Quote from: MtGox_Adam on June 23, 2011, 11:17:41 AM

Hi Everyone,

We are evaluating 2 methods at this time. SMS, and Yubikey.

The "free subscription" we're referring to is SMS verification. Unfortunately we're a prime target for SMS flooding if we make this a free service, as you can probably understand.

As for the Yubikey, you will pay for a key and the service itself would of course be offered free of charge, making it effectively a one time fee.

I don't want to be in a situation where I can't get into my account if I forgot or lose my second factor... I'm hoping you allow some flexibility in this new system for us to decide which methods we would like to select during login. If I need to get into my account, without my second factor, it would be nice to have the ability to choose one of the other 2nd factors during the logon process... If I don't have my Yubikey, but I do have my cell phone configured, I would like to be able to still access my account. If I don't have either of my 2nd factors.. Answering a short series of "Security Questions" should be allowed to be used to gain access. Something like the way that Paypal does it.. During the logon process a user can say "I don't have my Key right now" and still answer a couple of security questions only that user would know, as a backup method, to gain access to their account.

Of course each user could decide which factors are available for them... This would allow users to balance not only the increased security of the new system, but also how convenient they wish it to be for themselves.

Maybe you can implement the SMS 2-Factor in house.. and find a way to avoid the "SMS flooding" scenario... like sending the SMS AFTER the correct password has been entered on the site.

Here is a list of the majority of International SMS carrier gateways.. It could be used as a starting point should you decide to roll your own solution..

att=@txt.att.net
at&t=@txt.att.net
bell=@txt.bell.ca
beeline=@sms.beemail.ru
bouygues=@mms.bouyguestelecom.fr
cricket=@sms.mycricket.com
d1=@t-d1-sms.de
eplus=@smsmail.eplus.de
etisalat=@email2sms.ae
fido=@fido.ca
lmt=@smsmail.lmt.lv
metropcs=@mymetropcs.com
mobistar=@mobistar.be
optus=0@optusmobile.com.au
orange=@orange.net
o2uk=@o2imail.co.uk
o2germany=0@o2online.de
rogers=@pcs.rogers.com
sfr=@sfr.fr
softbank=@softbank.ne.jp
sprint=@messaging.sprintpcs.com
starhub=@starhub-enterprisemessaing.com
sunrise=@mysunrise.ch
swisscom=@bluewin.ch
tdc=@sms.tdk.dk
telecom=@etxt.co.nz
telenor=@mobilpost.no
tele2=@sms.tele2.lv
telia=@gsm1800.telia.dk
telstra=@tim.telstra.com
telus=@msg.telus.com
three=@three.co.uk
tmobile=@tmomail.net
tmobileczech=@sms.paegas.cz
uscellular=@email.uscc.net
verizon=@vtext.com
virginmobile=@vmobl.com
virginmobilecanada@vmobile.ca
vivo=@torpedoemail.com.br
vodafonegermany=0@vodafone-sms.de
vodafonegreece=@sms.vodafone.gr
vodafoneitaly=@sms.vodafone.it
vodafoneuk=@vodafone.net