unlock codes for Mtgox yubikeys leaked

[atsoat]

For those who have a Mtgox yubikey and now wish to unlock it and re-program it for other purposes, the unlock codes have been leaked:
http://www.sendspace.com/file/in4ss6

Search for your serial number (as printed on the dongle) in the txt file downloadable at the above link (ignore/delete any obviously dodgy exe files that are downloaded at the same time). And then use the tools from http://www.yubico.com/products/services-software/personalization-tools/use/ to reprogram.

The entry ending in A relates to slot 1, while that ending in B relates to slot 2.

I discovered this via this page: http://crypto.stackexchange.com/questions/14809/any-use-for-now-defunct-mt-gox-yubikey. I have no idea who/how/when this was leaked.

While this list allows the yubikeys to be unlocked and re-programmed, assuming yours is listed (and mine was) - it is not a leak of the stored keys in the device.

If you had funds at MtGox when it eventually died, then obviously you should think about whether you really want to re-program your yubikey - as at some level it allows you to to prove ownership of your account there.

[1714995483]

1714995483

[1714995483]

1714995483

[Geremia]

Excellent! I can make use of my free YubiKey now! Thank you very much!

[ninjarobot]

Interesting.

Does the download link work for anyone?

(nothing happens when I click on the (BOT)yk_s.txt link...)

[WeMineCoins]

Fantastic I'd be all over this if I wasn't planning on framing my MtGox yubikey.

[Geremia]

Fantastic I'd be all over this if I wasn't planning on framing my MtGox yubikey.

Why would you frame it?   For your BTC history museum? 

[haploid23]

I had a chance to get my free Mtgox Yubikey from that security leak (2011?), but never bothered to get one. Now I wish I had gotten it, just to keep a piece of history.

[Nagle]

First, has anyone checked to see that this is valid data?

If it is, this is evidence of gross negligence by the Mt. Gox trustee. It should be reported to the Tokyo District Court and the Tokyo police.

[st4nl3y]

People should be careful when downloading this. It might contain traps, like mt.gox leaked database did.

[Nagle]

People should be careful when downloading this. It might contain traps, like mt.gox leaked database did.

No, it's just a plain text file of Yubikey IDs and unlock codes. Whether they work, I don't know.

[Geremia]

People should be careful when downloading this. It might contain traps, like mt.gox leaked database did.

No, it's just a plain text file of Yubikey IDs and unlock codes. Whether they work, I don't know.

It worked for mine.

[st4nl3y]

People should be careful when downloading this. It might contain traps, like mt.gox leaked database did.

No, it's just a plain text file of Yubikey IDs and unlock codes. Whether they work, I don't know.

Oh, in that case it should be fine then.

[Veda]

First, has anyone checked to see that this is valid data?

If it is, this is evidence of gross negligence by the Mt. Gox trustee. It should be reported to the Tokyo District Court and the Tokyo police.

(sorry for bumping just found this thead with google and felt like clearing this up)

These leaked keys are not in any way a security breach for Mt. Gox. These keys can only be used to reprogram your yubikey.
You can see the unlockcode as the locksmiths tool to change your the key of your front door to make it fit to another lock. By doing that, the lock the key originally was for, cannot be opened anymore afterwards (unless there where more than 1 keys).

I wish I had a Mt. Gox yubikey

[Yubi_David]

Hello All,

The access codes linked to above will only allow for the re-configuration of any Mt.Gox issued YubiKey, but cannot be used to extract the secrets stored on the YubiKeys themselves. Please note that if you overwrite the configuration of a Mt.Gox YubiKey, there is no way to restore it, and the YubiKey will no longer be able to verify your identity for any Mt.Gox services used with it previously.

Thank you,
-David Maples
Yubico Solutions Engineer
www.yubico.com

[Dehumanizer]

I've found this topic today when I was thinking about what to do with my old mtgox yubikey and I can confirm it worked for me as well.
I now have a working yubikey, thank you!

I did not have any balance at MtGox so I don't care about losing a potentional access to the restored MtGox (lol)

[Brewins]

So did anyone found some use for the yubikeys?

(whatever a yubikey is)

[sangaman]

What other Bitcoin services use Yubikeys? I thought it'd be a nice souvenir but I wouldn't mind making it a functional souvenir.

[Dehumanizer]

So far I have found and verified that Kraken.com works with yubikey, I will do some more research today if there are more useful sites that use yubikey 2FA.
And of course, you can configure 2nd slot (the long press) as static password, so anywhere where you need a password, you can use it. It's a random set of either 16 or 32 alphanumeric characters, so it's always more secure than any password you can create and remember yourself. It is of course always the same fixed string (until you reconfigure it again), so it's advisable to add some prefix which you easily remember for each place where you use this fixed password, so that you won't have the same password everywhere where you use it.

[Dehumanizer]

Blockchain.info wallet also allows to use yubikey

[Geremia]

So did anyone found some use for the yubikeys?

(whatever a yubikey is)

I use mine for two-factor authentication for my Google account.

[mayax]

who cares about MT Gox now?