Quote from: julz on September 13, 2011, 03:44:43 AM

Quote from: DiabloD3 on September 13, 2011, 02:34:51 AM

I notified MagicTux through his support email, and he sent back a useless form letter as a reply.

Quote

Recently there has been a large increase in the number of phishing attacks that have been made against the users of Mt.Gox.
...
We sincerely apologize for the inconvenience our users have suffered at the hands of phishers, and are doing all that we can to prevent further attacks in the future.

Thanks,

MtGox.com Team

I consider this a smoking gun.

What about browsing other sites whilst you are logged into mtgox?
Due to CSRF attacks - this is something you shouldn't do when you are logged in to an important account.

You can argue that the site should be fully protected against CSRF, especially as this has come up before regarding mtgox - but it's possible there is a regression in this area or even that your specific browser version is contributing to this risk.

XSRF attacks are largely difficult to perform in many cases. The problem is I would have had to visit the attacker's website at some point inside of the same environment I use to access mtgox to allow it.