Coinbase user emails and full names leaked • Hacker News Board

Re: Coinbase user emails and full names leaked

#271

Post by kbenson » Wed, Apr 02, 2014, 1:39 AM UTC

hkphooey wrote: post #265

kbenson wrote: post #264

Earlier quoted context omitted.

The possibility of this being misinterpreted as valid is rather high. I think your point could have been made well with a single explaining sentence up front and without the name substitution in the actual content.

These guys stuck the knife into MtGox... when they themselves are no better. Check the forums over at BitcoinTalk, for months now, people using Kraken have been unable to withdraw their money, and deposits have been going 'missing'. The fact that support is conducted over a public forum, out of sheer desperation on the customers part, tells you something. If CoinBase did go down, would you bet against the other provi…

What does that have to do with what I said? I think the manner in which you made your point has too high a chance of being misinterpreted to be acceptable here, which is probably why it was being downvoted.

Re: Coinbase user emails and full names leaked

#272

Post by unreal37 » Wed, Apr 02, 2014, 2:01 AM UTC

goatforce5 wrote: post #217

beaner wrote: post #105

Earlier quoted context omitted.

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

I work on dating sites, some of them a bit risqué. On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".

How do you handle users attempting to register a new account with an email address that already exists?

If you say, "we don't allow two accounts with the same email address", you have the same issue as coinbase.

Re: Coinbase user emails and full names leaked

#273

Post by oafitupa » Wed, Apr 02, 2014, 2:47 AM UTC

bduerst wrote: post #244

sillysaurus3 wrote: post #134

Earlier quoted context omitted.

I've spent a couple months trying to come up with ways to protect bitcoin consumers, and the only thing I can think of is for exchanges to purchase some kind of high-risk insurance which will cover losses by the exchange. Nothing else will protect users, as far as I can tell, precisely because of bitcoin's irreversible transactions. Honestly, the best thing for the bitcoin ecosystem is to learn from Paypal and Visa,…

Well, you could create a certification program in which member exchanges agree to a set of financial standards between each other - e.g. they would automatically do charge backs on disputes within the system. This could lower the transactional-risk cost between doing business with certified exchanges, and still allow users to do business outside but with the increased transactional costs. But then again you're just b…

All of you guys seem not to be aware of the things you can do with Bitcoin. Eg: multi-signature wallets.

You won't need insurance when the coins simply can't be stolen.

Re: Coinbase user emails and full names leaked

#274

Post by kgreenek » Wed, Apr 02, 2014, 2:58 AM UTC

Yawn

Re: Coinbase user emails and full names leaked

#275

Post by mikeash » Wed, Apr 02, 2014, 3:02 AM UTC

larrys wrote: post #256

saalweachter wrote: post #236

Earlier quoted context omitted.

I'd imagine a letter in the mail asking for some paperwork is pretty terrifying if you have been cheating on your taxes. :)

I think it's actually something that will raise your anxiety level even if you are "pretty honest". Also there are some borderline issues with taxes (and/or self employment or small corp) that can give you problems.[1] (One for example is deducting for a home office, another might be charitable deductions, another might be writing off some auto usage). Think in terms of what happens when you see the flashing lights o…

I should have phrased that better. You're right, it is a bit frightening. But not on the same level as what we would think of as a real audit (I imagine, haven't had one).

Re: Coinbase user emails and full names leaked

#276

Post by voltagex_ » Wed, Apr 02, 2014, 3:53 AM UTC

oafitupa wrote: post #273

bduerst wrote: post #244

Earlier quoted context omitted.

Well, you could create a certification program in which member exchanges agree to a set of financial standards between each other - e.g. they would automatically do charge backs on disputes within the system. This could lower the transactional-risk cost between doing business with certified exchanges, and still allow users to do business outside but with the increased transactional costs. But then again you're just b…

All of you guys seem not to be aware of the things you can do with Bitcoin. Eg: multi-signature wallets. You won't need insurance when the coins simply can't be stolen.

Some Googling only brings up names of exchanges that are working on multi signature wallets. Do you have a link to how to set it up on your own machine?

Re: Coinbase user emails and full names leaked

#277

Post by sillysaurus3 » Wed, Apr 02, 2014, 4:41 AM UTC

oafitupa wrote: post #273

bduerst wrote: post #244

Earlier quoted context omitted.

Well, you could create a certification program in which member exchanges agree to a set of financial standards between each other - e.g. they would automatically do charge backs on disputes within the system. This could lower the transactional-risk cost between doing business with certified exchanges, and still allow users to do business outside but with the increased transactional costs. But then again you're just b…

All of you guys seem not to be aware of the things you can do with Bitcoin. Eg: multi-signature wallets. You won't need insurance when the coins simply can't be stolen.

I am aware of multisig, but multisig precludes realtime trading, which is usually the main point of an exchange.

It'd be a good idea for Coinbase to implement, though.

Re: Coinbase user emails and full names leaked

#278

Post by throwaway812 » Wed, Apr 02, 2014, 4:46 AM UTC

kevingadd wrote: post #23

throwaway812 wrote: post #12

Earlier quoted context omitted.

If they had evidence of that, why wouldn't they have pasted it as well? I'm assuming it's baseless speculation. Btw, has anyone actually confirmed any of these emails / names are real? I have a coinbase account and am not mentioned in the leak.

Wouldn't any evidence supporting the existence of the gag order be a violation of the gag order?

Presumably the person dumping names and emails (PII/PID) on pastebin has little regard for gag orders. (And no motivation not to reveal such an order, if proof were readily available.)

Re: Coinbase user emails and full names leaked

#279

Post by hkphooey » Wed, Apr 02, 2014, 5:16 AM UTC

kbenson wrote: post #271

hkphooey wrote: post #265

Earlier quoted context omitted.

These guys stuck the knife into MtGox... when they themselves are no better. Check the forums over at BitcoinTalk, for months now, people using Kraken have been unable to withdraw their money, and deposits have been going 'missing'. The fact that support is conducted over a public forum, out of sheer desperation on the customers part, tells you something. If CoinBase did go down, would you bet against the other provi…

What does that have to do with what I said? I think the manner in which you made your point has too high a chance of being misinterpreted to be acceptable here, which is probably why it was being downvoted.

I get your point, yet somebody misinterpreting a joke should have no impact on the company...

Unless the company actually had inadequate reserves to meet customer withdrawals, thus leaving the solvency of the company at risk of a good old-fashioned fractional reserve style bank-run...

Re: Coinbase user emails and full names leaked

#280

Post by matiasb » Wed, Apr 02, 2014, 7:28 AM UTC

trollfighter wrote: post #225

chazandchaz wrote: post #213

Earlier quoted context omitted.

"You’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site." I love this. Look these silly free social sites do it, so it must be ok. Anyone know if BofA or WellsFargo allow user enumeration?

BofA and Wells Fargo suffer from account number enumeration. Wells Fargo has 10-11 digit (depending on if it's WF or previously Wachovia) account numbers. One portion defines the bank branch where the account was opened, another portion defines the account type, and the last digit is a check digit. You can guess at an account number by attempting a deposit (in person or online). There's also the fact that BofA and We…

Two months ago I was able to enumerate all accounts from a local bank (Paraguay), they used document number and numeric passwords for login. They were showing different error messages when you tried to login with a nonexistent ID.

So I started generating random numbers between common document number ranges (1000000-4000000).

Our public health system has a web app that lets you check your enrollment status by entering an document #, and there are no CAPTCHAs! So the attack was like this: generate a random document number, send a request to the public health app and get the target's info (name, date of enrollment and other info). The most interesting thing was that I tried to login into all accounts by using the birth date of the target as a password (the bank's password policy: just numbers, a min. of 6 numbers...). Around 40% of the clients were vulnerable.