Bitcoin Forum
November 25, 2017, 11:53:43 AM *
News: Latest stable version of Bitcoin Core: 0.15.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: « 1 2 [3] 4 5 6 7 »  All
  Print  
Author Topic: Just lost 190 bitcoins through Mt. Gox  (Read 6624 times)
avegetable
Member
**
Offline Offline

Activity: 77


View Profile
February 08, 2013, 12:40:38 PM
 #41



This is very much true! There is no reason why they don't have options to lock IP and/or bitcoin address.


Locked IP is an interesting option. Does any other company offer that?

It does require a little technical knowledge from the users. People with dynamic IPs would have to specify an IP address range. Or several IP ranges for many ISPs.

It could prevent most unauthorized access (though not when the user's PC is hijacked and remove controlled), but there would also be a lot of extra support problems for Mtgox because of users accidentally locking themselves out of their own accounts.

1511610823
Hero Member
*
Offline Offline

Posts: 1511610823

View Profile Personal Message (Offline)

Ignore
1511610823
Reply with quote  #2

1511610823
Report to moderator
Join ICO Now A blockchain platform for effective freelancing
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1511610823
Hero Member
*
Offline Offline

Posts: 1511610823

View Profile Personal Message (Offline)

Ignore
1511610823
Reply with quote  #2

1511610823
Report to moderator
1511610823
Hero Member
*
Offline Offline

Posts: 1511610823

View Profile Personal Message (Offline)

Ignore
1511610823
Reply with quote  #2

1511610823
Report to moderator
Prattler
Full Member
***
Offline Offline

Activity: 192


View Profile
February 08, 2013, 01:05:41 PM
 #42

Quote from: avegetable link=topic=141831.msg1512094#msg1512094
Locked IP is an interesting option. Does any other company offer that?

It does require a little technical knowledge from the users. People with dynamic IPs would have to specify an IP address range. Or several IP ranges for many ISPs.

It could prevent most unauthorized access (though not when the user's PC is hijacked and remove controlled), but there would also be a lot of extra support problems for Mtgox because of users accidentally locking themselves out of their own accounts.

Just something as simple as send a warning email and allow cash out after 2+ days, if your IP is new.
Zomdifros
Full Member
***
Offline Offline

Activity: 210



View Profile
February 08, 2013, 01:22:01 PM
 #43


Locked IP is an interesting option. Does any other company offer that?



Yes, Blockchain does. However, as Prattler states, a simple email warning plus temporary lock for new IP's would be sufficient for now and must be quite easy to implement. It would of course increase the amount of work for their customer service but then again, if MtGox wants to remain the largest Bitcoin exchange in a few years time (and ultimately make an obscene amount of money), now would be the time to invest in their service.

Bitsaurus
Hero Member
*****
Offline Offline

Activity: 862



View Profile
February 08, 2013, 01:37:10 PM
 #44

Funny that the mining pools seem to have more safety lockouts than MtGox does.
avegetable
Member
**
Offline Offline

Activity: 77


View Profile
February 08, 2013, 01:45:10 PM
 #45

Funny that the mining pools seem to have more safety lockouts than MtGox does.

It's not such a surprise. It's generally a good thing for Mtgox if as many people as possible sign up. A nice security feature that tends to lock idiots out of their own accounts won't help them achieve that.

For a mining pool on the other hand, having a feature that deters the less tech-savvy is probably good
robocoin
Sr. Member
****
Offline Offline

Activity: 252



View Profile
February 08, 2013, 01:46:35 PM
 #46


Let me guess.... no two factor authentication?


how I can activate two factor authentication on mtgox?


ID verify your Mt.Gox account, you should than receive the offer to obtain a yubikey - FOR FREE.

DeathAndTaxes
Donator
Legendary
*
Offline Offline

Activity: 1218


Gerald Davis


View Profile
February 08, 2013, 02:00:50 PM
 #47

That point is of course quite true, however, it is basically illegal to send money through the mail for that very reason.

In the US it isn't illegal to send cash in the mail.  Never has been, just an urban legend.  Now the USPS recommends you don't send cash in the mail unless you send it registered mail as it isn't insured but the same applies to other valuables as well.

Quote
Bitcoin is not going to win any supporters if it just takes the attitude "sorry but you are just too stupid to use this" (this last was about attitude at not any sort of attack on the OP btw).

I think the larger point is that MtGox has offered 2FA for what two years now.  Despite the never ending stream of "my coins are gone" posts they all have one thing in common ... 2FA wasn't enabled.  I don't think anyone said "too stupid" but if your house comes equipped with the ability to lock the doors but you choose not to and then get robbed well ...  Now if MtGox provided no mechanism to keep balances safe that would be a different story but they do.  Despite all the prior losses it seems people just refuse to accept that passwords are insecure.  That is why 2FA exists.

Zomdifros
Full Member
***
Offline Offline

Activity: 210



View Profile
February 08, 2013, 02:36:27 PM
 #48


Bitcoin is not going to win any supporters if it just takes the attitude "sorry but you are just too stupid to use this" (this last was about attitude at not any sort of attack on the OP btw).

I think the larger point is that MtGox has offered 2FA for what two years now.  Despite the never ending stream of "my coins are gone" posts they all have one thing in common ... 2FA wasn't enabled.  I don't think anyone said "too stupid" but if your house comes equipped with the ability to lock the doors but you choose not to and then get robbed well ...  Now if MtGox provided no mechanism to keep balances safe that would be a different story but they do.  Despite all the prior losses it seems people just refuse to accept that passwords are insecure.  That is why 2FA exists.



Sure, they offer 2FA, but as a customer you pretty much have to find it out yourself. With a regular bank account it isn't even possible to make a withdrawal without 2FA in some form, it is a hard requirement. If we want Bitcoin to emerge from the niche it is in right now, everybody should be able to use it safely, even those who don't understand what 2FA is or why they need it, they should simply be forced to use it.

robocoin
Sr. Member
****
Offline Offline

Activity: 252



View Profile
February 08, 2013, 02:38:41 PM
 #49

Bitcoin is not going to win any supporters if it just takes the attitude "sorry but you are just too stupid to use this" (this last was about attitude at not any sort of attack on the OP btw).

I think the larger point is that MtGox has offered 2FA for what two years now.  Despite the never ending stream of "by coins are gone" posts they all have one thing in common ... 2FA wasn't enabled.  I don't think anyone said "too stupid" but if your house comes equipped with the ability to lock the doors but you choose not to and then get robbed well ...  Now if MtGox provided no mechanism to keep balances safe that would be a different story.

Everything is there you need. Maybe force 2FA for accounts with balances greater than 50 BTC.

Once I got ripped off 500€ from my bank account (bancomat skimmer), my bank immediatly compensated it. BUT if an attacker has your bank login AND your mobile phone is infected so the attcker can read your sms to retrieve the TAN numbers (mandatory 2FA here in Germany). Well, then you're on your own... I imagine there will be bank like Bitcoin systems in the future, eg. BitcoinCentral, just to be insurred against stuff like this.
40 years ago people did only brain fart in front of a computer. Secruity, cryptography and general awareness of computer systems will be more common for the "John Q. Public's" in near future. Its not that Bitcoin and the systems around it need to adjust itself down to "anyone's" abilities. Its more like that society will adjust itself to the level needed for Bitcoin.
Stephen Gornick
Legendary
*
Offline Offline

Activity: 2324



View Profile
February 08, 2013, 03:02:35 PM
 #50

Maybe force 2FA for accounts with balances greater than 50 BTC.

Yup, or some checkbox that says "I ACKNOWLEDGE THAT 2FA IS RECOMMENDED BUT DECLINE THE RECOMMENDATION."


Because there a lot of that going on.

MtGox account got cleared out
 - http://bitcointalk.org/index.php?topic=85533.0

All BTC disappeared from my Mt. Gox account
 - http://bitcointalk.org/index.php?topic=88368.0

Another:
 - http://bitcointalk.org/index.php?topic=80562.msg941759#msg941759

And another: My mtgox account got compromised, what can I do?
 - http://bitcointalk.org/index.php?topic=84585.0

Yet more: MT.Gox account hacked - lost 2k USD - MT.GOX will not explain how.
 - http://bitcointalk.org/index.php?topic=89142.0

And more again: Bitcoins stolen from MtGox
 - http://www.reddit.com/r/Bitcoin/comments/x8lcv/bitcoins_stolen_from_mtgox

And yet more: Stolen from Mt.Gox coins. Help return the coins.
 - http://bitcointalk.org/index.php?topic=119816.0

Or more here: Email from Mt.Gox this morning.
 - http://www.reddit.com/r/Bitcoin/comments/z0na5/email_from_mtgox_this_morning

And even more here: I just had $715 stolen out of my Mt. Gox account.
 - http://www.reddit.com/r/Bitcoin/comments/12j9gi/i_just_had_715_stolen_out_of_my_mt_gox_account

And the biggie: Bitcoinica MtGox account compromised
 - http://bitcointalk.org/index.php?topic=93074.0

With more here: Unauthorized Account Activity on my Mt.Gox Account - Account Compromised/Hacked?
 - http://bitcointalk.org/index.php?topic=94140.0

And even more: *MY* Mt Gox Account was Hacked - lost it all today... now what!?
 - http://bitcointalk.org/index.php?topic=137795.0

Ditto: My MtGox account was just exploited - 3 BTC stolen
 - http://bitcointalk.org/index.php?topic=141816.0

And now this one gets added to the list: Just lost 190 bitcoins through Mt. Gox
 - http://bitcointalk.org/index.php?topic=141831.0

And on other services as well. Here same thing happened to some GLBSE users:
 - http://bitcointalk.org/index.php?topic=84893.0

And elsewhere, BitMarket.eu in this instance:
 - http://bitcointalk.org/index.php?topic=5441.msg1259168#msg1259168

And now on bitcoin.de as well: Bitcoins stolen from bitcoin.de.
 - http://bitcointalk.org/index.php?topic=130264.0

In none of these was the person using multi-factor authentication. Mt. Gox has had Yubikey support for a while. Mt. Gox accounts now support Google Authenticator:
 - https://mtgox.com/press_release_20120605.html

If the exchange you are storing funds with doesn't provide OTP, consider using a different exchange:
 - http://bitcoin.stackexchange.com/questions/4113/which-two-factor-authentication-methods-are-available-at-which-exchanges

If you are storing funds in an EWallet, consider using a paper wallet.

Here is a fantastic guide: How to use 2-factor auth on mtgox, even without a smartphone (from a second device, of course, not from the same computer you log in on).
 - http://bitcointalk.org/index.php?topic=111943.0

CIYAM
Legendary
*
Offline Offline

Activity: 1862


Ian Knowles - CIYAM Lead Developer


View Profile WWW
February 08, 2013, 03:19:09 PM
 #51

I think the larger point is that MtGox has offered 2FA for what two years now.  Despite the never ending stream of "my coins are gone" posts they all have one thing in common ... 2FA wasn't enabled.

In regards to sending cash in Aus every *delivery* company makes it *clear* you *cannot* send cash (so maybe different to the US) and I'm not know talking about legality but instead about any guarantee of refund for losses incurred (IANAL).

Also in Australia (at least) even if your 2FA is compromised your bank is *insured* and you will likely be *refunded* for losses due to theft (unless they can pretty much *prove* you *stole* the funds yourself).

Mt. Gox offers 0% protection AFAIA (correct me if I am wrong) and that is my point (no "mom's and dad's" are going to invest in something with zero guarantee in case of theft when there is a guaranteed option available and nor should they).

With CIYAM anyone can create 100% generated C++ web applications in literally minutes.

GPG Public Key | 1ciyam3htJit1feGa26p2wQ4aw6KFTejU
sublime5447
Hero Member
*****
Offline Offline

Activity: 784



View Profile
February 08, 2013, 04:40:16 PM
 #52

Pay pal locks out based on IP address, If I try to access from a strange IP it ask me a security question. MT gox doesn't give a shit because they have zero liability. To all the tech guys talking about yubikeys and 2fa nerd stuff you dont get it people aren't going to do that. This thing only works if people use it. I am shocked to see the bitcoin faith in here. It is all worthless if people dont adopt it. If you think bitcoin is a retirement plan you are out of your mind.

COBINHOOD – ZERO TRADING FEE CRYPTOCURRENCY EXCHANGE 
slack
Telegram
rollingpaperguy
Newbie
*
Offline Offline

Activity: 22


View Profile
February 08, 2013, 04:44:23 PM
 #53

My guess is that you used the same email and password as you used somewhere else....mtgox might be tough to crack...but any other website, not so much.

Make sure your bitcoin wallet and bitcoin accounts all have different passwords.
mintymark
Sr. Member
****
Offline Offline

Activity: 278


View Profile
February 08, 2013, 05:21:24 PM
 #54

I think this is truly sickening, and I am very sorry to hear about it. If normal people make mistakes that end up in financial loss, then there is the suggestion that you need to be "superman" in order to avoid this. Well I for one am not!

Goldmoney, and most banks banks do offer better security here, and (in my view) the reason this happened is because MtGox is not offering reasonable security here. Other exchanges such as Bitstamp are equally vulnerable.

Goldmoney sends an email pin, and disallows email changes. (Or maybe slows them down, I dont remember.)

I think IP address locking is also very useful. You could also do it based on geo-location based on IP address. Someone in Sweden wants a withdrawal? Well I live in the USA and sometimes fly to London, so do not accept it from anywhere else!!  Challenge response is also useful.

There are lots of ways to do this well it seems to me and it seems to me that many Bitcoin exchanges are not doing it well right now. The non-reversability of Bitcoin means it needs to be done better than the companies doing fiat transactions do!! 


[[ All Tips gratefully received!!  ]]
15ta5d1N8mKkgC47SRWmnZABEFyP55RrqD
sublime5447
Hero Member
*****
Offline Offline

Activity: 784



View Profile
February 08, 2013, 06:39:03 PM
 #55

I think this is truly sickening, and I am very sorry to hear about it. If normal people make mistakes that end up in financial loss, then there is the suggestion that you need to be "superman" in order to avoid this. Well I for one am not!

Goldmoney, and most banks banks do offer better security here, and (in my view) the reason this happened is because MtGox is not offering reasonable security here. Other exchanges such as Bitstamp are equally vulnerable.

Goldmoney sends an email pin, and disallows email changes. (Or maybe slows them down, I dont remember.)

I think IP address locking is also very useful. You could also do it based on geo-location based on IP address. Someone in Sweden wants a withdrawal? Well I live in the USA and sometimes fly to London, so do not accept it from anywhere else!!  Challenge response is also useful.

There are lots of ways to do this well it seems to me and it seems to me that many Bitcoin exchanges are not doing it well right now. The non-reversability of Bitcoin means it needs to be done better than the companies doing fiat transactions do!! 



100% agreed  couldn't have said it better. It bugs me when someone has been taken advantage of and there is a huge outcry blaming the victim. Basically the claim goes like this.. It is your fault for not being a big enough tech nerd. It you read wired magazine everyday and spent 90 percent of your time online learning about bitcoin like I do then you wouldnt have gotten scammed. Bitcoin is beyond reproach and the community shares no blame. 

COBINHOOD – ZERO TRADING FEE CRYPTOCURRENCY EXCHANGE 
slack
Telegram
SgtSpike
Legendary
*
Offline Offline

Activity: 1358



View Profile
February 08, 2013, 06:46:58 PM
 #56

I think this is truly sickening, and I am very sorry to hear about it. If normal people make mistakes that end up in financial loss, then there is the suggestion that you need to be "superman" in order to avoid this. Well I for one am not!

Goldmoney, and most banks banks do offer better security here, and (in my view) the reason this happened is because MtGox is not offering reasonable security here. Other exchanges such as Bitstamp are equally vulnerable.

Goldmoney sends an email pin, and disallows email changes. (Or maybe slows them down, I dont remember.)

I think IP address locking is also very useful. You could also do it based on geo-location based on IP address. Someone in Sweden wants a withdrawal? Well I live in the USA and sometimes fly to London, so do not accept it from anywhere else!!  Challenge response is also useful.

There are lots of ways to do this well it seems to me and it seems to me that many Bitcoin exchanges are not doing it well right now. The non-reversability of Bitcoin means it needs to be done better than the companies doing fiat transactions do!! 



100% agreed  couldn't have said it better. It bugs me when someone has been taken advantage of and there is a huge outcry blaming the victim. Basically the claim goes like this.. It is your fault for not being a big enough tech nerd. It you read wired magazine everyday and spent 90 percent of your time online learning about bitcoin like I do then you wouldnt have gotten scammed. Bitcoin is beyond reproach and the community shares no blame. 
I'll agree with you here!

MtGox needs to implement better security options.  Withdrawal locks based on IP, email, and time should all be available options to users.  I would be so much more comfortable with putting funds on MtGox if I knew they couldn't be withdrawn to a different address other than what I've specified without email confirmation and a 7-day delay.  And I even have a yubikey required for logging in and withdrawal already!
farlack
Legendary
*
Offline Offline

Activity: 882



View Profile
February 08, 2013, 07:37:35 PM
 #57

I've read a 2F get hacked too. I bet its gox themselves..

I mean come on whats the likelihood of 7.6 billion people and only a few thousand that use bitcoin and all these gox hacks going around.


Id like to see a huge list of reports of peoples wallets on their computer, or blockchain.info getting fucked.

Zomdifros
Full Member
***
Offline Offline

Activity: 210



View Profile
February 08, 2013, 07:40:21 PM
 #58

I think this is truly sickening, and I am very sorry to hear about it. If normal people make mistakes that end up in financial loss, then there is the suggestion that you need to be "superman" in order to avoid this. Well I for one am not!

Goldmoney, and most banks banks do offer better security here, and (in my view) the reason this happened is because MtGox is not offering reasonable security here. Other exchanges such as Bitstamp are equally vulnerable.

Goldmoney sends an email pin, and disallows email changes. (Or maybe slows them down, I dont remember.)

I think IP address locking is also very useful. You could also do it based on geo-location based on IP address. Someone in Sweden wants a withdrawal? Well I live in the USA and sometimes fly to London, so do not accept it from anywhere else!!  Challenge response is also useful.

There are lots of ways to do this well it seems to me and it seems to me that many Bitcoin exchanges are not doing it well right now. The non-reversability of Bitcoin means it needs to be done better than the companies doing fiat transactions do!! 



100% agreed  couldn't have said it better. It bugs me when someone has been taken advantage of and there is a huge outcry blaming the victim. Basically the claim goes like this.. It is your fault for not being a big enough tech nerd. It you read wired magazine everyday and spent 90 percent of your time online learning about bitcoin like I do then you wouldnt have gotten scammed. Bitcoin is beyond reproach and the community shares no blame. 
I'll agree with you here!

MtGox needs to implement better security options.  Withdrawal locks based on IP, email, and time should all be available options to users.  I would be so much more comfortable with putting funds on MtGox if I knew they couldn't be withdrawn to a different address other than what I've specified without email confirmation and a 7-day delay.  And I even have a yubikey required for logging in and withdrawal already!

So, I guess we all agree that MtGox is making a half-assed job of their security, can anybody tell us why they aren't upgrading this?

gweedo
Legendary
*
Offline Offline

Activity: 1246


Java, PHP, HTML/CSS Programmer for Hire!


View Profile WWW
February 08, 2013, 07:45:31 PM
 #59

So, I guess we all agree that MtGox is making a half-assed job of their security, can anybody tell us why they aren't upgrading this?

Half-assed job of security is kinda strong don't you think? I mean where does security on the consumer side start? 2 factor auth is the saving grace if you don't have that you can kiss your coins goodbye. Then you don't need all those bells and whistles which would probably cause more issues then they are worth. I think as long as Mt Gox isn't getting hack and leaking bitcoins from there wallet, I say security is good then. Take some responsibility, don't make Mt Gox your mom.

Want to earn 2500 SATOSHIS per hour? Come Chat and Chill in https://goseemybits.com/lobby
SgtSpike
Legendary
*
Offline Offline

Activity: 1358



View Profile
February 08, 2013, 07:46:35 PM
 #60

So, I guess we all agree that MtGox is making a half-assed job of their security, can anybody tell us why they aren't upgrading this?

Half-assed job of security is kinda strong don't you think? I mean where does security on the consumer side start? 2 factor auth is the saving grace if you don't have that you can kiss your coins goodbye. Then you don't need all those bells and whistles which would probably cause more issues then they are worth. I think as long as Mt Gox isn't getting hack and leaking bitcoins from there wallet, I say security is good then. Take some responsibility, don't make Mt Gox your mom.
People WANT to take some responsibility, they just want more options to do it.  2FA is good for some things, but having some way to delay withdrawals to a new address seems like a sensible option to add.
Pages: « 1 2 [3] 4 5 6 7 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!