Bitcoin Forum
December 07, 2016, 02:33:55 PM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: « 1 [2] 3 »  All
  Print  
Author Topic: MTGOX really is affecting me being able to feed my family  (Read 3962 times)
Kazimir
Legendary
*
Offline Offline

Activity: 1036



View Profile
June 05, 2012, 10:18:47 AM
 #21

Well,I lost $200,somehow my account was hacked (no password changed,I was able to login)
[....]
I'll be using another exchange.

P.S. my PC is very secure.

That sucks man Undecided I assume you changed your password in the mean time?

Did you *ever* use the previous password (the one that was comprimised) on any other website or service or phone or anything?

Was it an easy to guess or bruteforce password? Or rather, if you're sure you're not using that password any longer (which you shouldn't), what was it? Just curious, cause some people really seem to have a twisted ideas about the strength of their password.

In theory, there's no difference between theory and practice. In practice, there is.
Insert coin(s): 1KazimirL9MNcnFnoosGrEkmMsbYLxPPob
1481121235
Hero Member
*
Offline Offline

Posts: 1481121235

View Profile Personal Message (Offline)

Ignore
1481121235
Reply with quote  #2

1481121235
Report to moderator
1481121235
Hero Member
*
Offline Offline

Posts: 1481121235

View Profile Personal Message (Offline)

Ignore
1481121235
Reply with quote  #2

1481121235
Report to moderator
1481121235
Hero Member
*
Offline Offline

Posts: 1481121235

View Profile Personal Message (Offline)

Ignore
1481121235
Reply with quote  #2

1481121235
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1481121235
Hero Member
*
Offline Offline

Posts: 1481121235

View Profile Personal Message (Offline)

Ignore
1481121235
Reply with quote  #2

1481121235
Report to moderator
1481121235
Hero Member
*
Offline Offline

Posts: 1481121235

View Profile Personal Message (Offline)

Ignore
1481121235
Reply with quote  #2

1481121235
Report to moderator
1481121235
Hero Member
*
Offline Offline

Posts: 1481121235

View Profile Personal Message (Offline)

Ignore
1481121235
Reply with quote  #2

1481121235
Report to moderator
Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 05, 2012, 10:24:22 AM
 #22

P.S. my PC is very secure.

Which version of Windows are you running?

Kazimir
Legendary
*
Offline Offline

Activity: 1036



View Profile
June 05, 2012, 10:30:53 AM
 #23

P.S. my PC is very secure.
Which version of Windows are you running?
I assume you mean: which version of Linux?

He said it's very secure, so obviously he's not running Mac OS X or Windows.

In theory, there's no difference between theory and practice. In practice, there is.
Insert coin(s): 1KazimirL9MNcnFnoosGrEkmMsbYLxPPob
Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 05, 2012, 12:25:14 PM
 #24

P.S. my PC is very secure.
Which version of Windows are you running?
I assume you mean: which version of Linux?

He said it's very secure, so obviously he's not running Mac OS X or Windows.

No I meant Windows.  I'm guessing it was Windows, and wanted a good opportunity to explain how one running Windows cannot make the statement "my PC is very secure".  And to recommend how anyone, particularly someone running Windows, with more than pocket change worth of funds on their exchange should be using two factor authentication.

TangibleCryptography
Sr. Member
****
Offline Offline

Activity: 476


Tangible Cryptography LLC


View Profile WWW
June 05, 2012, 12:28:51 PM
 #25

One thing I have asked for in the past and never gotten a response from MtGox on is a IRREVOCABLE DELAY TIMER.
Make it optional but it could add security and prevent thefts like this.  Pretty simple concept.

User sets a irrevocable waiting period of sending coins.  
User understands when setting it that it can't be removed without waiting the same amount of time (i.e. if you remove a 60 min waiting period it takes 60 minutes before it is removed).

So it works like this:
1) Attack attempts to send coins.
2) MtGox accepts the requests and delays it x minutes (preset by user).
3) MtGox sends email (and SMS it is 2012) to user with amount of coins, address, and a CANCEL THIS IS FRAUD link.
4) If user clicks cancel link it DOESN'T require a password (as attacker may have changed it), the tx is canceled and account frozen
5) If tx is legit delay timer expires and funds are sent.

It allows users to set the level of security they want.  Users who want ability to instantly send coins can use default 0 min delay timer.  Cautious users could use a delay timer of 30 min.  Ultra paranoid could use a delay time of 240 min.  Combined with email and SMS notifications it becomes very difficult for an attacker to transfer coins off site.

Now using the same process the user could WHITE LIST certain addresses which don't need to be delayed.  Obviously adding an address to the whitelist requires the delay (as would changing email or SMS phone #).  User gets emails (w/ fraud link) for adding a whitelisted addess, changing delay timer, removing delay period, changing email/phone, and sending coins.


Maybe I should trademark the term "warm wallet" (i.e. it isn't a "hot wallet" or "cold wallet" but a "warm wallet")? Smiley
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1442



View Profile
June 05, 2012, 12:39:11 PM
 #26

P.S. my PC is very secure.

But you are not. You can't buy an anti-stupidity software, you know?

Stop clicking links to phishing sites inside phishing emails.

rjk
Sr. Member
****
Offline Offline

Activity: 420


1ngldh


View Profile
June 05, 2012, 12:47:32 PM
 #27

I would like answers to my questions about network security. It seems that the recent claims of compromise are made by those that don't want to discuss whether their network is secure.

I want to know:
Have you used or are you using Tor?
Have you used or are you using a VPN?
Are you on a corporate network?
(And further to the above, has your company admin installed a company trusted root certificate on your box)
Have you ever clicked a link to mtgox in an email?

Also, since your password is unique for all sites, I'm sure you will have no problem sharing it with us for analysis since we can assume it has been compromised.

There's no point posting here asking for help if we can't have the information to help you.

Mining Rig Extraordinaire - the Trenton BPX6806 18-slot PCIe backplane [PICS] Dead project is dead, all hail the coming of the mighty ASIC!
Kazimir
Legendary
*
Offline Offline

Activity: 1036



View Profile
June 05, 2012, 01:15:24 PM
 #28

And to recommend how anyone, particularly someone running Windows, with more than pocket change worth of funds on their exchange should be using two factor authentication.
How do you go about two factor authentication, when using a local wallet / BTC client?

Personally I use an encrypted wallet, and run a client inside a VM which is on an encrypted truecrypt container which I only mount to run bitcoin. Still, everything occurs at my computer locally. Do you have something else in mind when you advocate two factor authentication?

In theory, there's no difference between theory and practice. In practice, there is.
Insert coin(s): 1KazimirL9MNcnFnoosGrEkmMsbYLxPPob
Inaba
Legendary
*
Offline Offline

Activity: 1260



View Profile WWW
June 05, 2012, 01:25:16 PM
 #29

The solution is to stop using MTGox.  Their constant lies about funding times and delay after delay is indicative of a larger problem that they are not admitting to (insolvency, outright fraud, using funds interest free?  Who knows).  But the fact is, they continually lie about what is going on and the "reason" why they somehow can't complete requests. 

They are a, in a nutshell, incredibly dishonest and people need to stop using them.  Find another exchange.

If you're searching these lines for a point, you've probably missed it.  There was never anything there in the first place.
cryptoanarchist
Hero Member
*****
Offline Offline

Activity: 896



View Profile
June 05, 2012, 04:38:06 PM
 #30

Their withdraw problems from wire transfers to Dwolla delays is just too much now. Why is it that I have to complain here bout them for them to do anything about my delays? As soon as I do it's like they do me a small favor and clear a little of the lot of money I have withdrawn but still has not shown up in my accounts. I'm fully verified with them and was thinking about becoming a trusted member but it just seems like it's not worth it. I used to have a great relationship with them as they used to be the best at Customer support and quickness of withdrawing but it's gone down hill the last two months and now I find myself with investments in BTC with MTGOX that I'm not getting my paid and not being able to support my family because of the amount of money they have held up of mine. Something needs to be done about this. Please magicaltux or anyone from MTGOX tell us the truth of what's going on.

Why are you using MtGox if you need to be able to withdraw on a timely basis?

Have you done ANY research on these companies? MtGox is notoriously slow with notoriously crappy customer service. The folks at Dwolla are confirmed scammer douchebags who change their TOS to rip people off.
Unacceptable
Legendary
*
Offline Offline

Activity: 1946



View Profile
June 05, 2012, 06:49:29 PM
 #31

I would like answers to my questions about network security. It seems that the recent claims of compromise are made by those that don't want to discuss whether their network is secure.

I want to know:
Have you used or are you using Tor?
Have you used or are you using a VPN?
Are you on a corporate network?
(And further to the above, has your company admin installed a company trusted root certificate on your box)
Have you ever clicked a link to mtgox in an email?

Also, since your password is unique for all sites, I'm sure you will have no problem sharing it with us for analysis since we can assume it has been compromised.

There's no point posting here asking for help if we can't have the information to help you.

Never used TOR
Never been part of a VPN
Private home network behind a router with firewall & AV installed (Avast),but use other AV's when necessary.
Never click on any emails from any one I don't know personally.

My old PW was Capri200,kinda simple but I won't forget it.I'm not a software guru or crypto phreak.No I did not use that PW anywhere else ever.

I use Win 7 64 bit.I have been building PC's for 12 years,so I'm not new to the PC enviroment,just a little naive I guess.I know all about phising emails & never click any links in emails or websites without thinking,if I need to do so I use a spare PC that I can "sacrifice" by reinstalling (I have 4 PC's in my room for gaming & surfing).

My situation is exactly like this one:

https://bitcointalk.org/index.php?topic=84585.0

I would've posted there,but I didn't browse the threads far enough Roll Eyes

"If you run into an asshole in the morning, you ran into an asshole. If you run into assholes all day long, you are the asshole."  -Raylan Givens
Got GOXXED ?? https://www.youtube.com/watch?v=9KiqRpPiJAU&feature=youtu.be
"An ASIC being late is perfectly normal, predictable, and legal..."Hashfast & BFL slogan Smiley
Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 05, 2012, 06:53:05 PM
 #32

And to recommend how anyone, particularly someone running Windows, with more than pocket change worth of funds on their exchange should be using two factor authentication.
How do you go about two factor authentication, when using a local wallet / BTC client?

Personally I use an encrypted wallet, and run a client inside a VM which is on an encrypted truecrypt container which I only mount to run bitcoin. Still, everything occurs at my computer locally. Do you have something else in mind when you advocate two factor authentication?

Well, that comment was describing how two factor authentication (which Mt. Gox offered first with Yubikey, and as of a few hours ago now supports Google Authenticator as well) is needed for using Mt. Gox, especially on Windows, but really all platforms, to be protected from these password-only thefts.

For a local wallet / BTC client there's no concept of two factor, and thus there needs to be a level of security appropriate for the risk.  For larger amounts, there's a secure method -- an air gapped system used for transacting.  When M of N transactions are implemented, that will help to lessen the risk of theft as well.

For now, what you have is probably much more secure than what most do, but it still is vulnerable if your host is compromised, say from a 0-day.  Or let's say some thieving software engineer at ATI slipped in a wallet stealer into their GPU driver binaries.  We'ld probably never know until after the wallets are gone.  (Your VM image probably wouldn't run the ATI binary driver so you'ld probably be safe from that specific vulnerability.)

Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 05, 2012, 06:56:30 PM
 #33

My old PW was Capri200,kinda simple but I won't forget it.I'm not a software guru or crypto phreak.No I did not use that PW anywhere else ever.

Root cause detected (most likely):
 - https://passfault.appspot.com/password_strength.html#menu

Would be nice if Mt. Gox (and other exchanges) would warn if a weak password is entered.
 - http://en.wikipedia.org/wiki/Password_strength

Use secure passwords, and use KeePass or LastPass:
 - http://superuser.com/questions/432844/how-do-i-securely-store-and-manage-180-passwords

Unacceptable
Legendary
*
Offline Offline

Activity: 1946



View Profile
June 05, 2012, 06:57:22 PM
 #34

The solution is to stop using MTGox.  Their constant lies about funding times and delay after delay is indicative of a larger problem that they are not admitting to (insolvency, outright fraud, using funds interest free?  Who knows).  But the fact is, they continually lie about what is going on and the "reason" why they somehow can't complete requests. 

They are a, in a nutshell, incredibly dishonest and people need to stop using them.  Find another exchange.


Personally,I'll only use MTgox for "at the moment trades",if I ever use them again,I'll never leave any coins or money in there again & I recommend everyone to do the same.

I was trading my cash for coins & vise versa,I made 15 BTC in 6 weeks this way,buy low sell high.I thought thier site was secure.I have an IT network guy coming over to scan my PC today,I'll let you guys know what we find.

"If you run into an asshole in the morning, you ran into an asshole. If you run into assholes all day long, you are the asshole."  -Raylan Givens
Got GOXXED ?? https://www.youtube.com/watch?v=9KiqRpPiJAU&feature=youtu.be
"An ASIC being late is perfectly normal, predictable, and legal..."Hashfast & BFL slogan Smiley
rjk
Sr. Member
****
Offline Offline

Activity: 420


1ngldh


View Profile
June 05, 2012, 07:07:41 PM
 #35

Thanks for the answers. The simple answer is that that is an extremely easy password that any dictionary cracking system would have found quickly. You may be interested in LastPass to generate secure passwords that are per-site and store them for you. However, LastPass is only as strong as your master password, unless you use it with a yubikey.

Mining Rig Extraordinaire - the Trenton BPX6806 18-slot PCIe backplane [PICS] Dead project is dead, all hail the coming of the mighty ASIC!
Unacceptable
Legendary
*
Offline Offline

Activity: 1946



View Profile
June 05, 2012, 07:25:22 PM
 #36

Thanks for the answers. The simple answer is that that is an extremely easy password that any dictionary cracking system would have found quickly. You may be interested in LastPass to generate secure passwords that are per-site and store them for you. However, LastPass is only as strong as your master password, unless you use it with a yubikey.

 Wink NP

I just want to figure out WHY this is happening Huh Yes my PW might have been easy to break  Sad

The answer can't be using yubikey(if you lose it,you lose anyhow) or lastpass or whatever.If everyone has to be that secure minded then BTC will NEVER go mainstream.80% of the american public (me included) is dumber than box of rocks & will never accept those extremes of security,on a personal level.There has to be a better way.............I know of 3 people that have been hacked on MTgox in the last week,not to mention how many have not been reported here on the forum.........Something is up & hope this community can help find it out.......

"If you run into an asshole in the morning, you ran into an asshole. If you run into assholes all day long, you are the asshole."  -Raylan Givens
Got GOXXED ?? https://www.youtube.com/watch?v=9KiqRpPiJAU&feature=youtu.be
"An ASIC being late is perfectly normal, predictable, and legal..."Hashfast & BFL slogan Smiley
Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 05, 2012, 07:50:03 PM
 #37

80% of the american public (me included) is dumber than box of rocks & will never accept those extremes of security,on a personal level.

He has a point there.  That's why (in the U.S.) when the banks have losses from identity theft they find it cheaper to either pass along the cost when they can (reverse transactions) or eat the remaining loss when they can't.  That's cheaper than the cost of customer training and lost customer satisfaction when trying to impose security procedures like a Yubikey, for instance.

I don't know the solution.  Now that there is Google authenticator on Mt. Gox, hopefully more people can secure their accounts.  Right now it seems the password crackers are just shooting fish in the Mt. Gox barrel.

Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 07, 2012, 01:31:49 AM
 #38

80% of the american public (me included) is dumber than box of rocks & will never accept those extremes of security,on a personal level.

He has a point there.  That's why (in the U.S.) when the banks have losses from identity theft they find it cheaper to either pass along the cost when they can (reverse transactions) or eat the remaining loss when they can't.  That's cheaper than the cost of customer training and lost customer satisfaction when trying to impose security procedures like a Yubikey, for instance.

Well, let's see after this LinkedIn security breach if anything changes.  3.4 million passwords have been cracked so far, though if the perpetrator has the corresponding e-mail addresses that hasn't been leaked yet.  But anyone in the list of 6 million with a password of 8 characters or less in length has probably had their LinkedIn password cracked by now, or will have before long.  At some point this will force "extremes of security" such as strong password requirements.


My old PW was Capri200,kinda simple but I won't forget it.I'm not a software guru or crypto phreak.No I did not use that PW anywhere else ever.

Incidentally, Capri200 either wasn't used or hasn't been cracked yet.
 - http://www.leakedin.org/?check=3d9ad3d4e34f82f0b0fd29de989d51acb737c1e8

Unacceptable
Legendary
*
Offline Offline

Activity: 1946



View Profile
June 07, 2012, 03:42:15 AM
 #39

80% of the american public (me included) is dumber than box of rocks & will never accept those extremes of security,on a personal level.

He has a point there.  That's why (in the U.S.) when the banks have losses from identity theft they find it cheaper to either pass along the cost when they can (reverse transactions) or eat the remaining loss when they can't.  That's cheaper than the cost of customer training and lost customer satisfaction when trying to impose security procedures like a Yubikey, for instance.

Well, let's see after this LinkedIn security breach if anything changes.  3.4 million passwords have been cracked so far, though if the perpetrator has the corresponding e-mail addresses that hasn't been leaked yet.  But anyone in the list of 6 million with a password of 8 characters or less in length has probably had their LinkedIn password cracked by now, or will have before long.  At some point this will force "extremes of security" such as strong password requirements.


My old PW was Capri200,kinda simple but I won't forget it.I'm not a software guru or crypto phreak.No I did not use that PW anywhere else ever.

Incidentally, Capri200 either wasn't used or hasn't been cracked yet.
 - http://www.leakedin.org/?check=3d9ad3d4e34f82f0b0fd29de989d51acb737c1e8

Very interesting SG  Wink

I'll never keep ANY money or coin at any exchange ever again because of this.I don't trust anyone in bitcoin any farther than I can throw them anymore....................

Those coins I lost were earned by mining,so I didn't lose any "out of pocket" cash at least.

This hacking crap WILL be the main thing that keeps bitcoin from going to the general population.Who besides software guru's & REAL puter nerds will understand how to secure either thier PC or logins to such an extreme level  Huh

I'll still mine like crazy & reap those rewards,but as far letting any entity hold my earnings for any length of time,FORGET IT !!

Until there is a way to "backup" BTC like a bank does (reimburse for specific reasons),whether with insurance or something similar,BTC will be used mainly by launderers & drug dealers (Silk Road)................

"If you run into an asshole in the morning, you ran into an asshole. If you run into assholes all day long, you are the asshole."  -Raylan Givens
Got GOXXED ?? https://www.youtube.com/watch?v=9KiqRpPiJAU&feature=youtu.be
"An ASIC being late is perfectly normal, predictable, and legal..."Hashfast & BFL slogan Smiley
Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 07, 2012, 10:04:53 AM
 #40

This hacking crap WILL be the main thing that keeps bitcoin from going to the general population.Who besides software guru's & REAL puter nerds will understand how to secure either thier PC or logins to such an extreme level  Huh

Well, I guess they won't be adding any LinkedIn connections either.  Or looking for love on eHarmoney:
Another 1.5 million passwords leaked
 - http://arstechnica.com/security/2012/06/eharmony-confirms-member-passwords-compromise/

Pages: « 1 [2] 3 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!