For information it is now possible to order the yubikeys on mtgox, after logging in.

We are currently evaluating the possibility of selling half-locked keys that would be usable with yubicloud, and with other yubikey-enabled websites, which may be less secure as a rogue site could use your login token to login on mtgox instead of validating it with yubicloud.

You can now order a yubikey if you have a Mt.Gox account and 29.99 USD or equivalent in bitcoins.

You can just login to Mt.Gox and click on "order a yubikey".

For the past weeks we have been focusing on improving the security on our site, both on our side, and on our users' side.

We have tested various options, and the yubikey was chosen as it is cost-effective and secure. Each time you use it, a 44 characters long code is inputted by your yubikey on your keyboard. This string is in fact the hexadecimal representation of an AES128 encrypted message that allows us to certify you are indeed you.

We will start shipping those today to people who have already ordered, and hve some stocks for the next days. So far it is difficult to know exactly how many people will order, swhich make it difficult to provide an estimate. We will  update as we receive more orders on the shipping delays.

When shipped you receive an URL to track your package.

The code input is made of letters only, and only some letters to be keymap-independent (this way even if your computer is configured for azerty or qwerty, it'll work fine). The string is in fact hexadecimal (yubico calls this "modhex", modified hexadecimal) and is a 22 bytes string made of 6 fixed bytes, and 16 bytes which are various informations encrypted with AES128.

The auth server has a copy of the 128bits key used on the yubikey, and will try to decrypt the string. It'll then check counters in there and will only accept the code if its counter is higher than the last seen code.

It means:

• A code cannot be used more than once
• Only a code more recent than the latest used code can be used
• A code will not expire in terms of time, but only if a more recent code is used on the site

Ticket located, and answer made. Please let us know if you do not receive your funds by 01:00GMT.

Hi,

Please contact us if your transfer takes more than a few days (usually 24hours max, lately we reached 3 days): there may be something wrong (LR API didn't reply, etc).

Anyway we have caught up on our LR withdraw delays today.

That's the question many here are asking, and while I can only do my best to reduce this every day, let me provide some stats.

We switched to ZenDesk from regular email support when we started reaching over ~200 emails per day, because it was way too much to handle. ZenDesk has nice reporting tools that allow us to see what's happening.

The event we had two weeks ago caused a huge spike in tickets, and switched our main priority from answering tickets (which we were still doing) to getting things back up.

We have hired some help, both permanent and temporary to keep with the current surge in tickets and keep up with the tickets in the future. Many of those tickets can be answered by some people after only a few hours of training ("how long does it take to withdraw to X?", "What is bitcoin?", "Why didn't you answer to my 6 previous tickets about why you didn't answer about my first ticket?", etc).

Let's start with resolution time as shown by ZenDesk. It's an important information. We try to resolve people's ticket (most of the time the resolution is just an automatic response about withdraw delays, what is bitcoin, etc).



We can see resolution time stalling around ~70 tickets solved per day for 20th week, and starting to go much higher starting on 27, once the site is back and we can start replying to everyone.

We are still really late on a lot of tickets, as can show this other set of values (source: GoodData with ZenDesk integration)



This is by week, and we can see  that last week (27th's week) we had a lot of activity, and there's still a lot remaining. I would say that all remaining tickets (there are about 1500 tickets waiting for reply at this time) will receive an answer by the end of the week middle of the month.

This all to say that everyone who contacted us will eventually get an answer. If your ticket was marked "solved" by error or because we believe your problem has been resolved (lots of "mtgox doesn't work" tickets) you can still re-open it easily. Please avoid opening more than one ticket for a given issue.

Neat, now just missing ability to read QR codes

It will not execute, and I told you it'll be fixed in a couple of hours. Thanks for disclosing this before.

Hi,

SEPA transfers are still handled. Please contact info@mtgox.com and include your withdraw reference for details.

You need to provide more infos, especially if the account has non-zero balances.

As for the "password strength" we compute it based on length and randomness

I see one possibility for this... I'll add a patch to see if it helps.

Even if it goes faster, we'll enable it with a lot of other people at the same time.

Our ToS writes hacking as included in Force Majeure. If you didn't read it that's your own problem.

"Force Majeure" is anything independ of us, not the same thing as "Act of God".

Please read what I say.

Let me quote a part of our generic terms of service about Force Majeure:


And another one:


We had no intention of getting this to happen, and we have followed every industry standard to make this secure. Despite this it happened. We have learnt new things (especially that lots of people want Bitcoin to disappear).

We will.

Some people did, we'll leave those as negative balance and count it as loss if not solved.

As for lawsuits we got threats only so far.

1000 BTC you had and lost, or 1000 BTC you gained from some guy selling at prices as low as 0.01 USD per btc?

1) Passing the verification may take some time if there is a lot of users. We'll try to make it as fast as possible.
2) No funds were stolen
3) Legal troubles?

Hi,

That's indeed from us.

If you reply to an email, make sure you reply to an @mtgox.com domain - should be safe (and never open any .rar or .exe files).