Bitcoin Forum
April 23, 2014, 01:07:20 PM *
News: Due to the OpenSSL heartbleed bug, changing your forum password is recommended.
 
   Home   Help Search Donate Login Register  
Pages: [1] 2  All
  Print  
Author Topic: Mtgox's 2 Factor Authentication: Yubikeys  (Read 3875 times)
csshih
Member
**
Offline Offline

Activity: 95


View Profile

Ignore
July 06, 2011, 01:21:45 AM
 #1

Hey All,

I just wanted to post some pictures of the Yubikey I got from Mtgox - Mark is currently running a beta test to ~50 people to work out the bugs.



the QR code and serial are obfuscated for security purposes Wink



purchasers will get a nice Mtgox lasered one, I believe.

sorry about the image, my camera is out for repair.



The yubikey is recognized as a USB input device. All I have to do is touch the contact (the glowing part) and it'll enter in a code, and press enter.

If you have yubikeys enabled on your account, you are greeted with this message AFTER you log in with your username and password.


I was able to log in using nothing in the yubikey authentication box until I used the yubikey for the first time. Pressing only enter would kick me back log-in screen (I would have to enter in username and password again)

What I observed:
1. Keys cannot be used twice
2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid.
3. I'm not sure when the keys expire after generation.

More to come as I poke around more.

Edit: Oh yeah, Mtgox will be selling them for 29.99 shipped. BTC accepted, of course. Wink

Craig | #Bitcoin-OTC ratings | How to use the OTC | GPG signed msgs on request
1398258440
Hero Member
*
Offline Offline

Posts: 1398258440

View Profile Personal Message (Offline)

Ignore
1398258440
Reply with quote  #2

1398258440
Report to moderator
1398258440
Hero Member
*
Offline Offline

Posts: 1398258440

View Profile Personal Message (Offline)

Ignore
1398258440
Reply with quote  #2

1398258440
Report to moderator
1398258440
Hero Member
*
Offline Offline

Posts: 1398258440

View Profile Personal Message (Offline)

Ignore
1398258440
Reply with quote  #2

1398258440
Report to moderator
Buy a Blade, Get a 5-Chip Free!
Start Mining with GAWMiners.com
24/7 Live Phone & Tech Support
Free Hosting & Electricity for 1 Year!

Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1398258440
Hero Member
*
Offline Offline

Posts: 1398258440

View Profile Personal Message (Offline)

Ignore
1398258440
Reply with quote  #2

1398258440
Report to moderator
1398258440
Hero Member
*
Offline Offline

Posts: 1398258440

View Profile Personal Message (Offline)

Ignore
1398258440
Reply with quote  #2

1398258440
Report to moderator
1398258440
Hero Member
*
Offline Offline

Posts: 1398258440

View Profile Personal Message (Offline)

Ignore
1398258440
Reply with quote  #2

1398258440
Report to moderator
Superform
Jr. Member
*
Offline Offline

Activity: 56


View Profile

Ignore
July 06, 2011, 03:16:42 PM
 #2

cant wait.. mt gox really is lifting its game

1P4pSRP6mZTt17TkEEA7aPMzKqUYGbYytn
like my post? send me some btc Smiley
datguywhowanders
Member
**
Offline Offline

Activity: 112



View Profile

Ignore
July 06, 2011, 05:05:10 PM
 #3

Very interesting. Thanks for the post and please keep us informed as you run it through initial tests.

Donations Welcome: 163id7T8KZ6MevqT86DjrBF2kfCPrQsfZE
cypherdoc
Hero Member
*****
Offline Offline

Activity: 1120



View Profile

Ignore
July 06, 2011, 05:41:40 PM
 #4

yes, i installed mine yesterday and it works as you described.  i'll add that Mark said yesterday that Withdrawal will be added shortly.

when you speak of "keys", do u mean the series of letters entered into the OTP box by the Yubikey?  how do you know how many of them there are?  i also noted they're just alpha and was surprised it didn't generate numerics in the password as well.

whats the purpose of the QR code?

i don't understand what you mean by the following.  can u expound on each of them please?:

"1. Keys cannot be used twice
2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid.
3. I'm not sure when the keys expire after generation."
Jine
Sr. Member
****
Offline Offline

Activity: 392


View Profile

Ignore
July 06, 2011, 11:12:23 PM
 #5

Funny! Smiley I actually my self ordered a YubiKey just a couple of days ago - arrived today.
We're implementing it at Bitcoins.lc as we speak.

Previous founder of Bit LC Inc. | I've always loved the idea of bitcoin.
MagicalTux
VIP
Hero Member
*
Offline Offline

Activity: 617


Working on new MtGox features


View Profile WWW

Ignore
July 07, 2011, 12:17:22 AM
 #6

yes, i installed mine yesterday and it works as you described.  i'll add that Mark said yesterday that Withdrawal will be added shortly.

when you speak of "keys", do u mean the series of letters entered into the OTP box by the Yubikey?  how do you know how many of them there are?  i also noted they're just alpha and was surprised it didn't generate numerics in the password as well.

whats the purpose of the QR code?

i don't understand what you mean by the following.  can u expound on each of them please?:

"1. Keys cannot be used twice
2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid.
3. I'm not sure when the keys expire after generation."

The code input is made of letters only, and only some letters to be keymap-independent (this way even if your computer is configured for azerty or qwerty, it'll work fine). The string is in fact hexadecimal (yubico calls this "modhex", modified hexadecimal) and is a 22 bytes string made of 6 fixed bytes, and 16 bytes which are various informations encrypted with AES128.

The auth server has a copy of the 128bits key used on the yubikey, and will try to decrypt the string. It'll then check counters in there and will only accept the code if its counter is higher than the last seen code.

It means:
  • A code cannot be used more than once
  • Only a code more recent than the latest used code can be used
  • A code will not expire in terms of time, but only if a more recent code is used on the site

Jine
Sr. Member
****
Offline Offline

Activity: 392


View Profile

Ignore
July 07, 2011, 01:04:31 AM
 #7

A question to you MT - are you using your own key/validationserver?
I've gotten a couple of questions if It's possible to use the same key for both Bit LC and MTGox - and it all depends on if you're using yubicloud or not.

In either way - the MTGox-keys are based upon YubiKey 2.2 if i see correctly - which supports double identities - so it should not be a issue anyway.

Previous founder of Bit LC Inc. | I've always loved the idea of bitcoin.
TheMartin
Member
**
Offline Offline

Activity: 84


View Profile

Ignore
July 07, 2011, 03:52:27 AM
 #8

Thanks for the info:

If you have yubikeys enabled on your account, you are greeted with this message AFTER you log in with your username and password.


Will this yubikey be used for login only or to authenticate orders too?

I think only the latter would be safe when doing a BTC withdraw for example on a corrupted PC

danf
Newbie
*
Offline Offline

Activity: 8


View Profile

Ignore
July 07, 2011, 07:59:10 PM
 #9

A question to you MT - are you using your own key/validationserver?
I've gotten a couple of questions if It's possible to use the same key for both Bit LC and MTGox - and it all depends on if you're using yubicloud or not.

In either way - the MTGox-keys are based upon YubiKey 2.2 if i see correctly - which supports double identities - so it should not be a issue anyway.

Yubico replied to my tweet to Mt. Gox:

Quote
I think MtGox use their own validation server and not the YubiCloud. John.

You can see the tweet here.
MagicalTux
VIP
Hero Member
*
Offline Offline

Activity: 617


Working on new MtGox features


View Profile WWW

Ignore
July 08, 2011, 12:04:27 AM
 #10

For information it is now possible to order the yubikeys on mtgox, after logging in.

We are currently evaluating the possibility of selling half-locked keys that would be usable with yubicloud, and with other yubikey-enabled websites, which may be less secure as a rogue site could use your login token to login on mtgox instead of validating it with yubicloud.

Oldminer
Hero Member
*****
Offline Offline

Activity: 546


The trust reporting system is a 'scam'


View Profile

Ignore
July 08, 2011, 01:05:42 AM
 #11

Hey MT, is there a shipping fee for international buyers or is it included in the cost?

MagicalTux
VIP
Hero Member
*
Offline Offline

Activity: 617


Working on new MtGox features


View Profile WWW

Ignore
July 08, 2011, 02:58:01 AM
 #12

Hey MT, is there a shipping fee for international buyers or is it included in the cost?

The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax.

JoelKatz
Hero Member
*****
Offline Offline

Activity: 1036


Democracy is vulnerable to a 51% attack.


View Profile WWW

Ignore
July 08, 2011, 03:03:04 AM
 #13

What scheme is Mt. Gox using? Are they using Yubikey's verification servers? Do they generate the key and burn it into the token themselves? Or can the user program the token?

I am an employee of Ripple Labs, the company behind the Ripple payment network.
1Joe1Katzci1rFcsr9HH7SLuHVnDy2aihZ
error
Sr. Member
****
Offline Offline

Activity: 462



View Profile

Ignore
July 08, 2011, 03:21:28 AM
 #14

This really needs a smartphone app. Smiley

15UFyv6kfWgq83Pp3yhXPr8rknv9m6581W
haydent
Full Member
***
Offline Offline

Activity: 154



View Profile

Ignore
July 08, 2011, 03:32:35 AM
 #15

Hey MT, is there a shipping fee for international buyers or is it included in the cost?

The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax.

what happened to the offer to give these away you made on onlyonetv bitcoin show when your site was hacked. you said they would be free to peeps who had trades reversed, ie inconvenienced..

2x Gigabyte 6950 OC @ 920/450 w/ ati tray tools (1 shader modded) - 760Mhs on ozco.in 0% fee aus pool
btc: 1HS5Brzcsh7XkJn566XYbvfpa2JuBRBdss
MKW2012
Jr. Member
*
Offline Offline

Activity: 42


View Profile

Ignore
July 08, 2011, 04:10:16 AM
 #16

This really needs a smartphone app. Smiley

Good idea.
haydent
Full Member
***
Offline Offline

Activity: 154



View Profile

Ignore
July 08, 2011, 05:33:20 AM
 #17

Hey MT, is there a shipping fee for international buyers or is it included in the cost?

The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax.

what happened to the offer to give these away you made on onlyonetv bitcoin show when your site was hacked. you said they would be free to peeps who had trades reversed, ie inconvenienced..

i stand corrected, they are free if your account was affected like mine !


2x Gigabyte 6950 OC @ 920/450 w/ ati tray tools (1 shader modded) - 760Mhs on ozco.in 0% fee aus pool
btc: 1HS5Brzcsh7XkJn566XYbvfpa2JuBRBdss
JoelKatz
Hero Member
*****
Offline Offline

Activity: 1036


Democracy is vulnerable to a 51% attack.


View Profile WWW

Ignore
July 08, 2011, 05:41:52 AM
 #18

This really needs a smartphone app. Smiley
If Gox lets you program your own Yubikey, you can do the same thing without a Yubikey. The algorithm is public and well-documented. It's basically just AES.

I am an employee of Ripple Labs, the company behind the Ripple payment network.
1Joe1Katzci1rFcsr9HH7SLuHVnDy2aihZ
Randall Flagg
Jr. Member
*
Offline Offline

Activity: 42


View Profile

Ignore
July 09, 2011, 12:04:45 AM
 #19

Woah ! nice gift this is from MtGox !!!  Ordered mine, but bye bye anonymity ahah
MagicalTux
VIP
Hero Member
*
Offline Offline

Activity: 617


Working on new MtGox features


View Profile WWW

Ignore
July 09, 2011, 06:16:12 AM
 #20

What scheme is Mt. Gox using? Are they using Yubikey's verification servers? Do they generate the key and burn it into the token themselves? Or can the user program the token?

We use our own AES keys (two random AES key by user) and burn the tokens.

We will provide in the future an option to unlink a token and retrieve the keys & programming codes.

Pages: [1] 2  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!