leaked database list.

Ok, I just ordered my free yubikey :-)

I got that email today also, looking forward to getting mine in the post :)  Even though they say it can only be used with Mt.Gox it looks like you can also use them with a blockchain.info wallet.

https://blockchain.info/wallet/yubikey

I got the email also and ordered my free yubikey :)

You, sir, are a bullshitter.
Edit: I take it back. As rjk points out below, this was an old, revived thread.

My understanding was that a MtGox Yubikey was a Yubikey with an AES key put into it by MtGox.  Actually, that's two AES keys - one for the short press (logging in), and one for the long press (withdrawing funds).

AES is a symmetric algorithm - in this case, I understand this to mean that MtGox and the key know the same secret number.

That said, I don't understand how can a third party make use of a MtGox Yubikey without knowing that number?

Read the post date - August 2011. It was true then, although it may be unrelated now. It's a shame that they have to give them away instead of people being smart enough to order them in the first place. They really don't cost much when you buy them, but it does cost mtgox a lot just to give them away en masse.

I believe that you can validate against a given authentication server without needing to know the secret.

Yes. The same way that you can authenticate a generic Yubikey against the YubiCloud without knowing the private key that is pre-programmed in the 1st slot, you should be able to authenticate a Mt.Gox Yubikey if you have been given access to their authentication server.

I got one too.... Dunno if I'll use it (eggs/basket etc), but it's free :)

Are we 100% sure this is from Mt.Gox and not a phishing expedition.

Thanks. Just in case I get such an offer. :'(   

I got a free one from Gox too 2-3 months ago. They sent it straight from Japan in some cool Japanese envelopes with a crazy amount of tickboxes on it. (all the customs declarations)

;D I actually paid for mine, and I got 2 in the mail, one had someone else's name lol. Whoops.

Alright, yubikey will protect my account in case a keylogger is running on my computer. Is that all? How about the security of gox android app?

Also arrived in Holland. Thanks Mtgox. Though, it's not working for some reason. It's not generating a OTP. =/

Make sure the USB keyboard driver gets installed when you plug it in. It might take a few seconds to be detected. You can play with it in an instance of a text editor such as notepad. A short press means hold for half a second, you can't just tap it real quick. A long press means hold it for 3.5 sec or so, but if you hold it too long it might not go.

Where can I find this driver? It's not on the homepage of yubico for instance.

It should install itself as a standard USB keyboard or HID device, there isn't a driver to download.

Thats weird, it's not doing anything when I connect it.
Tried multiple USB input ports.

Edit: nvm.. its working now. Weird.

wow very fast delivery just 5 days
arrived today . Thanks Mtgox.
http://cl.ly/HqCE/MtGox.png

Does it actually protect you from key logger  ? Mine gets installed as HID device.. i would imagine key logger could see the output ? same as a keyboard ??

The idea behind it is that each password it generates can only used one time.  Every time you press that button a new password is generated, and as long as the most recent one was used to log into Mt.Gox any old ones will be invalid.  Someone will need physical access to your yubikey to log into your account.

However if you like to play around with your new yubikey and watch it type random passwords in notepad, an attacker could use one of these passwords to log into your account.  Always make sure you log into your Mt.Gox account with the last password generated by your yubikey and do not generate any more yubikey passwords after you log in!

Good point. On a related note, how much ahead from the last used password does their server try going to match my input? If I use the otp once, log off, then generate a seqence of 15 OTPs offline, will gox keep going 16 times the next time I log in? Or does yubi broadcast a serial number with the OTP?

The Yubikey output contains the serial number, an OTP, an incrementing counter, and possibly some other things that I have forgotten. It is not time limited, so you could generate (say) 15 OTPs in a row from an offline computer, and record them on a bit of paper for later use, as long as they were used sequentially. This would work, but it would be tedious to type in every time.

Got it, the counter. Thanks.

The other thing is that you can skip OTPs if you want to, because of that counter. Therefore, you could generate a bunch of keys, but as soon as you used key #15 from the example above, all the previous ones would become invalid unless you had used them in sequence.

From the blockchain website: