csshih (OP)
Member
Offline
Activity: 96
Merit: 10
|
|
July 06, 2011, 01:21:45 AM Last edit: July 06, 2011, 08:10:43 AM by csshih |
|
Hey All, I just wanted to post some pictures of the Yubikey I got from Mtgox - Mark is currently running a beta test to ~50 people to work out the bugs. the QR code and serial are obfuscated for security purposes purchasers will get a nice Mtgox lasered one, I believe. sorry about the image, my camera is out for repair. The yubikey is recognized as a USB input device. All I have to do is touch the contact (the glowing part) and it'll enter in a code, and press enter. If you have yubikeys enabled on your account, you are greeted with this message AFTER you log in with your username and password. I was able to log in using nothing in the yubikey authentication box until I used the yubikey for the first time. Pressing only enter would kick me back log-in screen (I would have to enter in username and password again) What I observed: 1. Keys cannot be used twice 2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid. 3. I'm not sure when the keys expire after generation. More to come as I poke around more. Edit: Oh yeah, Mtgox will be selling them for 29.99 shipped. BTC accepted, of course.
|
|
|
|
Superform
Newbie
Offline
Activity: 56
Merit: 0
|
|
July 06, 2011, 03:16:42 PM |
|
cant wait.. mt gox really is lifting its game
|
|
|
|
datguywhowanders
Member
Offline
Activity: 112
Merit: 10
|
|
July 06, 2011, 05:05:10 PM |
|
Very interesting. Thanks for the post and please keep us informed as you run it through initial tests.
|
Donations Welcome: 163id7T8KZ6MevqT86DjrBF2kfCPrQsfZE
|
|
|
cypherdoc
Legendary
Offline
Activity: 1764
Merit: 1002
|
|
July 06, 2011, 05:41:40 PM |
|
yes, i installed mine yesterday and it works as you described. i'll add that Mark said yesterday that Withdrawal will be added shortly.
when you speak of "keys", do u mean the series of letters entered into the OTP box by the Yubikey? how do you know how many of them there are? i also noted they're just alpha and was surprised it didn't generate numerics in the password as well.
whats the purpose of the QR code?
i don't understand what you mean by the following. can u expound on each of them please?:
"1. Keys cannot be used twice 2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid. 3. I'm not sure when the keys expire after generation."
|
|
|
|
Jine
|
|
July 06, 2011, 11:12:23 PM |
|
Funny! I actually my self ordered a YubiKey just a couple of days ago - arrived today. We're implementing it at Bitcoins.lc as we speak.
|
Previous founder of Bit LC Inc. | I've always loved the idea of bitcoin.
|
|
|
MagicalTux
VIP
Hero Member
Offline
Activity: 608
Merit: 501
-
|
|
July 07, 2011, 12:17:22 AM |
|
yes, i installed mine yesterday and it works as you described. i'll add that Mark said yesterday that Withdrawal will be added shortly.
when you speak of "keys", do u mean the series of letters entered into the OTP box by the Yubikey? how do you know how many of them there are? i also noted they're just alpha and was surprised it didn't generate numerics in the password as well.
whats the purpose of the QR code?
i don't understand what you mean by the following. can u expound on each of them please?:
"1. Keys cannot be used twice 2. If I generate many keys, I can use them all if used in order of generation. If I use the last key generated, all previous keys become invalid. 3. I'm not sure when the keys expire after generation."
The code input is made of letters only, and only some letters to be keymap-independent (this way even if your computer is configured for azerty or qwerty, it'll work fine). The string is in fact hexadecimal (yubico calls this "modhex", modified hexadecimal) and is a 22 bytes string made of 6 fixed bytes, and 16 bytes which are various informations encrypted with AES128. The auth server has a copy of the 128bits key used on the yubikey, and will try to decrypt the string. It'll then check counters in there and will only accept the code if its counter is higher than the last seen code. It means: - A code cannot be used more than once
- Only a code more recent than the latest used code can be used
- A code will not expire in terms of time, but only if a more recent code is used on the site
|
|
|
|
Jine
|
|
July 07, 2011, 01:04:31 AM |
|
A question to you MT - are you using your own key/validationserver? I've gotten a couple of questions if It's possible to use the same key for both Bit LC and MTGox - and it all depends on if you're using yubicloud or not.
In either way - the MTGox-keys are based upon YubiKey 2.2 if i see correctly - which supports double identities - so it should not be a issue anyway.
|
Previous founder of Bit LC Inc. | I've always loved the idea of bitcoin.
|
|
|
TheMartin
Member
Offline
Activity: 84
Merit: 10
|
|
July 07, 2011, 03:52:27 AM |
|
Thanks for the info: If you have yubikeys enabled on your account, you are greeted with this message AFTER you log in with your username and password. Will this yubikey be used for login only or to authenticate orders too? I think only the latter would be safe when doing a BTC withdraw for example on a corrupted PC
|
|
|
|
danf
Newbie
Offline
Activity: 8
Merit: 0
|
|
July 07, 2011, 07:59:10 PM |
|
A question to you MT - are you using your own key/validationserver? I've gotten a couple of questions if It's possible to use the same key for both Bit LC and MTGox - and it all depends on if you're using yubicloud or not.
In either way - the MTGox-keys are based upon YubiKey 2.2 if i see correctly - which supports double identities - so it should not be a issue anyway.
Yubico replied to my tweet to Mt. Gox: I think MtGox use their own validation server and not the YubiCloud. John.
You can see the tweet here.
|
|
|
|
MagicalTux
VIP
Hero Member
Offline
Activity: 608
Merit: 501
-
|
|
July 08, 2011, 12:04:27 AM |
|
For information it is now possible to order the yubikeys on mtgox, after logging in.
We are currently evaluating the possibility of selling half-locked keys that would be usable with yubicloud, and with other yubikey-enabled websites, which may be less secure as a rogue site could use your login token to login on mtgox instead of validating it with yubicloud.
|
|
|
|
Oldminer
Legendary
Offline
Activity: 1022
Merit: 1001
|
|
July 08, 2011, 01:05:42 AM |
|
Hey MT, is there a shipping fee for international buyers or is it included in the cost?
|
|
|
|
MagicalTux
VIP
Hero Member
Offline
Activity: 608
Merit: 501
-
|
|
July 08, 2011, 02:58:01 AM |
|
Hey MT, is there a shipping fee for international buyers or is it included in the cost?
The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax.
|
|
|
|
JoelKatz
Legendary
Offline
Activity: 1596
Merit: 1012
Democracy is vulnerable to a 51% attack.
|
|
July 08, 2011, 03:03:04 AM |
|
What scheme is Mt. Gox using? Are they using Yubikey's verification servers? Do they generate the key and burn it into the token themselves? Or can the user program the token?
|
I am an employee of Ripple. Follow me on Twitter @JoelKatz 1Joe1Katzci1rFcsr9HH7SLuHVnDy2aihZ BM-NBM3FRExVJSJJamV9ccgyWvQfratUHgN
|
|
|
error
|
|
July 08, 2011, 03:21:28 AM |
|
This really needs a smartphone app.
|
3KzNGwzRZ6SimWuFAgh4TnXzHpruHMZmV8
|
|
|
haydent
|
|
July 08, 2011, 03:32:35 AM |
|
Hey MT, is there a shipping fee for international buyers or is it included in the cost?
The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax. what happened to the offer to give these away you made on onlyonetv bitcoin show when your site was hacked. you said they would be free to peeps who had trades reversed, ie inconvenienced..
|
2x Gigabyte 6950 OC @ 920/450 w/ ati tray tools (1 shader modded) - 760Mhs on ozco.in 0% fee aus pool btc: 1HS5Brzcsh7XkJn566XYbvfpa2JuBRBdss
|
|
|
MKW2012
Jr. Member
Offline
Activity: 74
Merit: 1
|
|
July 08, 2011, 04:10:16 AM |
|
This really needs a smartphone app. Good idea.
|
|
|
|
haydent
|
|
July 08, 2011, 05:33:20 AM |
|
Hey MT, is there a shipping fee for international buyers or is it included in the cost?
The shipping fee is included in the price for any destination. Depending on your country's customs you may have to pay a tax. what happened to the offer to give these away you made on onlyonetv bitcoin show when your site was hacked. you said they would be free to peeps who had trades reversed, ie inconvenienced.. i stand corrected, they are free if your account was affected like mine !
|
2x Gigabyte 6950 OC @ 920/450 w/ ati tray tools (1 shader modded) - 760Mhs on ozco.in 0% fee aus pool btc: 1HS5Brzcsh7XkJn566XYbvfpa2JuBRBdss
|
|
|
JoelKatz
Legendary
Offline
Activity: 1596
Merit: 1012
Democracy is vulnerable to a 51% attack.
|
|
July 08, 2011, 05:41:52 AM |
|
This really needs a smartphone app. If Gox lets you program your own Yubikey, you can do the same thing without a Yubikey. The algorithm is public and well-documented. It's basically just AES.
|
I am an employee of Ripple. Follow me on Twitter @JoelKatz 1Joe1Katzci1rFcsr9HH7SLuHVnDy2aihZ BM-NBM3FRExVJSJJamV9ccgyWvQfratUHgN
|
|
|
Randall Flagg
Newbie
Offline
Activity: 41
Merit: 0
|
|
July 09, 2011, 12:04:45 AM |
|
Woah ! nice gift this is from MtGox !!! Ordered mine, but bye bye anonymity ahah
|
|
|
|
MagicalTux
VIP
Hero Member
Offline
Activity: 608
Merit: 501
-
|
|
July 09, 2011, 06:16:12 AM |
|
What scheme is Mt. Gox using? Are they using Yubikey's verification servers? Do they generate the key and burn it into the token themselves? Or can the user program the token?
We use our own AES keys (two random AES key by user) and burn the tokens. We will provide in the future an option to unlink a token and retrieve the keys & programming codes.
|
|
|
|
|