Coinbase user emails and full names leaked • Hacker News Board

Re: Coinbase user emails and full names leaked

#211

Post by mpyne » Tue, Apr 01, 2014, 6:52 PM UTC

bduerst wrote: post #130

sillysaurus3 wrote: post #89

Earlier quoted context omitted.

Same. It seems like it can't happen until it happens, and then you face the reality that it happened. It sucks, and there's absolutely no protection for consumers from it. There's not even any insurance policy that exchanges can purchase yet, which is pretty much the only hope at this point.

Wouldn't that add a transactional cost to bitcoin, not unlike PayPal or Visa?

Yes, of course. And since transactions are completely irreversible on Bitcoin the insurance rate would have to be higher than otherwise, as there's no collateral for the insurance company to claim when they do payout.

Re: Coinbase user emails and full names leaked

#212

Post by tptacek » Tue, Apr 01, 2014, 6:56 PM UTC

mpyne wrote: post #209

beaner wrote: post #105

Earlier quoted context omitted.

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

It does confirm email addresses you can guess though (which are not necessarily email addresses you have , until they're confirmed), along with leaking other information about that user.

What other information is it leaking?

Re: Coinbase user emails and full names leaked

#213

Post by chazandchaz » Tue, Apr 01, 2014, 6:57 PM UTC

FredEE wrote: post #206

NathanKP wrote: post #64

Does anyone know where or if the full list can be found? I have a Coinbase account but I don't see my name on the abbreviated list. I suspect that the person who made this Pastebin just ran a huge list of known leaked emails, or dictionary based emails through the minor information leakage vulnerability discussed yesterday ( https://hackerone.com/reports/5200 ). I would be willing to bet that this brief list is actua…

Update - blog post here: http://blog.coinbase.com/post/81407694500/update-on-coinbase...

"You’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site."

I love this. Look these silly free social sites do it, so it must be ok. Anyone know if BofA or WellsFargo allow user enumeration?

Re: Coinbase user emails and full names leaked

#214

Post by Ensorceled » Tue, Apr 01, 2014, 6:58 PM UTC

dangrossman wrote: post #63

SDGT wrote: post #19

Earlier quoted context omitted.

You can just type emails into the gmail account creation form to get results back on if the username was taken. This whole debacle is making a mountain out of a molehill.

SMTP's the API for checking if an address exists at any mail provider. Start sending a mail, if the server doesn't tell you there's no such mailbox right then, you can abandon the connection without sending a message through. No CAPTCHAs there either.

Many mail relays, especially spam appliances like Barracuda, will always give an 250 OK to the email address provided to prevent exactly this trick. They then toss as spam or bounce once they get the message.

Re: Coinbase user emails and full names leaked

#215

Post by mpyne » Tue, Apr 01, 2014, 6:59 PM UTC

genwin wrote: post #192

eli wrote: post #162

Earlier quoted context omitted.

No, and indeed I don't publish whether or not I have a coinbase account. But it isn't a serious security failure if that somehow got out.

Except for the non-zero possibility it could make the difference between you being murdered during a home invasion, or not.

Last time a politician was worried about non-zero probabilities, the U.S. invaded Iraq. I mean, if changing the probability someone's home gets broken into is our standard of practice nowadays there's a lot of companies which will have to close down today.

Re: Coinbase user emails and full names leaked

#216

Post by genwin » Tue, Apr 01, 2014, 7:01 PM UTC

MichaelGG wrote: post #199

genwin wrote: post #182

Earlier quoted context omitted.

I think I see your point; clever. The site could show the message and only then send the mail asynchronously. I guess that's why you said most implementations.

Queuing up an async message still takes time. As does reading a row from a database and materializing an object. So "most" is really probably nearly all unless they take explicit steps to make sure the same amount of work is performed in either case.

Yes, or sleep to elapse a time that's longer than needed to queue up the async message, say half a second, before returning the message to the browser.

Re: Coinbase user emails and full names leaked

#217

Post by goatforce5 » Tue, Apr 01, 2014, 7:01 PM UTC

beaner wrote: post #105

NathanKP wrote: post #64

Does anyone know where or if the full list can be found? I have a Coinbase account but I don't see my name on the abbreviated list. I suspect that the person who made this Pastebin just ran a huge list of known leaked emails, or dictionary based emails through the minor information leakage vulnerability discussed yesterday ( https://hackerone.com/reports/5200 ). I would be willing to bet that this brief list is actua…

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

I work on dating sites, some of them a bit risqué.

On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".

Re: Coinbase user emails and full names leaked

#218

Post by mag00 » Tue, Apr 01, 2014, 7:02 PM UTC

sillysaurus3 wrote: post #144

FredEE wrote: post #137

Earlier quoted context omitted.

Fred from Coinbase here. There is no full list, and there is no leak. We're drafting a more formal response now.

Would you include in your response the reason why you're ignoring Homakov's security flaw reports, which were emailed to you at your whitehat@coinbase.com email address? https://news.ycombinator.com/item?id=7505757 A lot of people are getting nervous that you're not taking security seriously at Coinbase. Ignoring whitehat reports would seem to be a serious issue.

Hi, Ryan here - We've moved over to hackerone.com/coinbase, and emailed everyone at the whitehat@ address about the transition. We'll be getting in touch for the details and will get an autoresponder up on whitehat@. We don't view missed reports as a good thing, we'll do better and have already made improvements.

Re: Coinbase user emails and full names leaked

#219

Post by foobar5482 » Tue, Apr 01, 2014, 7:05 PM UTC

jakejake wrote: post #151

korzun wrote: post #76

At this point I would not trust Coinbase, their engineering department shows that they have very little clue when it comes to building a secure infrastructure. Not only they are not rate limiting and leaking names, their implementations are simply laughable. With a proper design, customer should have been allowed to either enable/disable that end-point when somebody is searching for their email, or there should have…

I haven't really lost my trust in Coinbase due to this issue but I do find it annoying the way they are handling it so far. Almost any site that has a password reset can be used to verify whether an email account exists in that system - depending if the system tells you "no user with that username exists" or not. Coinbase is in no way unique with the amount of info they expose, which is the point they were trying to…

It is certainly possible to allow for password resets and account creation as well without revealing whether an account exists.

Password reset:

1. User enters email in password reset form.

2. Website shows the same message whether the password was reset or not.

3. Email is what differs. If the account exists, send a password reset link. If it does not, send an email asking them if they want to create an account (and offer an unsubscribe link so people can't spam signup emails).

Signup:

1. User enters email in signup form.

2. Website states it is sending an email to verify the account.

3. If it already exists, send a message saying they already have an account. If not, send the normal email verification link and then they can complete filling in their account details.

This prevent someone without access to the email from finding that the account exists, and also keeps the owner of the email filled in if they just forgot which email they used for the account or that they already had an account.

Re: Coinbase user emails and full names leaked

#220

Post by fcp » Tue, Apr 01, 2014, 7:09 PM UTC

onewaystreet wrote: post #207

loumf wrote: post #174

Earlier quoted context omitted.

Does it leak the fact that you have a coinbase account? That seems private as well.

If someone has your email address it is impossible for coinbase or any service to stop that person from checking if you have an account. All they have to do it try registering a new account with your address and see if it lets them (as most services don't allow multiple accounts to use the same email address).

It doesn't need to be impossible. The problem could be designed away: on form submission send an email saying 'looks like you already have an account' or 'welcome... next steps' and just show a 'check your email' message in the browser.