61–70 of 75 posts
Earlier quoted context omitted.
Coinbase CEO here. You can see an updated response on this issue here for more information: https://hackerone.com/reports/5200
Any info on why emails to whitehat@coinbase.com are being ignored? EDIT: For what it's worth, judging by the upvotes, a lot of people are hoping for any answer.
Earlier quoted context omitted.
The call is made on behalf of an user account using an API key. You could rate limit by either one and/or both.
Nothing really stopping somebody automating the creation of those either when you're up against people with ridiculous amounts of cost-free (read, botnet) resources to spam with. The Bitcoin reddit gets flooded with spam on an almost minutely basis despite reddits heavy rate limiting and captchas.
Earlier quoted context omitted.
Any info on why emails to whitehat@coinbase.com are being ignored? EDIT: For what it's worth, judging by the upvotes, a lot of people are hoping for any answer.
Because Coinbase has moved the program out of email and into here: https://hackerone.com/coinbase
There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. They also not into replying emails on their whitehat@ address.
Earlier quoted context omitted.
Lots of small businesses are perfectly happy to lock out foreign IP addresses on the slightest breeze, and it's probably a good result because for those businesses 1000 out of 1000 requests from the Eastern Hemisphere are hostile.
Assuming malicious requests come from other countries would be foolhardy.
But "for these businesses every connection from certain continents is an attack" is absolutely true.
I've worked with these businesses, worked with their CEO on their business needs, and seen their internet traffic. They, really, have absolutely no need to interact with Asia. They aren't hotshot SV companies trying to become the global leader of VR selfies, they are just boring[1] businesses sending plain old physical goods to customers within a thousand miles of them.
[1] Boring isn't a pejorative in my mind, but I know it is for some other people.
Source:
http://www.reddit.com/r/Bitcoin/comments/21wx59/coinbase_ema...
API rate limiting seems to be their best course of action, and it's disappointing that they're ignoring you.
Shouldn't they also stop letting the requester know whether the requested email address corresponds to a Coinbase user?
As someone who studies human nature I'd like to ask this question of the OP and anyone else who cares to answer. I'd seriously like to know this. Why do people spend extensive time [1] documenting security flaws like this [2] and going to the trouble of informing the company. And then if that doesn't work take more time to write up a blog post to get the info out? What do they gain by doing so exactly? Is this a play…
There's no one-size-fits-all answer to your question just as there isn't to questions like why someone wants to be a programmer, or a startup founder. The micro-motivations of individuals doing this sort of work can be all over the map from person to person. But as someone who very occasionally does such things (but isn't looking to "make a name" for myself as a security researcher, which is often a motivation): 1) T…
With respect to this would you say that there is a bit of a buzz when the company acknowledges and pats you on that back and says "hey thanks good job" (like your elementary school teacher?).
So taking this one step further I would say if that is the case then it becomes a big motivating factor, especially if the reinforcement is intermittent. Because you are searching for the next hit of approval.
Agree? Or?
Earlier quoted context omitted.
Sounds more like a design decision. Do you have any suggestions besides not using iframes?
No, since there's no way to check iframe's domain I don't think it can be fixed for iframes . They should stop asking for user's password right there, because it makes people trust any iframe
I am curious why Coinbase is not rate limiting that API call (temp-fix) or addressing this yet (even privately)? Granted it is not a critical flaw, but is having no limits over time really necessary for Coinbase API users?
You can read some more information on our response here https://hackerone.com/reports/5200