Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

121–130 of 294 posts

Re: Coinbase user emails and full names leaked

#121

Post by qdog »

fudWrecker wrote: post #116
simon_ wrote: post #82

Relatedly: DO NOT CHEAT ON YOUR TAXES. If you have any BTC profits and do not report them to the IRS this month, they are reasonably likely to catch you and make an example of you.

YOU ARE WRONG. The IRS is .1% in the business of audits and 99.9% in the business of scaring people about the possibility of an audit. Like you just did.

I have no bitcoin, but I've been audited. Unless your intent is to avoid taxation and you don't mind the risk, you should definitely pay tax on any bitcoins you've mined.

Re: Coinbase user emails and full names leaked

#122

Post by drags »

fudWrecker wrote: post #116
simon_ wrote: post #82

Relatedly: DO NOT CHEAT ON YOUR TAXES. If you have any BTC profits and do not report them to the IRS this month, they are reasonably likely to catch you and make an example of you.

YOU ARE WRONG. The IRS is .1% in the business of audits and 99.9% in the business of scaring people about the possibility of an audit. Like you just did.

I'm being audited right now (over a $2,500 student loan interest deduction, of all things) and it's totally automated. It seems like they have an internal process that goes "Taxpayer claimed deduction, IRS doesn't have paperwork matching payment activity, ergo send letter asking taxpayer to pony up".

If Coinbase is going to report earnings to the IRS, it's a good idea to match what they report or you might trigger the algorithm.

Re: Coinbase user emails and full names leaked

#123

Post by stonogo »

drags wrote: post #122
fudWrecker wrote: post #116

Earlier quoted context omitted.

YOU ARE WRONG. The IRS is .1% in the business of audits and 99.9% in the business of scaring people about the possibility of an audit. Like you just did.

I'm being audited right now (over a $2,500 student loan interest deduction, of all things) and it's totally automated. It seems like they have an internal process that goes "Taxpayer claimed deduction, IRS doesn't have paperwork matching payment activity, ergo send letter asking taxpayer to pony up". If Coinbase is going to report earnings to the IRS, it's a good idea to match what they report or you might trigger th…

What you are describing is not an audit. The automated system is a separate process. An audit involves an actual IRS agent manually reviewing your entire tax history for the given year.

Re: Coinbase user emails and full names leaked

#124

Post by dspillett »

eli wrote: post #29
jeremymcanally wrote: post #26

Earlier quoted context omitted.

Do you publish that you have a Coinbase account? That's the issue. Now these people are valuable targets for spear phishing and other attacks on their e-mail accounts because it's known that they have hot access to at least some amount of Bitcoin. Without that information, an attacker is shooting blind. So, this sort of leak or enumeration basically reduces the (though tenuous) degree of security afforded by one's pr…

shrug Some people certainly do: https://twitter.com/search?q=just%20bought%20coinbase&src=ty... I agree it's not ideal, but if your security relied on a guessable email address staying private, you're already not in a good place.

Because "well someone else does it" has always been the best reason to behave a certain way...

Re: Coinbase user emails and full names leaked

#125

Post by antr »

I don't care if you are a bootstrap startup or a multi-million dollar vc funded giant, I will signup to your service with an email alias. This is the reason why.

It's easy to block the account if spammers get hold of it, nobody is able to double check if I use other services by comparing login emails, I know which service has leaked my email... bottom line, I am in control. I feel sorry for these Coinbase users.

Re: Coinbase user emails and full names leaked

#126

Post by dspillett »

SDGT wrote: post #19
smtddr wrote: post #16

Earlier quoted context omitted.

FWIW, https://plus.google.com/people/find You can find people's G+ profile if you guess the email correctly. I wouldn't be surprised if LinkedIn,Facebook,etc. had the same type of thing. I do think that coinbase-API should be rate-limited or unreplayable, but I'm _much more_ interested in where the email-list input data came from. My email wasn't in this alleged partial list, but if it was I'd like to know where they…

You can just type emails into the gmail account creation form to get results back on if the username was taken. This whole debacle is making a mountain out of a molehill.

In an not-yet-authenticated state your code should do everything it can not to tell a potential hacker something they do not already know. Being able to check if an account exists and being able to read of the full name associated with it are not the worst problems in the world (though knowing the full name could make fishing attacks slightly less unconvincing) but if you take the attitude of never telling an attacker anything no matter how innocuous you think the information is then you are less likely to accidentally let something sensitive slip due to a bug.

Re: Coinbase user emails and full names leaked

#127

Post by doesnt_know »

nwh wrote: post #43
tokenizerrr wrote: post #38

Earlier quoted context omitted.

Just invest in a raspberry pi as an offline cold storage bitcoin machine. They're not expensive, and armory (or electrum) work fine on it. Make a paper backup and keep it in a safety deposit box if you have a large amount of bitcoins.

That's not convenient. Coinbase is convenient. You're suggesting a ride on lawnmower as a substitute to a car. As a spending wallet Coinbase is fairly close to ideal. Please read my post carefully next time.

Ah yes convenience, clearly the most important factor when choosing where to store your currency.

Re: Coinbase user emails and full names leaked

#128

Post by beat »

ben0x539 wrote: post #120
beat wrote: post #39

Earlier quoted context omitted.

There's lots wrong with anonymity. But those wrongs are the price we pay for the benefits of anonymity. Thinking there's "nothing wrong with anonymity" is the kind of intellectual fallacy that makes it so hard to take 'net libertarians seriously.

You're right, of course, and maybe I should have said "nothing wrong with submitting an article to hn without putting an established identity or even your real-life personal safety on the line". I suppose it was my desire to express with that comment my wider frustration regarding stuff like facebook/google+ real name policies that made my opt for a less accurate statement.

In general I agree, although there are certainly times when anonymity could be problematic even submitting an article on HN - for example, lying about an individual or a company, or starting a dangerous rumor.

The benefit of anonymity is, generally, to protect the anonymous from retaliation for things said or done anonymously. This is important, priceless even, when evil is being done by the powerful. For example, whistleblowing.

So the question is, is anonymity being used in any given case for good, neutral, or evil?

In the case of Facebook/Google+, I think the policy is understandable, if annoying. There's no business benefit to them to provide anonymity, and substantial business risk if they do.

Re: Coinbase user emails and full names leaked

#129

Post by dspillett »

dangrossman wrote: post #63
SDGT wrote: post #19

Earlier quoted context omitted.

You can just type emails into the gmail account creation form to get results back on if the username was taken. This whole debacle is making a mountain out of a molehill.

SMTP's the API for checking if an address exists at any mail provider. Start sending a mail, if the server doesn't tell you there's no such mailbox right then, you can abandon the connection without sending a message through. No CAPTCHAs there either.

Many mail servers delay account checking for that very reason.

They take in all mail - instead of telling the sending MTA that the account doesn't exist the message is accepted and sent to /dev/null. A bounce message may be generated but the automated MTA won't see that as the message will be carrying invalid mail sender information.

Re: Coinbase user emails and full names leaked

#130

Post by bduerst »

sillysaurus3 wrote: post #89
sciguy77 wrote: post #84

Earlier quoted context omitted.

MtGox was the biggest Bitcoin exchange with the largest trade volume. I still lost all my BTC when it went under.

Same. It seems like it can't happen until it happens, and then you face the reality that it happened. It sucks, and there's absolutely no protection for consumers from it. There's not even any insurance policy that exchanges can purchase yet, which is pretty much the only hope at this point.

Wouldn't that add a transactional cost to bitcoin, not unlike PayPal or Visa?
Post reply on HN