Bitcoin Forum
December 08, 2016, 08:21:31 PM *
News: Latest stable version of Bitcoin Core: 0.13.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: « 1 [2]  All
  Print  
Author Topic: I received my free Yubikey from MtGox today  (Read 4157 times)
cepler
Jr. Member
*
Offline Offline

Activity: 47


View Profile
August 09, 2011, 07:16:40 PM
 #21

Negative side, it's bound to Mt. Gox so you can't use it as a normal YK on any other site.

Did you try it on http://demo.yubico.com/php-yubico/one_factor.php ?
It is pitty if the key cannot be used outside MtGox (yes, I've read their EULA Smiley AFAIK yubikey has 2 slots for secret key, they can be switched by long tap. I wonder why they removed Yubiko key instead of using the second slot. If they would leave Yubico's secret key then the key could be used on other sites for authentication...

I was under the impression that MtGox used both keys.

Download the personalization tool and take a peek at it:

http://www.yubico.com/personalization-tool

I have two Yubikeys on the way for password database use (ie: Passpack.com, Lastpass.com, 1Password, etc) and have been reading up on them.  Going to try to get the wife to use one... *crosses fingers*
1481228491
Hero Member
*
Offline Offline

Posts: 1481228491

View Profile Personal Message (Offline)

Ignore
1481228491
Reply with quote  #2

1481228491
Report to moderator
1481228491
Hero Member
*
Offline Offline

Posts: 1481228491

View Profile Personal Message (Offline)

Ignore
1481228491
Reply with quote  #2

1481228491
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
falkenberg
Member
**
Offline Offline

Activity: 84


View Profile
August 09, 2011, 07:34:07 PM
 #22

Download the personalization tool and take a peek at it:

If I understood it well, with this tool you can change secret AES key, but you need one from Yubiko in case if you want to be authenticated by on-line services.  Yubiko's keys are stored in the moment of creation. If mtgox overrides it then you do not have the valid key Sad
elggawf
Sr. Member
****
Offline Offline

Activity: 308



View Profile
August 09, 2011, 09:28:33 PM
 #23

If I understood it well, with this tool you can change secret AES key, but you need one from Yubiko in case if you want to be authenticated by on-line services.  Yubiko's keys are stored in the moment of creation. If mtgox overrides it then you do not have the valid key Sad

If I understood it well, if you blow away your AES key on your Yubikey, then you'd have to convince MtGox to let you update the AES key on their site before you could keep using it with them. Chances are they're not going to want to do that - they'd rather just charge you $30 and send you another key.

^_^
Maged
Legendary
*
Offline Offline

Activity: 1260


View Profile
August 10, 2011, 03:07:01 AM
 #24

I was under the impression that MtGox used both keys.

After reading the forum I came to the same conclusion. But why? What's the reason to allocate both slots if just one is needed for OTP? Even if they do not want to share secret keys with Yubiko (but I would trust them more then mtgox: they never loose their database while mtgox was hacked because someone steel the database. What will it be if the database with secret keys will be stolen next time?), they need just one slot.
It's so that if you are man-in-the-middled, the worst someone could do is log in and trade. They wouldn't be able to withdraw, even if they had you pregenerate a bunch of OTPs for login.

cepler
Jr. Member
*
Offline Offline

Activity: 47


View Profile
August 10, 2011, 04:02:27 AM
 #25

There's no technical reason for Mt. Gox to lock the second profile.  If they left it open then you could use it for whatever you wanted, static password, Challenge-Response, a Yubico OTP, whatever but nope, they decided to lock it in to Mt. Gox only.  I suppose an argument could be made that it makes it so that if you hold the button down past the first profile's time it'll activate the second and still get you in but that's about it.  Hopefully they'll just give out the key soon so people can take advantage of the other profile, especially since they're paying a premium for a pre-configured one.  (Ya I know, labor to configure/ship etc them)
geek-trader
Sr. Member
****
Offline Offline

Activity: 294


View Profile
August 10, 2011, 04:08:01 AM
 #26

There's no technical reason for Mt. Gox to lock the second profile.  If they left it open then you could use it for whatever you wanted, static password, Challenge-Response, a Yubico OTP, whatever but nope, they decided to lock it in to Mt. Gox only.  I suppose an argument could be made that it makes it so that if you hold the button down past the first profile's time it'll activate the second and still get you in but that's about it.  Hopefully they'll just give out the key soon so people can take advantage of the other profile, especially since they're paying a premium for a pre-configured one.  (Ya I know, labor to configure/ship etc them)

Tell me if I have this right:  A Yubikey has 2 "profiles" -  a short press and a long press.

If this is correct, then MtGox is using them both.  A short press to login, and long press to withdraw funds.

Make 1 deposit and earn BTC for life! http://bitcoinpyramid.com/r/345
Play my FREE HTML5 games at: http://magigames.org  BTC donations accepted.
elggawf
Sr. Member
****
Offline Offline

Activity: 308



View Profile
August 10, 2011, 04:44:41 AM
 #27

Tell me if I have this right:  A Yubikey has 2 "profiles" -  a short press and a long press.

If this is correct, then MtGox is using them both.  A short press to login, and long press to withdraw funds.

Yes.

^_^
forbun
Member
**
Offline Offline

Activity: 107


View Profile WWW
August 30, 2011, 09:09:37 PM
 #28

Why bother-- How does using separate profiles for login and withdrawal add security?


Also, on https://yubikey.mtgox.com/ why does the top of the page say: Last Price: 0.53910961 High:0.53910961 Low: 0.53910961 Volume: 0

What name would you give to the smallest unit of bitcoin (0.00000001)? sat. What name would you give to 100 sats? bit. 1 bit = 1 uBTC. 1,000,000 bits = 1 BTC. It's bits
elggawf
Sr. Member
****
Offline Offline

Activity: 308



View Profile
August 30, 2011, 10:06:22 PM
 #29

Why bother-- How does using separate profiles for login and withdrawal add security?

Only thing I can think of? It solves MITM attacks accidentally allowing withdrawals.

If you MITM someone, get a login session to MtGox, you can't just "oops you're logged out" the client end in order to get another yubikey code to let you withdraw... because that would be a login code not a withdraw code. In order to actually steal from someone, you have to MITM the login session and the withdraw request, replacing the withdraw request with your own information.

It's not a huge leap of security, but it ups the bar a bit (because the user has to want to create a withdrawal while the attack is going on).

^_^
Pages: « 1 [2]  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!