Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

161–170 of 294 posts

Re: Coinbase user emails and full names leaked

#161

Post by tptacek »

jakejake wrote: post #154
sillysaurus3 wrote: post #144

Earlier quoted context omitted.

Would you include in your response the reason why you're ignoring Homakov's security flaw reports, which were emailed to you at your whitehat@coinbase.com email address? https://news.ycombinator.com/item?id=7505757 A lot of people are getting nervous that you're not taking security seriously at Coinbase. Ignoring whitehat reports would seem to be a serious issue.

They mentioned something about it on the thread that they were transitioning to a new system - plus the fact that nobody saw it as a vulnerability. I guess that's the reason

Apropos nothing else and without judging the actual report you're referring to: if you set up a "whitehat@yourdomain" or "security@yourdomain" alias, you need to be responsive. You can't ignore good-faith messages because you don't think they're valid. You have to act like all good-faith messages are urgent.

Those aliases are cheap insurance, but they aren't free: they'll cost you some tech support cycles.

Re: Coinbase user emails and full names leaked

#162

Post by eli »

dspillett wrote: post #124
eli wrote: post #29

Earlier quoted context omitted.

shrug Some people certainly do: https://twitter.com/search?q=just%20bought%20coinbase&src=ty... I agree it's not ideal, but if your security relied on a guessable email address staying private, you're already not in a good place.

Because "well someone else does it" has always been the best reason to behave a certain way...

No, and indeed I don't publish whether or not I have a coinbase account. But it isn't a serious security failure if that somehow got out.

Re: Coinbase user emails and full names leaked

#163

Post by eli »

jonknee wrote: post #110
josephwegner wrote: post #99

Earlier quoted context omitted.

If you use gmail, you can use youremail+anything@gmail.com, and it will all get forwarded to youremail@gmail.com. This is incredibly handy for noticing who is sending you spam. I'll also use it for sites that I know are going to send me spam, and then immediately create a filter than deletes emails sent to joe+annoyingsite@gmail.com (note: that's not my real email)

That won't help here, your real Gmail address is exposed which lets everyone know that you have BTC on web wallets.

Actually it would help you here. In this case your real address isn't exposed unless someone guessed the exact version you used to sign up.

Re: Coinbase user emails and full names leaked

#164

Post by genwin »

sillysaurus3 wrote: post #71
nwh wrote: post #69

Earlier quoted context omitted.

So ask them to prove their reserves if it bothers you so. Other large services have in the past.

Proving reserves doesn't help at all. They can die at any time from massive loss. Proof of reserve reveals whether there's a problem; it doesn't prevent any problem from happening. To use a metaphor, a failed proof of reserve is like detecting that someone who's riding a motorcycle without a helmet has been launched into the air due to a car crash, and is about to hit the ground. That doesn't change the fact that the…

> Keep your funds in your own secure cold storage wallet, and you'll have them forever.

In regards to Coinbase, if only because their terms make it clear they aren't liable for a customer loss of any cause whatsoever.

Re: Coinbase user emails and full names leaked

#165

Post by korzun »

jakejake wrote: post #151
korzun wrote: post #76

At this point I would not trust Coinbase, their engineering department shows that they have very little clue when it comes to building a secure infrastructure. Not only they are not rate limiting and leaking names, their implementations are simply laughable. With a proper design, customer should have been allowed to either enable/disable that end-point when somebody is searching for their email, or there should have…

I haven't really lost my trust in Coinbase due to this issue but I do find it annoying the way they are handling it so far. Almost any site that has a password reset can be used to verify whether an email account exists in that system - depending if the system tells you "no user with that username exists" or not. Coinbase is in no way unique with the amount of info they expose, which is the point they were trying to…

I see your point, but keep in mind that Coinbase deals with money.

I don't think many banks (if any) will let you do a password reset based on your email address, they would use your credit card/account number as identifier of some sort not tied in to their authentication system or system that can be hacked (ie: email).

Them comparing a financial service API that deals with money to Google+ or Facebook should tell you as much.

Re: Coinbase user emails and full names leaked

#166

Post by smtddr »

psykovsky wrote: post #88
smtddr wrote: post #55

Earlier quoted context omitted.

https://twitter.com/SMTDDR/status/438404079438422016 Bonus points: That screenshot also tells you I have an account with Patelco Credit Union.

You trust Patelco CU and Coinbase employees a lot... Watch out, it might backfire...

If an employee of either company steals from me, I'd expect them to be easily caught. If Coinbase decides to steal 1k from everyone then shutdown that would be crazy since the people behind Coinbase are very well known and in SF; I accepted that risk when I signed up. If someone inside Patelco decides to steal from me, that's a heavly regulated financial establishment - I don't think that person could get away with it or that Patelco wouldn't reimburse me.

If someone who is not an employee of either company manages to steal funds from me just based on that screenshot then there is some other security-issue somewhere else and it was bound to happen sooner or later.

Probably something like this[1], which I don't really see how you'd protect yourself against. Like getting hit by a car running a red-light.

1. http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking

Re: Coinbase user emails and full names leaked

#167

Post by albedoa »

stonogo wrote: post #123
drags wrote: post #122

Earlier quoted context omitted.

I'm being audited right now (over a $2,500 student loan interest deduction, of all things) and it's totally automated. It seems like they have an internal process that goes "Taxpayer claimed deduction, IRS doesn't have paperwork matching payment activity, ergo send letter asking taxpayer to pony up". If Coinbase is going to report earnings to the IRS, it's a good idea to match what they report or you might trigger th…

What you are describing is not an audit. The automated system is a separate process. An audit involves an actual IRS agent manually reviewing your entire tax history for the given year.

At least at the state level (MA), the automated system is considered an audit. I recently received notice that an "audit" (their word) of my state tax return detected a discrepancy with my federal return. When I called, I was told that it was caught automatically.

So I think the manual and automatic processes are considered to be two forms of the broader term "audit".

Re: Coinbase user emails and full names leaked

#169

Post by genwin »

fudWrecker wrote: post #116
simon_ wrote: post #82

Relatedly: DO NOT CHEAT ON YOUR TAXES. If you have any BTC profits and do not report them to the IRS this month, they are reasonably likely to catch you and make an example of you.

YOU ARE WRONG. The IRS is .1% in the business of audits and 99.9% in the business of scaring people about the possibility of an audit. Like you just did.

The IRS is 100% in the business of noticing when your tax filing doesn't jive with the numbers others reported to them about you. To have low risk of getting caught with unreported Bitcoin gains, you'd need to sell anonymously.

Re: Coinbase user emails and full names leaked

#170

Post by larrys »

stonogo wrote: post #123
drags wrote: post #122

Earlier quoted context omitted.

I'm being audited right now (over a $2,500 student loan interest deduction, of all things) and it's totally automated. It seems like they have an internal process that goes "Taxpayer claimed deduction, IRS doesn't have paperwork matching payment activity, ergo send letter asking taxpayer to pony up". If Coinbase is going to report earnings to the IRS, it's a good idea to match what they report or you might trigger th…

What you are describing is not an audit. The automated system is a separate process. An audit involves an actual IRS agent manually reviewing your entire tax history for the given year.

Read this:

http://www.irs.gov/Businesses/Small-Businesses-&-Self-Employ...

"An audit may be conducted by mail or through an in-person interview and review of the taxpayer's records."

"You will be provided with a written request for specific documents needed."

"An IRS audit is a review/examination of an organization's or individual's accounts and financial information to ensure information is being reported correctly, according to the tax laws, to verify the amount of tax reported is accurate."

Consquently by my interpretation (and actual experience over many years) your last sentence is not correct.

Post reply on HN