Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

51–60 of 294 posts

Re: Coinbase user emails and full names leaked

#51

Post by billyhoffman »

wes-exp wrote: post #11
jyap wrote: post #5

Earlier quoted context omitted.

Here is the bug closed as "Won't fix" (so yes, it is the same exploit/bug): https://hackerone.com/reports/5200

Apparent Coinbase response there: "This stance is not unusual on the web: you'll find that user enumeration is possible on Facebook, Google, and nearly every other major internet site" Um, no. If that is what Coinbase believes, I just lost respect for their claims of security.

Please discuss which attack vectors you are worried about for this user enumeration issue affecting a public website.

Re: Coinbase user emails and full names leaked

#53

Post by gommm »

flanbiscuit wrote: post #48
gommm wrote: post #44

And this is why in addition to per site passwords, I also use per site email addresses. I like to be able to track who spams me and in case of leaks I like the ability to disable an email address...

how do you keep track of all the emails? and did you always do this or did you start at one point having to go back through a lot of old accounts to change emails and passwords?

I track all the emails with 1password (same as for the passwords).

I started doing this four years ago but before that I had an email address that I reserved only for signing up for most websites (to prevent spam leaking into my personal email address).

Re: Coinbase user emails and full names leaked

#54

Post by reverend_gonzo »

flanbiscuit wrote: post #48
gommm wrote: post #44

And this is why in addition to per site passwords, I also use per site email addresses. I like to be able to track who spams me and in case of leaks I like the ability to disable an email address...

how do you keep track of all the emails? and did you always do this or did you start at one point having to go back through a lot of old accounts to change emails and passwords?

I've used sneakemail for a number of years. With their paid account ($12/yr, I think), it lets you create emails on the fly with a specific pattern.

For example:

amazon-flanbiscuit@sneakemail.com

That gets forwarded to your actual email address, and you can see how it was tagged. If needed, you can whitelist/blacklist specific senders from specific tags as well.

Re: Coinbase user emails and full names leaked

#55

Post by smtddr »

jeremymcanally wrote: post #26
SDGT wrote: post #17

Earlier quoted context omitted.

Would you care explaining why it is that you believe email enumeration to be "insecure"? The data obtained is an email address and a name (only if the user filled in the "name" field). This may as well be treated as public information.

Do you publish that you have a Coinbase account? That's the issue. Now these people are valuable targets for spear phishing and other attacks on their e-mail accounts because it's known that they have hot access to at least some amount of Bitcoin. Without that information, an attacker is shooting blind. So, this sort of leak or enumeration basically reduces the (though tenuous) degree of security afforded by one's pr…

https://twitter.com/SMTDDR/status/438404079438422016

Bonus points: That screenshot also tells you I have an account with Patelco Credit Union.

Re: Coinbase user emails and full names leaked

#56

Post by Datsundere »

flanbiscuit wrote: post #48
gommm wrote: post #44

And this is why in addition to per site passwords, I also use per site email addresses. I like to be able to track who spams me and in case of leaks I like the ability to disable an email address...

how do you keep track of all the emails? and did you always do this or did you start at one point having to go back through a lot of old accounts to change emails and passwords?

keepass

Re: Coinbase user emails and full names leaked

#57

Post by FreezerburnV »

flanbiscuit wrote: post #48
gommm wrote: post #44

And this is why in addition to per site passwords, I also use per site email addresses. I like to be able to track who spams me and in case of leaks I like the ability to disable an email address...

how do you keep track of all the emails? and did you always do this or did you start at one point having to go back through a lot of old accounts to change emails and passwords?

You can always use a service such as spamgourmet to "protect" your main email and be able to disable email addresses at any time. All the emails you get from the disposable email addresses just go to your main email address. Also the email address each email goes through is repeated in the subject line, so it's easy to keep track of things. (you can also get a list of all your disposable email addresses from their website)

Re: Coinbase user emails and full names leaked

#58

Post by megatron7 »

nwh wrote: post #40
jellicle wrote: post #35

Earlier quoted context omitted.

> Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Were you born yesterday? The steal-all-your-money rate of bitcoin businesses is running right around 100%, and you're going to lecture people that "they can only ever lose a small portion of all stored user funds"? Really?

Coinbase isn't some random website made in a basement. It's a well funded, YC backed, known-founder company that complies with relevant banking law. There's absolutely nothing to suggest that they hold a partial reserve or have any ill intention whatsoever.

There's one reason to believe they have ill intention: their habit of ignoring serious user problems (lost deposits, security problems) until they're widely public.

Their actions make clear that they are enormously untrustworthy.

Re: Coinbase user emails and full names leaked

#59

Post by SDGT »

wes-exp wrote: post #36
SDGT wrote: post #17

Earlier quoted context omitted.

Would you care explaining why it is that you believe email enumeration to be "insecure"? The data obtained is an email address and a name (only if the user filled in the "name" field). This may as well be treated as public information.

It also discloses whether someone is a customer or not. Possibly en masse. Problems: 1) Aids phishing attacks against Coinbase and customers 2) Oftentimes harmless tidbits of information can be combined to form non-harmless information. In this case, disclosing email, name, and the fact of being a Coinbase customer, or not, seems minor on its own. However, combine it with some other dataset (let's say emails/password…

I would argue that using a personal email and filling in your full name on coinbase, who CLEARLY state you have no expectation of privacy in this regard, is effectively the same as publicizing the information.

If one cares about the privacy aspect, then don't use an email that is tied back to you in any way, and certainly don't fill in your personal information.

Re: Coinbase user emails and full names leaked

#60

Post by FreezerburnV »

reverend_gonzo wrote: post #54
flanbiscuit wrote: post #48

Earlier quoted context omitted.

how do you keep track of all the emails? and did you always do this or did you start at one point having to go back through a lot of old accounts to change emails and passwords?

I've used sneakemail for a number of years. With their paid account ($12/yr, I think), it lets you create emails on the fly with a specific pattern. For example: amazon-flanbiscuit@sneakemail.com That gets forwarded to your actual email address, and you can see how it was tagged. If needed, you can whitelist/blacklist specific senders from specific tags as well.

Never heard of them before. Do they have any benefit over Spam Gourmet? (which I use occasionally, and is free)
Post reply on HN