Update on Coinbase Data Security
blog.coinbase.com
Update on Coinbase Data Security
1–10 of 135 posts
Re: Update on Coinbase Data Security
#2Less sympathetic than I was hoping for but copacetic. Could they have nipped this in the bud with a faster response? Perhaps. However having dealt with reports like this, I cannot recall a decent interaction with a reporter.
Re: Update on Coinbase Data Security
#3Rate limiting
Do we have to spell it out to them?
Re: Update on Coinbase Data Security
#4Rate limiting Do we have to spell it out to them?
From the text:
"For example, we employ rate limits around sensitive actions, such as requesting money, to prevent them from being abused at scale."
Re: Update on Coinbase Data Security
#5Rate limiting Do we have to spell it out to them?
Up this comment goes! Why are they not addressing it? I'm confused.
Re: Update on Coinbase Data Security
#6Less sympathetic than I was hoping for but copacetic. Could they have nipped this in the bud with a faster response? Perhaps. However having dealt with reports like this, I cannot recall a decent interaction with a reporter.
copacetic : in excellent order.
(For the lazy like me, who still want to learn new and useful words.)
Re: Update on Coinbase Data Security
#7Rate limiting Do we have to spell it out to them?
From the text: "For example, we employ rate limits around sensitive actions, such as requesting money, to prevent them from being abused at scale."
They don't appear to be rate limiting their API that allows enumeration of first and last names. Also,
We’d also like to address the claim of a “leaked” list of Coinbase emails and user names. This list (the size of which is less than one half of one percent of Coinbase users) was not the result of a data breach at Coinbase.
There are 2,040 names on the leaked list. Fun fact: that means there are about 408,000 Coinbase users total.
Re: Update on Coinbase Data Security
#8Rate limiting Do we have to spell it out to them?
We are pushing some changes to rate limiting - this wasn't clear in the original post and I just edited. Thanks for the heads up.
Re: Update on Coinbase Data Security
#9No mention of the claimed IRS / Fed gag order, interesting. (although I realize its not their main focus right now)
Re: Update on Coinbase Data Security
#10I'm curious why, given the prior reports of security issues at Coinbase and the ongoing drama with Mt Gox, you guys didn't immediately hire, say, tptacek's company to do extensive penetration testing and a full security audit. It appears that not all API calls were rate-limited, as they probably should have been, and there certainly doesn't seem to be any sort of monitoring of brute-force attempts like this in place. With all the negative publicity around Bitcoin exchanges, you should have doubled down on security weeks ago, or at least explained the privacy tradeoffs in your design decisions clearly.