Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

81–90 of 294 posts

Re: Coinbase user emails and full names leaked

#81

Post by korzun »

lettergram wrote: post #28

This doesn't seem like that big of an issue. Yes coinbase should protect against this, but it doesn't really cause a security threat of any kind (assuming you have a secure password). This is a list of people who have bitcoins, but if you have a secure password you should be fine, further you can change your email.

Actually it's a big deal, if your local bank allowed to do mass look-ups like that you would be receiving phisihing attempts that pretend to be that facility for the rest of your life.

And right now, an email is part of your security auth since it's email * password.

When email is known as a 'good user' that reduces that multiplication to just password.

Re: Coinbase user emails and full names leaked

#84

Post by sciguy77 »

nwh wrote: post #40
jellicle wrote: post #35

Earlier quoted context omitted.

> Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Were you born yesterday? The steal-all-your-money rate of bitcoin businesses is running right around 100%, and you're going to lecture people that "they can only ever lose a small portion of all stored user funds"? Really?

Coinbase isn't some random website made in a basement. It's a well funded, YC backed, known-founder company that complies with relevant banking law. There's absolutely nothing to suggest that they hold a partial reserve or have any ill intention whatsoever.

MtGox was the biggest Bitcoin exchange with the largest trade volume. I still lost all my BTC when it went under.

Re: Coinbase user emails and full names leaked

#85

Post by Einstalbert »

devanti wrote: post #68

Seeing a complaint about Coinbase every week makes me feel like they are a poorly managed company -- which is crucial if you're a company dealing with a lot of money.

Reputation is sacred for these kinds of companies and this stuff isn't helping. I was just about to sign up for them, I had their tab open in my browser, but I sincerely thought something like this would happen and that I would "be on a list." Tab's closed, now.

Re: Coinbase user emails and full names leaked

#86

Post by [deleted] »

[deleted] wrote: post #80
eli wrote: post #29

Earlier quoted context omitted.

shrug Some people certainly do: https://twitter.com/search?q=just%20bought%20coinbase&src=ty... I agree it's not ideal, but if your security relied on a guessable email address staying private, you're already not in a good place.

[deleted]

[deleted]

Re: Coinbase user emails and full names leaked

#87

Post by sillysaurus3 »

nwh wrote: post #43
tokenizerrr wrote: post #38

Earlier quoted context omitted.

Just invest in a raspberry pi as an offline cold storage bitcoin machine. They're not expensive, and armory (or electrum) work fine on it. Make a paper backup and keep it in a safety deposit box if you have a large amount of bitcoins.

That's not convenient. Coinbase is convenient. You're suggesting a ride on lawnmower as a substitute to a car. As a spending wallet Coinbase is fairly close to ideal. Please read my post carefully next time.

There's no reason to argue against an inexpensive solution like a Pi + Armory in comparison to the massively risky "trust a third party to hold all my coins" approach.

Perhaps you're arguing so vehemently in support of Coinbase because you're keeping all of your coins there? If so, I would suggest you move them to a secure cold storage wallet immediately.

Re: Coinbase user emails and full names leaked

#88

Post by psykovsky »

smtddr wrote: post #55
jeremymcanally wrote: post #26

Earlier quoted context omitted.

Do you publish that you have a Coinbase account? That's the issue. Now these people are valuable targets for spear phishing and other attacks on their e-mail accounts because it's known that they have hot access to at least some amount of Bitcoin. Without that information, an attacker is shooting blind. So, this sort of leak or enumeration basically reduces the (though tenuous) degree of security afforded by one's pr…

https://twitter.com/SMTDDR/status/438404079438422016 Bonus points: That screenshot also tells you I have an account with Patelco Credit Union.

You trust Patelco CU and Coinbase employees a lot... Watch out, it might backfire...

Re: Coinbase user emails and full names leaked

#89

Post by sillysaurus3 »

sciguy77 wrote: post #84
nwh wrote: post #40

Earlier quoted context omitted.

Coinbase isn't some random website made in a basement. It's a well funded, YC backed, known-founder company that complies with relevant banking law. There's absolutely nothing to suggest that they hold a partial reserve or have any ill intention whatsoever.

MtGox was the biggest Bitcoin exchange with the largest trade volume. I still lost all my BTC when it went under.

Same. It seems like it can't happen until it happens, and then you face the reality that it happened. It sucks, and there's absolutely no protection for consumers from it. There's not even any insurance policy that exchanges can purchase yet, which is pretty much the only hope at this point.

Re: Coinbase user emails and full names leaked

#90

Post by bvttf »

NathanKP wrote: post #64

Does anyone know where or if the full list can be found? I have a Coinbase account but I don't see my name on the abbreviated list. I suspect that the person who made this Pastebin just ran a huge list of known leaked emails, or dictionary based emails through the minor information leakage vulnerability discussed yesterday ( https://hackerone.com/reports/5200 ). I would be willing to bet that this brief list is actua…

For what it's worth, I have a coinbase account linked to a gmail address in the form firstname.lastname, where both are common names. I'd expect it to be in a dictionary based list, and it's not on the pastebin.
Post reply on HN