Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

191–200 of 294 posts

Re: Coinbase user emails and full names leaked

#191

Post by sillysaurus3 »

boling11 wrote: post #186
sillysaurus3 wrote: post #89

Earlier quoted context omitted.

Same. It seems like it can't happen until it happens, and then you face the reality that it happened. It sucks, and there's absolutely no protection for consumers from it. There's not even any insurance policy that exchanges can purchase yet, which is pretty much the only hope at this point.

xapo.com is insured by Meridian group. There's also one in the UK that's insured Lloyd's that I'm drawing a blank on. Have you looked into either of them?

This is the first I've heard that any insurance company is willing to fully insure any bitcoin exchange, and it's wonderful news. Thank you so much for pointing it out! I'll look into it and see whether it's as good as it sounds.

Re: Coinbase user emails and full names leaked

#192

Post by genwin »

eli wrote: post #162
dspillett wrote: post #124

Earlier quoted context omitted.

Because "well someone else does it" has always been the best reason to behave a certain way...

No, and indeed I don't publish whether or not I have a coinbase account. But it isn't a serious security failure if that somehow got out.

Except for the non-zero possibility it could make the difference between you being murdered during a home invasion, or not.

Re: Coinbase user emails and full names leaked

#193

Post by mikeash »

larrys wrote: post #170
stonogo wrote: post #123

Earlier quoted context omitted.

What you are describing is not an audit. The automated system is a separate process. An audit involves an actual IRS agent manually reviewing your entire tax history for the given year.

Read this: http://www.irs.gov/Businesses/Small-Businesses-&-Self-Employ... "An audit may be conducted by mail or through an in-person interview and review of the taxpayer's records." "You will be provided with a written request for specific documents needed." "An IRS audit is a review/examination of an organization's or individual's accounts and financial information to ensure information is being reported correctly,…

Could we just say that it's not what people usually think of when they say "IRS audit"? Getting a letter in the mail asking for some paperwork isn't really scary.

Re: Coinbase user emails and full names leaked

#194

Post by eli »

jonknee wrote: post #189
eli wrote: post #163

Earlier quoted context omitted.

Actually it would help you here. In this case your real address isn't exposed unless someone guessed the exact version you used to sign up.

What do you mean? If joeblow+coinbase@gmail.com is in the leaked list you know that that joeblow@gmail.com is the "real" user and also is someone who has BTC.

There was no leak. The API allowed you to see whether a given email had an account associated, so someone churned through a big list of known email addresses to find accounts.

Re: Coinbase user emails and full names leaked

#195

Post by bushido »

beaner wrote: post #105
NathanKP wrote: post #64

Does anyone know where or if the full list can be found? I have a Coinbase account but I don't see my name on the abbreviated list. I suspect that the person who made this Pastebin just ran a huge list of known leaked emails, or dictionary based emails through the minor information leakage vulnerability discussed yesterday ( https://hackerone.com/reports/5200 ). I would be willing to bet that this brief list is actua…

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

Since Coinbase is a financial-esque firm that deals with and stores peoples money/BTC it is not at all alright for this to be treated as public information, even if someone already had the email address.

I know CB is not a financial company and they are not obligated to provide the same protections to consumers/customers.

Phishing is not the only reason why a customer would not like their bank to confirm that they have an account.

As a matter of fact in this situation, when someone sends a fund request, CB should never let the requesting party know the name of the account holder, unless the account holder explicitly gives them permission, maybe not even then.

With any other organization law enforcement would require a warrant to get basic confirmation if a customer has an account and the name on the account.

Re: Coinbase user emails and full names leaked

#197

Post by rasz_pl »

FredEE wrote: post #137
NathanKP wrote: post #64

Does anyone know where or if the full list can be found? I have a Coinbase account but I don't see my name on the abbreviated list. I suspect that the person who made this Pastebin just ran a huge list of known leaked emails, or dictionary based emails through the minor information leakage vulnerability discussed yesterday ( https://hackerone.com/reports/5200 ). I would be willing to bet that this brief list is actua…

Fred from Coinbase here. There is no full list, and there is no leak. We're drafting a more formal response now.

Didnt you run Iraqi ministry of information back in the day?

Re: Coinbase user emails and full names leaked

#198

Post by MichaelGG »

jeremymcanally wrote: post #26
SDGT wrote: post #17

Earlier quoted context omitted.

Would you care explaining why it is that you believe email enumeration to be "insecure"? The data obtained is an email address and a name (only if the user filled in the "name" field). This may as well be treated as public information.

Do you publish that you have a Coinbase account? That's the issue. Now these people are valuable targets for spear phishing and other attacks on their e-mail accounts because it's known that they have hot access to at least some amount of Bitcoin. Without that information, an attacker is shooting blind. So, this sort of leak or enumeration basically reduces the (though tenuous) degree of security afforded by one's pr…

The name is an optional field, so no one is being forced here. If you don't fill out your name, this oh-so-clever "hack" doesn't work.

Re: Coinbase user emails and full names leaked

#199

Post by MichaelGG »

genwin wrote: post #182
ambrop7 wrote: post #177

Earlier quoted context omitted.

Sending an email takes more time than not sending an email.

I think I see your point; clever. The site could show the message and only then send the mail asynchronously. I guess that's why you said most implementations.

Queuing up an async message still takes time. As does reading a row from a database and materializing an object. So "most" is really probably nearly all unless they take explicit steps to make sure the same amount of work is performed in either case.
Post reply on HN