Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

71–80 of 294 posts

Re: Coinbase user emails and full names leaked

#71

Post by sillysaurus3 »

nwh wrote: post #69
sillysaurus3 wrote: post #65

Earlier quoted context omitted.

You're right, there isn't anything suggesting that they hold a partial reserve. And there won't be even when they do. And when they close due to massive theft / loss of coin, and take all of their users' funds with them, that will be the first suggestion that any user hears of. It happened to me. It's not fearmongering, it's fact.

So ask them to prove their reserves if it bothers you so. Other large services have in the past.

Proving reserves doesn't help at all. They can die at any time from massive loss. Proof of reserve reveals whether there's a problem; it doesn't prevent any problem from happening.

To use a metaphor, a failed proof of reserve is like detecting that someone who's riding a motorcycle without a helmet has been launched into the air due to a car crash, and is about to hit the ground. That doesn't change the fact that they're not wearing a helmet in the first place. And in bitcoin's case, no such "helmet" exists. There is no protection for consumers against losing their funds by the exchange.

There's always going to be this massive risk of the coins disappearing due to any number of reasons: that they get hacked, that the founder steals them, that they lose them to some massive technical problem, that they experience another undocumented bitcoin protocol issue like malleability, that they lose access to their cold storage wallets, etc.

This has happened at, what, a dozen exchanges so far? They've all died due to one of the above reasons. Who's next? It's completely possible that Coinbase is next, and that you're recommending users throw their money away by trusting them. There's no reason to trust Coinbase. Keep your funds in your own secure cold storage wallet, and you'll have them forever. Keep them in Coinbase and you'll have them exactly as long as Coinbase lasts.

Re: Coinbase user emails and full names leaked

#72

Post by nvk »

ryanthejuggler wrote: post #9

I'm pissed. My email address is among those leaked. I got two transaction requests, the first for 732342.34425 BTC and the second for 999999.99999999 BTC. The second had registered a username of "⚠ URGENT: Сoinbase hacked. We" so that the email subject line read "⚠ URGENT: Сoinbase hacked. We sent you a payment request." I got my coin out of Inputs.io just a few days before they got hacked, and I've got a low balance…

You can only get so much for FREE, that's not Coinkite.com's model. We charge, but we answer email and fix issues.

Re: Coinbase user emails and full names leaked

#73

Post by reverend_gonzo »

FreezerburnV wrote: post #60
reverend_gonzo wrote: post #54

Earlier quoted context omitted.

I've used sneakemail for a number of years. With their paid account ($12/yr, I think), it lets you create emails on the fly with a specific pattern. For example: amazon-flanbiscuit@sneakemail.com That gets forwarded to your actual email address, and you can see how it was tagged. If needed, you can whitelist/blacklist specific senders from specific tags as well.

Never heard of them before. Do they have any benefit over Spam Gourmet? (which I use occasionally, and is free)

I've never heard of Spam Gourmet. I've been using Sneakemail for the past 10-15 years. Since it's so cheap, and it's worked well enough, I just haven't bothered looking at anything else.

Re: Coinbase user emails and full names leaked

#74

Post by waterlesscloud »

nwh wrote: post #62
megatron7 wrote: post #58

Earlier quoted context omitted.

There's one reason to believe they have ill intention: their habit of ignoring serious user problems (lost deposits, security problems) until they're widely public. Their actions make clear that they are enormously untrustworthy.

That doesn't really suggest malice so much as ill attention. From their posts it sounds like they are stretched a little thin under the load, if they wanted to steal they would just be gone not occasionally unresponsive.

It doesn't matter one bit if it's malice or inattention once your coins are gone.

Re: Coinbase user emails and full names leaked

#75

Post by berberous »

alandarev wrote: post #6

> Coinbase provides your full transaction history to the FBI, FinCEN and IRS every day. They are under a gag order. That is interesting accusation. Even if this is true, we will unlikely have evidence. Is there a serious risk to Coinbase users granted Gov is having full access?

This is highly likely to be true, and even if it's not, everyone should operate as if it's true. With the meteoric rise in price appreciation, I can't imagine the IRS at some point not requiring that the largest companies directly report users' income or capital gains to them. So don't be tempted to under-report your bitcoin gains. Similarly, the FBI and other money regulators have clearly shown their strong interest in stopping illegal activities conducted with Bitcoin, so I can't imagine them not receiving information from the largest companies and exchanges.

The allegation of a gag order is a bit odd, however. This should all be fairly obvious, so I'm not sure why anyone would want to keep it secret. Counting on the hubris and naivety of criminals, I guess?

Re: Coinbase user emails and full names leaked

#76

Post by korzun »

At this point I would not trust Coinbase, their engineering department shows that they have very little clue when it comes to building a secure infrastructure.

Not only they are not rate limiting and leaking names, their implementations are simply laughable.

With a proper design, customer should have been allowed to either enable/disable that end-point when somebody is searching for their email, or there should have been an option to have a 'whitelist' a set of users/user that are able to look up that information and make a transaction request.

On top of that, they should have been able to detect a pattern such as this attack and pro-actively block it.

This would pass for a to-do app API but Coinbase? Wow.

Re: Coinbase user emails and full names leaked

#77

Post by madaxe_again »

alandarev wrote: post #6

> Coinbase provides your full transaction history to the FBI, FinCEN and IRS every day. They are under a gag order. That is interesting accusation. Even if this is true, we will unlikely have evidence. Is there a serious risk to Coinbase users granted Gov is having full access?

It's hard to believe that it's not the case. I mean - why wouldn't the DOJ take an interest?

Re: Coinbase user emails and full names leaked

#79

Post by ajkjk »

nwh wrote: post #32
nly wrote: post #18

Earlier quoted context omitted.

You've just become a target. Everyone now knows everyone on that list has Bitcoin and use web wallets, so it's effectively a list of potentially profitable targets for email account compromise. Please ensure you're using random passwords on every site you use, select the best available security questions, use a password manager, and enable two factor authentication everywhere that allows it. Also move all your coins…

Hot/cold storage as coinbase is using is probably better than any encryption. Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Manual processing of this means there is some sanity checking on large withdrawals too. Encryption affords you none of that, I would be happier with coinbase than storing on any other online wallet for this very reason.

Why would you assume any of that? Do you put blind faith in companies as a rule, or has something about coinbase particularly enchanted you?

Re: Coinbase user emails and full names leaked

#80

Post by [deleted] »

eli wrote: post #29
jeremymcanally wrote: post #26

Earlier quoted context omitted.

Do you publish that you have a Coinbase account? That's the issue. Now these people are valuable targets for spear phishing and other attacks on their e-mail accounts because it's known that they have hot access to at least some amount of Bitcoin. Without that information, an attacker is shooting blind. So, this sort of leak or enumeration basically reduces the (though tenuous) degree of security afforded by one's pr…

shrug Some people certainly do: https://twitter.com/search?q=just%20bought%20coinbase&src=ty... I agree it's not ideal, but if your security relied on a guessable email address staying private, you're already not in a good place.

[deleted]
Post reply on HN