Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

171–180 of 294 posts

Re: Coinbase user emails and full names leaked

#171

Post by dualogy »

doesnt_know wrote: post #127
nwh wrote: post #43

Earlier quoted context omitted.

That's not convenient. Coinbase is convenient. You're suggesting a ride on lawnmower as a substitute to a car. As a spending wallet Coinbase is fairly close to ideal. Please read my post carefully next time.

Ah yes convenience, clearly the most important factor when choosing where to store your currency.

If crypto ever wants to win over fiat among the "masses", then yes, it clearly is. Because most people don't care about scary-sounding fluff pieces about the "Fed's fractional reserve ponzi" etc.

Re: Coinbase user emails and full names leaked

#172

Post by dang »

jellicle wrote: post #35
nwh wrote: post #32

Earlier quoted context omitted.

Hot/cold storage as coinbase is using is probably better than any encryption. Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Manual processing of this means there is some sanity checking on large withdrawals too. Encryption affords you none of that, I would be happier with coinbase than storing on any other online wallet for this very reason.

> Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Were you born yesterday? The steal-all-your-money rate of bitcoin businesses is running right around 100%, and you're going to lecture people that "they can only ever lose a small portion of all stored user funds"? Really?

Please don't make personally aggressive remarks like "Were you born yesterday?" on Hacker News. It only adds negativity, not information. That breaks our two most important principles: optimizing for signal/noise ratio, and being civil.

Re: Coinbase user emails and full names leaked

#173

Post by genwin »

ambrop7 wrote: post #139
seanieb wrote: post #45

This is not a "leak". All of these email addresses were already in the wild. The "attacker" simply tested if Coinbase accounts matched these emails. Think about it. Email enumeration is possible if accounts associated with an email address. Otherwise forgot password forms would simply say successful even if someone typo'd their address (terrible UI) or the signup forms would allow multiple accounts with the same emai…

Actually, many password forget forms do not provide any information about whether the email was recognized or not. More than once I've seen a message along the lines if "If the email entered was associated with an account, a password reset has been sent.". EDIT: On the other hand even if the response is always the same, I expect most implementations to be vulnerable to a timing attack ;)

How would they be vulnerable to a timing attack?

Re: Coinbase user emails and full names leaked

#174

Post by loumf »

djf1 wrote: post #157
beaner wrote: post #105

Earlier quoted context omitted.

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

It gives the full name associated with an email address. A more dramatic but analogous situation would be if an attacker were able to attain password info or credit card info associated with an email address. Just because email address is known does not imply that other personal information should be given away.

Does it leak the fact that you have a coinbase account? That seems private as well.

Re: Coinbase user emails and full names leaked

#175

Post by jlgaddis »

flanbiscuit wrote: post #48
gommm wrote: post #44

And this is why in addition to per site passwords, I also use per site email addresses. I like to be able to track who spams me and in case of leaks I like the ability to disable an email address...

how do you keep track of all the emails? and did you always do this or did you start at one point having to go back through a lot of old accounts to change emails and passwords?

My mail is hosted on servers running Postfix that I control, so this won't work for everybody.

In main.cf:

  virtual_alias_maps = hash:/etc/postfix/db/virtual_aliases
This file is in the same standard aliases(5) file format:

  zzz-foo@example.com          my@real-account.com
I started doing this when I moved all of my mail off of Google. It has the advantage (over you+foo@gmail.com) that it doesn't reveal my real mailbox. It does very quickly reveal who shares/sells my e-mail address, though. When that happens, it's simply a matter of deleting the alias from the file.

Re: Coinbase user emails and full names leaked

#176

Post by thetrb »

josephwegner wrote: post #99
flanbiscuit wrote: post #48

Earlier quoted context omitted.

how do you keep track of all the emails? and did you always do this or did you start at one point having to go back through a lot of old accounts to change emails and passwords?

If you use gmail, you can use youremail+anything@gmail.com, and it will all get forwarded to youremail@gmail.com. This is incredibly handy for noticing who is sending you spam. I'll also use it for sites that I know are going to send me spam, and then immediately create a filter than deletes emails sent to joe+annoyingsite@gmail.com (note: that's not my real email)

In general spammers deal with those things pretty quickly. They can just quickly add a regex to remove everything starting with the "+" and then you don't have any unique identifier any more.

Re: Coinbase user emails and full names leaked

#177

Post by ambrop7 »

genwin wrote: post #173
ambrop7 wrote: post #139

Earlier quoted context omitted.

Actually, many password forget forms do not provide any information about whether the email was recognized or not. More than once I've seen a message along the lines if "If the email entered was associated with an account, a password reset has been sent.". EDIT: On the other hand even if the response is always the same, I expect most implementations to be vulnerable to a timing attack ;)

How would they be vulnerable to a timing attack?

Sending an email takes more time than not sending an email.

Re: Coinbase user emails and full names leaked

#178

Post by wlesieutre »

doesnt_know wrote: post #127
nwh wrote: post #43

Earlier quoted context omitted.

That's not convenient. Coinbase is convenient. You're suggesting a ride on lawnmower as a substitute to a car. As a spending wallet Coinbase is fairly close to ideal. Please read my post carefully next time.

Ah yes convenience, clearly the most important factor when choosing where to store your currency.

I keep my savings in cash under my mattress. Sure, banks are more secure, but they have annoying hours and having the money easily accessible is much more convenient.

Besides, I trust my mattress. It's a nice mattress made by a great VC backed mattress company. It's not like I'm putting my money under some mattress that I bought on craigslist.

Re: Coinbase user emails and full names leaked

#179

Post by ttty »

jonknee wrote: post #110
josephwegner wrote: post #99

Earlier quoted context omitted.

If you use gmail, you can use youremail+anything@gmail.com, and it will all get forwarded to youremail@gmail.com. This is incredibly handy for noticing who is sending you spam. I'll also use it for sites that I know are going to send me spam, and then immediately create a filter than deletes emails sent to joe+annoyingsite@gmail.com (note: that's not my real email)

That won't help here, your real Gmail address is exposed which lets everyone know that you have BTC on web wallets.

If you do a filter like this: All mail that arrives to john.s.m.i.t.h@gmail.com is important. Everything else is spam. Of course you might not get emails from people who sends emails to john.smith@gmail.com nor johnsmith@gmail.com because the emails go to spam.
Post reply on HN