Beware of MTgox Yubikey

[cuz0882]

I purchased a yubikey and it stopped working 2 weeks after I got it. Now I can't access my account. The only way they will unlock my account is to mail it back. It's 90 bucks to mail it back to japan, and if it should get lost in the mail or misplaced on there end I will never get access to my accounts again. Not to mention bitcoin has dropped 20% in value since I've been locked account of my account. Total loss is in the hundreds already. Not exactly a security feature.

[Littleshop]

You can apparently order a new one sent to your address without sending the old one back for far less money.  Do that instead.

[Mt.Gox Support]

I purchased a yubikey and it stopped working 2 weeks after I got it. Now I can't access my account. The only way they will unlock my account is to mail it back. It's 90 bucks to mail it back to japan, and if it should get lost in the mail or misplaced on there end I will never get access to my accounts again. Not to mention bitcoin has dropped 20% in value since I've been locked account of my account. Total loss is in the hundreds already. Not exactly a security feature.

Hi, we are sorry to hear about your Yubikey problem, I have actually mine all day long since day one in my pocket alongside my keys and it never failed me once. What I would like to suggest you is to send the Yubikey by regular mail it will be shipper for you and will take normally a week or so. Once we got your Yubikey we will send you a new one at not cost for you using our EMS Service.
Also as soon as we ship the Yubikey to you, you will be able to access your account until you bet your Yubikey back.

Regards

[jake262144]

To tell you the truth, Cuz, I've deployed Yubikeys in a couple of medium-scale IT systems and the only failures I encountered were user-caused.
You mentioned burning your mobo along with the yubikey by shorting out your USB mouse?

You can always purchase programmable yubikeys directly from the manufacturer.
Whether MtGox will give you the techie details necessary to configure it is another sack of ferrets though.

Frankly, that's the price you're paying for MtGox's flawed implementation: it's unthinkable that they should have no contingency plan in case a yubikey is damaged/misplaced. Being unable to use the device should never irreversibly cut the user off.

I've never been tempted to order the Gox Yubikey, I opt never to keep large amounts of funds there.

a couple generations of yubikeys...
...and the config utililty

[rjk]

You did something very wrong.

http://www.yubico.com/YubiKey-washing-machine

I've even zapped my yubikeys with static, and they keep working.

[Gabi]

Are you guys seriously blaming cuz because a machine no more work?

Guess what, it's a machine, it can break. Eventually it WILL break.


Wow it survived the washing machine? And this is surprising? Wtf, a yubikey is pure solid state component, a washing machine usually has 40-60° hot water, much less than my GPU and CPU run daily. As long as the package is sturdy enough, why the hell it should not survive?

[jake262144]

Are you guys seriously blaming cuz because a machine no more work?

No blaming, just pointing out that those are tough little buggers them yubikeys.
Cuz has experienced a very rare, catastrophic usb failure.

I believe MtGox is the only entity to be blamed due lack of a protocol (like contacting the user on a predefined phone number, asking a secret question, and then keeping an eye on the login IP address) for temporarily dropping multifactor authorization.

... Frankly, that's the price you're paying for MtGox's flawed implementation...

I thought I was clear enough on this.

[cuz0882]

Now they tell me if my Yubikey is lost they will just confirm my account and unlink it. To test this and save myself some money since I don't want another yubikey anyways, I flushed it down the toilet. After telling them my yubikey is now lost. They refuse to do anything until they receive the yubikey, even after telling them again that its not possible because its lost. 

[rjk]

Now they tell me if my Yubikey is lost they will just confirm my account and unlink it. To test this and save myself some money since I don't want another yubikey anyways, I flushed it down the toilet. After telling them my yubikey is now lost. They refuse to do anything until they receive the yubikey, even after telling them again that its not possible because its lost. 

Ahahahahahaha! I had a good laugh there!

[cuz0882]

You can apparently order a new one sent to your address without sending the old one back for far less money.  Do that instead.

They don't do that anymore either. According to them without mailing it back your pretty much screwed now. Definitely do not want to lose your yubikey or your in big troubles.

[bitflower]

You can apparently order a new one sent to your address without sending the old one back for far less money.  Do that instead.

They don't do that anymore either. According to them without mailing it back your pretty much screwed now. Definitely do not want to lose your yubikey or your in big troubles.

Hello,

You may still order a new Yubikey from https://yubikey.mtgox.com/ which will replace the old Yubikey linked to your account.

[cuz0882]

You can apparently order a new one sent to your address without sending the old one back for far less money.  Do that instead.

They don't do that anymore either. According to them without mailing it back your pretty much screwed now. Definitely do not want to lose your yubikey or your in big troubles.

Hello,

You may still order a new Yubikey from https://yubikey.mtgox.com/ which will replace the old Yubikey linked to your account.

Not according to tech support. They say a lot of things but don't do anything...Originally they asked me to provide account history to prove it was my account so they could unlink it. After doing that they decided that I had to mail it in. This after they already assured me if my yubikey was lost it was not a problem.  If they don't like you though they will just close your ticket, lock out your account and keep your money. Last thing they told me was to find and mail in my yubikey or they won't help me.. Even if I had a yubikey I would not mail it to these guys. They would probably just pretend it never got there, or my luck it would get lost in the mail. They said that if someone lost there yubikey, they will unlink it from the account, but if your yubikey breaks they won't unlink it from your account until you pay to mail it. Cross your fingers that it does not get lost. What kind of nonsense is that..So they said point blank if you break your yubikey and then lose it your never getting access to your account...What a clown outfit, they would use any excuse to lock people from their accounts.

[jake262144]

That's just appalling...

[LoupGaroux]

You can apparently order a new one sent to your address without sending the old one back for far less money.  Do that instead.

They don't do that anymore either. According to them without mailing it back your pretty much screwed now. Definitely do not want to lose your yubikey or your in big troubles.

Hello,

You may still order a new Yubikey from https://yubikey.mtgox.com/ which will replace the old Yubikey linked to your account.

Not according to tech support. They say a lot of things but don't do anything...Originally they asked me to provide account history to prove it was my account so they could unlink it. After doing that they decided that I had to mail it in. This after they already assured me if my yubikey was lost it was not a problem.  If they don't like you though they will just close your ticket, lock out your account and keep your money. Last thing they told me was to find and mail in my yubikey or they won't help me.. Even if I had a yubikey I would not mail it to these guys. They would probably just pretend it never got there, or my luck it would get lost in the mail. They said that if someone lost there yubikey, they will unlink it from the account, but if your yubikey breaks they won't unlink it from your account until you pay to mail it. Cross your fingers that it does not get lost. What kind of nonsense is that..So they said point blank if you break your yubikey and then lose it your never getting access to your account...What a clown outfit, they would use any excuse to lock people from their accounts.

It IS support that is responding to you. Getting hysterical about imagined dire scenarios is just silly. Insure the hell out of it, send it International Priority, which will cost you about $30 US, and get your new key that they have graciously offered to send at no cost. Why would they throw away their entire reputation to steal a few thousand dollars from you? They make that much in fees in a couple of hours, they don't need to kill that golden goose.

And really, stop the FUD. It is over the top, doesn't make your point any better to have multiple threads about it, and just paints you in a poor light when you are clearly being offered pretty damn good customer service right here in the open. Unless you have a reason that might make them right in this, do what they are suggested and send them the key back.

[cuz0882]

You can apparently order a new one sent to your address without sending the old one back for far less money.  Do that instead.

They don't do that anymore either. According to them without mailing it back your pretty much screwed now. Definitely do not want to lose your yubikey or your in big troubles.

Hello,

You may still order a new Yubikey from https://yubikey.mtgox.com/ which will replace the old Yubikey linked to your account.

Not according to tech support. They say a lot of things but don't do anything...Originally they asked me to provide account history to prove it was my account so they could unlink it. After doing that they decided that I had to mail it in. This after they already assured me if my yubikey was lost it was not a problem.  If they don't like you though they will just close your ticket, lock out your account and keep your money. Last thing they told me was to find and mail in my yubikey or they won't help me.. Even if I had a yubikey I would not mail it to these guys. They would probably just pretend it never got there, or my luck it would get lost in the mail. They said that if someone lost there yubikey, they will unlink it from the account, but if your yubikey breaks they won't unlink it from your account until you pay to mail it. Cross your fingers that it does not get lost. What kind of nonsense is that..So they said point blank if you break your yubikey and then lose it your never getting access to your account...What a clown outfit, they would use any excuse to lock people from their accounts.

It IS support that is responding to you. Getting hysterical about imagined dire scenarios is just silly. Insure the hell out of it, send it International Priority, which will cost you about $30 US, and get your new key that they have graciously offered to send at no cost. Why would they throw away their entire reputation to steal a few thousand dollars from you? They make that much in fees in a couple of hours, they don't need to kill that golden goose.

And really, stop the FUD. It is over the top, doesn't make your point any better to have multiple threads about it, and just paints you in a poor light when you are clearly being offered pretty damn good customer service right here in the open. Unless you have a reason that might make them right in this, do what they are suggested and send them the key back.

According to what they where telling me, I would never get into my account unless they actually had my yubikey period. I knew that was not true because they had already told me so prior. Yubikey would not be very useful if losing locked you out of your accounts. Now they have agreed to unlock my account without mailing in my yubikey. Image that... I opened another thread because this was the wrong place to put it, and they had yet give me a proper answer. The link above is for people who can log into their accounts. Which does me no good. They could have resolved this issue long ago by providing a option besides mailing it back as requested. Every time I requested a alternate method this was there response. It's all from the same ticket as well.

"Sure, we can request our management group to unlink your broken Yubikey from your account in the meantime. We will let you know as soon as he processes this request. We apologize for any inconvenience caused."

Later I received this...
"Unfortunately, this only applies for Yubikeys that are lost. If you have a broken yubikey, we require it to be mailed back due to our policy"

Later...
"Thank you for providing the balances. We will request our management group to unlink your Yubikey from your account. We will notify you as soon as this is processed. We appreciate your patience through this matter."

Again..
"Our apologies for misunderstanding the issue. You only need to mail the physical Yubikey back if you would like a free replacement. If you just want it unlinked from your account, we can proceed to do so. Please confirm the ownership by providing the last 3 transactions of your account."

Obviously they didn't follow through with that statement.
"Thank you for providing the balances. We will request our management group to unlink your Yubikey from your account. We will notify you as soon as this is processed. We appreciate your patience through this matter."

Again..
"For lost Yubikeys, we will be able to unlink the Yubikey after confirming ownership. For broken Yubikeys, we will need the physical Yubikey returned."
"All other users have mailed back broken Yubikeys to us and in order to be fair, we must request the same from you."
What is this the fair police?

[CoinSpeculator]

Thank you for posting your experiences.  Sounds like they don't have any one person running the operation.

I was considering one of these a while back but it's honestly more likely they would steal/lock me out of my accounts than a hacker getting into my computer.

[naypalm]

Anyone have of of these mt gox yubikeys?

[TbbW]

Anyone have of of these mt gox yubikeys?

Lol i still got mine... not that there is any use for it anymore.

[naypalm]

I wanted to get one back in the day, but never got one of the freebie codes

They are now a collectible item, although they are indeed useless.