Bitcoin Forum
December 04, 2016, 06:02:57 AM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: « 1 [2] 3 »  All
  Print  
Author Topic: MtGox going to charge for 2 step authentication!  (Read 3940 times)
muad_dib
Member
**
Offline Offline

Activity: 84


View Profile
June 23, 2011, 11:13:08 AM
 #21


So you're saying that if I want to setup such a mechanism without relying on google accounts I need to modify the google authenticator for every single device I want to support ? (and then maintain the apps). Or am I missing something here ?



There are two parts in the google authenticator:

The PAM which needs to be configured on your website

The OTP generator on your phone.


You can take the  existing PAM examples or build your own, without relying on google accounts.

Anyhow, on android, you need a google account to download the app for your phone. But you can use the standard authenticator for your website, without having to maintain any app.


More infos here:

http://guides.webbynode.com/articles/security/ubuntu-google-authenticator.html

1480831377
Hero Member
*
Offline Offline

Posts: 1480831377

View Profile Personal Message (Offline)

Ignore
1480831377
Reply with quote  #2

1480831377
Report to moderator
1480831377
Hero Member
*
Offline Offline

Posts: 1480831377

View Profile Personal Message (Offline)

Ignore
1480831377
Reply with quote  #2

1480831377
Report to moderator
1480831377
Hero Member
*
Offline Offline

Posts: 1480831377

View Profile Personal Message (Offline)

Ignore
1480831377
Reply with quote  #2

1480831377
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1480831377
Hero Member
*
Offline Offline

Posts: 1480831377

View Profile Personal Message (Offline)

Ignore
1480831377
Reply with quote  #2

1480831377
Report to moderator
1480831377
Hero Member
*
Offline Offline

Posts: 1480831377

View Profile Personal Message (Offline)

Ignore
1480831377
Reply with quote  #2

1480831377
Report to moderator
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 23, 2011, 11:17:03 AM
 #22

Thanks a lot, I'll look into it

bitpop
Legendary
*
Offline Offline

Activity: 1918


https://keybase.io/bitpop


View Profile WWW
June 23, 2011, 12:02:43 PM
 #23

You need a google account to access the market and download the application,  and google authenticator is setup for gmail, but Google gives you all the source code, so you can have a parallel implementation independent from OpenID.
So you're saying that if I want to setup such a mechanism without relying on google accounts I need to modify the google authenticator for every single device I want to support ? (and then maintain the apps). Or am I missing something here ?


No, the only google thing required is the app from them which shouldnt be modified. I guess you kinda need an android and their market to get it, but you can also use blackberry.

Reputation  |  PGP  |  DigitalOcean  |  OpenVPN 2GB Free  |  TorGuard  |  Ethereum Classic
Bitcoin: 3DSh6AnmvBpDJFUz2mnLirMLmTMcFs9nDm
Bitmessage: BM-2cXN9j8NFT2n1FxDVQ6HQq4D4MZuuaBFyb
b1tc01n_wh0r3
Newbie
*
Offline Offline

Activity: 17



View Profile
June 23, 2011, 01:37:53 PM
 #24

Symantec VIP charge sites thousands, it may be nice but yubikey is just as good and FREE to websites.
So mt gox BETTER have us buy our own from yubikey, no reselling, then use it for FREE on their site.
It's free for them and it is SHADY to try to charge us, especially after what happened.

agree, especially after poor database security they should provide all these services for free to reclaim people's trust, otherwise, I think mtGox will not last long.

19HAcLfGD9FYs2Gt5cXMzmdFa1SQbxj7Mk
realnowhereman
Hero Member
*****
Offline Offline

Activity: 504



View Profile
June 23, 2011, 02:32:51 PM
 #25

For information:

The Google authenticator software essentially stores a per-account, per-application secret on your phone.  That secret is combined with the current time at a 30 second resolution to give a verification code.  I haven't looked at the details but I would guess is that this secret is the private half of an asymmetric key pair.

The verification code can then be thought of as the private-key signed digits of the current time.  Now, any site with the public key, including the site you are trying to log in to, can verify that code, demonstrating that you have possession of the secret (something you have is factor one).  This is usually combined with a password to make the second factor of the two factor authentication (something you know).

In this way, even if your account is hacked and the public half of the secret is known, there is no way for the attacker to get at the secret on your phone.  Hence they cannot make a valid login.

It's not a million miles off bitcoin transactions really is it? Smiley

To be honest I personally much prefer this idea of a bit of software running on my phone than another bit of electronics that I have to carry around.  I'm already carrying my phone, I don't want another gadget thanks.  This yubikey stuff is not the way.  Google authenticator is based on open standards and is available for free.

Update: http://tools.ietf.org/html/rfc4226

It seems to be a symmetric key instead of an asymmetric key.  Perhaps I'm misunderstanding, but doesn't that defeat the purpose?  We're just storing another password?

1AAZ4xBHbiCr96nsZJ8jtPkSzsg1CqhwDa
makomk
Hero Member
*****
Offline Offline

Activity: 686


View Profile
June 23, 2011, 03:33:10 PM
 #26

It seems to be a symmetric key instead of an asymmetric key.  Perhaps I'm misunderstanding, but doesn't that defeat the purpose?  We're just storing another password?
Most two-factor authentication schemes do use symmetric keys - it's the only way to create authentication codes that are actually short enough to type manually, I think. Even YubiKey is symmetric crypto. They're mainly designed to protect against password sniffing, though some have special hardware crypto modules that the server can store its copy of the shared secret in securely.

Quad XC6SLX150 Board: 860 MHash/s or so.
SIGS ABOUT BUTTERFLY LABS ARE PAID ADS
realnowhereman
Hero Member
*****
Offline Offline

Activity: 504



View Profile
June 23, 2011, 03:41:28 PM
 #27

It seems to be a symmetric key instead of an asymmetric key.  Perhaps I'm misunderstanding, but doesn't that defeat the purpose?  We're just storing another password?
Most two-factor authentication schemes do use symmetric keys - it's the only way to create authentication codes that are actually short enough to type manually, I think. Even YubiKey is symmetric crypto. They're mainly designed to protect against password sniffing, though some have special hardware crypto modules that the server can store its copy of the shared secret in securely.

In that case though, I don't understand what the advantage is?  Other than being an overly complicated way of forcing a secure password.

If someone has cracked a website and gotten the password database, then that database will include the shared key; and the attacker can just enter that shared key into their copy of the two factor authentication software.

Protection against password sniffing is already provided by SSL isn't it?

Passwords are already a form of symmetric key; so I'm confused as to what advantage two factor authentication is meant to give?

1AAZ4xBHbiCr96nsZJ8jtPkSzsg1CqhwDa
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 23, 2011, 03:49:25 PM
 #28

Passwords are already a form of symmetric key; so I'm confused as to what advantage two factor authentication is meant to give?
Passwords that are valid for 30 seconds only, generated by an app or a hardware device.
Having the database would be of no use in that regard.

muad_dib
Member
**
Offline Offline

Activity: 84


View Profile
June 23, 2011, 03:59:01 PM
 #29


Passwords that are valid for 30 seconds only, generated by an app or a hardware device.
Having the database would be of no use in that regard.

the symmetric key is used to initialize the stream of random passwords.

If you can intercept the key, you technically could duplicate the stream of one time passwords.


In fact the problem with OTP is the delivery of the means. Supposing that everybody has an Android phone, with the given app, how do you synchronize them (i.e. share the symmetric key?) If you deliver it through your web application then the method is vulnerable to zero-day attacks.
davout
Legendary
*
Offline Offline

Activity: 1358


1davout


View Profile WWW
June 23, 2011, 04:08:58 PM
 #30

In fact the problem with OTP is the delivery of the means. Supposing that everybody has an Android phone, with the given app, how do you synchronize them (i.e. share the symmetric key?) If you deliver it through your web application then the method is vulnerable to zero-day attacks.
Honestly I'm a total crypto-newb, this is why I'm watching this thread with lots of interest Smiley
I guess what you state is an advantage for yubikeys right ?

muad_dib
Member
**
Offline Offline

Activity: 84


View Profile
June 23, 2011, 04:22:22 PM
 #31

In fact the problem with OTP is the delivery of the means. Supposing that everybody has an Android phone, with the given app, how do you synchronize them (i.e. share the symmetric key?) If you deliver it through your web application then the method is vulnerable to zero-day attacks.
Honestly I'm a total crypto-newb, this is why I'm watching this thread with lots of interest Smiley
I guess what you state is an advantage for yubikeys right ?



No. Yubikeys share the same weakness.

The main strength point of keys is that you have two delivery methods, one by post service and one by the web (for first password).


Anyhow if you ever need to resynchonize the key, you are vulnerable to a man-in-the-middle attack.  Thus physical keys are just an additional  useless layer of complexity which is not scalable.


We would need to modify the google authenticator by:

- Using asymmetric keys

- Using stronger hashing algortihms


Remember that we are home bankers, i.e.: people who runs a bank from home, while these security measure are designed for less critical content and blogging applications.
makomk
Hero Member
*****
Offline Offline

Activity: 686


View Profile
June 23, 2011, 08:48:26 PM
 #32

In that case though, I don't understand what the advantage is?  Other than being an overly complicated way of forcing a secure password.

If someone has cracked a website and gotten the password database, then that database will include the shared key; and the attacker can just enter that shared key into their copy of the two factor authentication software.

Protection against password sniffing is already provided by SSL isn't it?
Protection against password sniffing is provided by SSL so long as the end user's machine isn't compromised. That's the main threat these devices are designed to protect against. (Though as I've said, YubiKey do have a HSM of some kind you can store the server copy of the shared key in to protect it when your server gets compromised. I've no idea if Mt Gox are planning on using one.)

Quad XC6SLX150 Board: 860 MHash/s or so.
SIGS ABOUT BUTTERFLY LABS ARE PAID ADS
finack
Jr. Member
*
Offline Offline

Activity: 56


View Profile
June 23, 2011, 09:34:44 PM
 #33

Protection against password sniffing is provided by SSL so long as the end user's machine isn't compromised. That's the main threat these devices are designed to protect against. (Though as I've said, YubiKey do have a HSM of some kind you can store the server copy of the shared key in to protect it when your server gets compromised. I've no idea if Mt Gox are planning on using one.)

OOPS, I misread what was said. Boy do I feel dumb. Edited my shame away.
sturle
Legendary
*
Offline Offline

Activity: 1418

http://bitmynt.no


View Profile WWW
June 23, 2011, 10:10:15 PM
 #34

BUT their support thread says they are getting 2 step authentication (like paypals) but they want to charge for it!
That is BS! If they do not use yubikey (which I will buy a yubi key, one time fee) and then use it for free I may not use mt gox any more.
After what happened, there is ZERO reason to charge for extra security.
What do you guys think?
You don't have to use two factor authentication if you don't want to.  I don't think there will be any more secure place to trade Bitcoin than Mt.Gox, even without two factor authentication.  AFAIK none of the other exchanges offer two factor authentication at all.

Bitcoin7 has already shown total lack of interest in security and knowledge about Bitcoin and bookkeeping in general, and ThradeHill users spam my mailbox and this forum so much it is sickening.  TradeHill don't seem to do much about their spam problem either, and spammers are still allowed to trade there.  Fortunately there are other exchanges as well, which seem more secure and don't encourage anti-social practices.

Mt. Gox is very liquid and cheap to get money in to and out of for us Europeans, and a good place to trade in spite of a comparatively high fee.  They also have a simple API for fast and easy trading without using the web interface.  And I don't think any of the other exchanges could have handled a security breach like this better than Mt. Gox has done.  Most likely those that keep funds an do automatic transactions would have gone bankrupt.

Sjå http://bitmynt.no for veksling av bitcoin mot norske kroner.  Trygt, billig, raskt og enkelt sidan 2010.
I buy with EUR and other currencies at a fair market price when you want to sell.  See http://bitmynt.no/eurprice.pl
I support the roadmap.  If a majority of miners ever try to forcefully take control of Bitcoin through a hard fork without 100% consensus, I will immediately split out and dump all my forkcoins, and buy more real Bitcoin.
Valalvax
Sr. Member
****
Offline Offline

Activity: 439


View Profile
June 23, 2011, 10:20:00 PM
 #35

+1 for yubikey
If someone donates a yubikey I'll implement the two factor authentication in bitcoin-central's codebase so anyone can open an exchange with awesome security out of the box.

If someone's interested PM for postal address.

there are better ways than yubikey.

http://www.openauthentication.org/

In the era of internet, we need to avoid the step of shipping a physical device to ensure security, as it is expensive and not scalable.

yup http://code.google.com/p/google-authenticator/

Indeed.

Anyhow I was wondering which is the best way to deliver the OTP.

An Android phone? Can we count on the fact that every person has an Android Phone?

An Iphone? No. Apple refused to accept a similar app I developed for a business customer. We resolved to use it on jailbroken devices/

A windows machine? Sorry but it might be infected, so your OTPs wouldnt be safe.

SMS? Sorry, too expensive. One could finish all your credit by sending unwanted OTPs.

Mumble mumble mumble...


Both Rift and World of Warcraft have iPhone Authenticators
ploum
Sr. Member
****
Offline Offline

Activity: 378



View Profile WWW
June 23, 2011, 10:21:13 PM
 #36

In this way, even if your account is hacked and the public half of the secret is known, there is no way for the attacker to get at the secret on your phone.  Hence they cannot make a valid login.

No way? I mean, there are already exploits to crack phones. Also, it wouldn't be hard to steal a phone, copy its content and give it back to someone "sir, you lost your phone".

For my Euros bank, I have a digicode, which is an unconnected physical device. This device is unique and protected by a pincode. It means that, in order to access to my bank account, the attacker would have to:

- access my secret code (easy with a keylogger)
- steal physically the digicode (for a device that always stay at home!)
- know my PIN code (no keylogger possible)

Not to mention the fact that, if it is stolen, I would immediately notice it, thus effectively blocking my account.

Solutions on a phone are cheaper but they only mean that the attacker has to crack two devices instead of only one. I would definitely not trust such system if I had 1 million of € on a website.

Blog posts about Bitcoin - 1KdRBbhjo72CqKTrFsQed6s9NMrvwvrUkq
sturle
Legendary
*
Offline Offline

Activity: 1418

http://bitmynt.no


View Profile WWW
June 23, 2011, 10:21:27 PM
 #37

there are better ways than yubikey.

http://www.openauthentication.org/
LOL!  Flash all over the page.  That's what "open" means to them.  :-)

I think yubikey along with a strong password is more than enough security for me.  I don't plan to keep half a million bitcoins at Mt.Gox.  On other exchanges I have no other choice than password.

Sjå http://bitmynt.no for veksling av bitcoin mot norske kroner.  Trygt, billig, raskt og enkelt sidan 2010.
I buy with EUR and other currencies at a fair market price when you want to sell.  See http://bitmynt.no/eurprice.pl
I support the roadmap.  If a majority of miners ever try to forcefully take control of Bitcoin through a hard fork without 100% consensus, I will immediately split out and dump all my forkcoins, and buy more real Bitcoin.
randomguy7
Hero Member
*****
Offline Offline

Activity: 528


View Profile
June 23, 2011, 10:36:55 PM
 #38

Why not use simple plain ssl client authentication? People could then put their certificate on a hardware token which implements pkcs#11 (eToken for example). And even without hardware token, nobody ever will brute force the certificate Grin.
Jack of Diamonds
Sr. Member
****
Offline Offline

Activity: 252



View Profile
June 24, 2011, 06:18:33 PM
 #39

Tradehill

Quote
International transfer fee: $45

A bad joke? How are they going to compete with Mt. Gox which has free withdrawals?
AFAIK mtgox didn't offer international wire withdrawals at all. You'd have to use Dwolla or LR or other such US-specific nonsense I'd never heard of before starting with Bitcoin.

I've recieved dozens of international wire transfers from Mt. Gox at $0 fee. Last one just 2 days ago.

1f3gHNoBodYw1LLs3ndY0UanYB1tC0lnsBec4USeYoU9AREaCH34PBeGgAR67fx
Justsomeforumuser
Member
**
Offline Offline

Activity: 84


View Profile
June 24, 2011, 11:44:47 PM
 #40

Quote
I've recieved dozens of international wire transfers from Mt. Gox at $0 fee. Last one just 2 days ago.

Anyone in the SEPA / EUR zone gets "free" wires after currency conversion + fee costs.
No idea why the USD is so much more of a headache given that it would not even need the conversion step, but this puts MtGox lightyears ahead of the spammer infested/encouraging turdnest that is Tradehill.

Ho-Hum.
Pages: « 1 [2] 3 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!