Quote from: solex on September 15, 2013, 11:29:05 PM

Quote from: 01BTC10 on September 15, 2013, 11:09:22 PM

Quote from: solex on September 15, 2013, 11:08:24 PM

Quote from: Han on September 15, 2013, 10:46:06 PM

Quote from: joesmoe2012 on September 15, 2013, 10:32:42 PM

Seems this guy didn't enable 2FA until after the attack.

Right now, both he and Mark Karpeles could be telling the truth if the attacker disabled 2fa, then reenabled it after he was done.

2FA on withdrawal is pointless if it can be disabled after login.
My understanding is that once Yubikey is enabled on MtGox for withdrawals it can't be disabled (by the user), hence the multi-week delay for lost/broken Yubikeys while account ownerwhip is re-verified and MtGox enables a replacement Yubikey.

It can be disabled with the OTP code.

But only by using the Yubikey...

Exact. I did it when I changed my Google Authenticator because I wanted to backup the seed.