Quote from: flatfly on May 13, 2013, 06:59:22 PM

Quote from: DeathAndTaxes on May 13, 2013, 06:28:42 PM

Quote from: flatfly on May 13, 2013, 06:22:54 PM

Stop believing the myth that TFA is uncrackable.
It does improve security, sure, but it is no way the holy grail.
There have been precedents where malware could steal funds despite TFA.

http://www.wired.com/insights/2013/04/five-myths-of-two-factor-authentication-and-the-reality/

Please provide some examples, your linked article did nothing of the sort.

Nobody said anything about holy grail but extraordinary claims require extraordinary details. The OP provided no details so to assume MtGox 2FA has been compromised is dubious at this time.

Quote

Measures like the above would greatly help secure user accounts (in addition to TFA) while being rather easy to implement, so Gox really has no excuses for neglecting such details.

Unless the OP had a horribly weak password the most common attack vector is compromise to the users machine and gain access to credentials via keylogger. In that instance it is highly likely the user's email address is compromised as well (unless it is also protected by 2FA). A more sophisticated attack would use OP computer as a proxy or to just steal the OP session when already logged in. In either case the only IP would be the users. Layering steps and procedures which all involve the same compromised machine is probably just "feel good" security.

My claim was not that extraordinary... It's not like I'm saying
I was abducted by a UFO or something

Anyway, here's one rather famous example:

http://arstechnica.com/security/2012/12/sophisticated-botnet-steals-more-than-47m-by-infecting-pcs-and-phones/

I agree with the rest of your comments.

Nice example. This is one reason why I favor dedicated offline tokens. PayPal (of all people) uses a nice one which is the size of a credit card so you can easily store it in your wallet.

The extraordinary claim was more direct at the OP claim. Some details would be nice. Past examples of people reporting their 2FA on MtGox was compromised turned out to be untrue (in one example user never activated it due to user error).