404600+ entries in 0.122s
mircea_popescu: i don't think she actually understood before what sessions are and how they work
mircea_popescu: anyway, as you say. mtgox does not talk to yubikey, it talks to teh computor.
mircea_popescu: "Edit2: I was finally able to log into my account and found an API key with full rights to everything. I never made one, wtf does this mean?"
mircea_popescu: my impression of the general truecrypt population is that they're not particularly more secure than average
☟︎ mircea_popescu: "TC gives you a false sense of security so its worse than no partition encryption."
mircea_popescu: "Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes."
mircea_popescu: "x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection."
mircea_popescu: asciilifeform the ideea is, suppose i pass all my traffic through your controlled relay
mircea_popescu: i don't think it has anything to do with the 2fa mtgox issue but anyway
mircea_popescu: Used bitcoin-qt and litecoin-qt. For the wallets, those encryption passwords were from memory. The truecrypt password, I always copied and pasted the password from a text file, on a USB drive, inside a password protected winrar file, inside of a password protected winrar file, inside of a password protected winrar file, totaling 3 different password protected rars to reach the .txt file.
mircea_popescu: optimator not sure why people imagine machines locate items by name
mircea_popescu: "I figured if I was ever the victim of a wallet stealing program, implementing a dummy in the default location would fool it and upload it, rather than my real one, to the attackers choice, but I was wrong."
mircea_popescu: "I know I've found this one thing that I just have to download and install Java for, then totally forget or put off uninstalling it afterwards, many a time."
mircea_popescu: "In fact, scratch the social engineering, you don't need to convince someone to run your .exe if you can just run your .exe for them via a Java drive-by attack, and admit it, you've left Java installed for extended periods of time, even if you try to keep it uninstalled normally."
mircea_popescu: always funny when people with 85 ltc speak of the masses.
mircea_popescu: "I haven't nor will I ask for donations. This truly sucks for me, but I only want to find out how this happened. I wish I could see the code/method used for educational purposes. Fuck people who steal. I strive for bitcoins and litecoins to gain popularity among the masses and become an accepted currency in societies eyes."
☟︎ mircea_popescu: asciilifeform bitcoind is such a mess it'd be easier to make a million dollars being a janitor.
mircea_popescu: I used a random 64 character ASCII character password from this site for my truecrypt password.
mircea_popescu: optimator the reason girl said anything/i'm leading some credence to the claim of 2fa is because this isn't the first case i've heard.
mircea_popescu: i have yet to see any indication of such wonder in practice.
mircea_popescu: for the simple reason that if anyone ever did most of the us would be so very much less lonely.
mircea_popescu: see, but it'd seem to me you readily argue both ends of this rope.
mircea_popescu: <asciilifeform> there is only so many times that this can happen without a real effect
mircea_popescu: but it wouldn't be the first website with a broken 2fa implementation.
mircea_popescu: if indeed this was an attack able to cut through their (braindead) 2fa implementation
mircea_popescu: you'd have to be born last night to actually believe this.
mircea_popescu: NOW what you do with this ion cannon is steal random 4 btc wallet ?
mircea_popescu: and let's presume for a moment you have no better use for it than btc.
mircea_popescu: listen. suppose you actually have the tech to own yubikeys
mircea_popescu: nope. it'll do exactly the same thing as mtgox lieing about "hacks"
mircea_popescu: right, what io'm sauying is, this is a working prototype
mircea_popescu: it's horible for gox, and esopecxially so for gox investors. so ?
mircea_popescu: i still need to see someone argue convincingly that goxlag is bad for bitcoin.