Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

11–20 of 294 posts

Re: Coinbase user emails and full names leaked

#11

Post by wes-exp »

jyap wrote: post #5
privong wrote: post #2

The link has no mention of the "bug was dismissed" as stated in the HN title. Support for this? Or is it the same bug as https://news.ycombinator.com/item?id=7504353 ? Also, what is the evidence for the assertion that transaction logs are delivered daily? Given recent revelations, it's probably a reasonable assumption, but there's still no actual evidence given.

Here is the bug closed as "Won't fix" (so yes, it is the same exploit/bug): https://hackerone.com/reports/5200

Apparent Coinbase response there: "This stance is not unusual on the web: you'll find that user enumeration is possible on Facebook, Google, and nearly every other major internet site"

Um, no. If that is what Coinbase believes, I just lost respect for their claims of security.

Re: Coinbase user emails and full names leaked

#12

Post by throwaway812 »

alandarev wrote: post #6

> Coinbase provides your full transaction history to the FBI, FinCEN and IRS every day. They are under a gag order. That is interesting accusation. Even if this is true, we will unlikely have evidence. Is there a serious risk to Coinbase users granted Gov is having full access?

If they had evidence of that, why wouldn't they have pasted it as well? I'm assuming it's baseless speculation.

Btw, has anyone actually confirmed any of these emails / names are real? I have a coinbase account and am not mentioned in the leak.

Re: Coinbase user emails and full names leaked

#13

Post by naterator »

300bps wrote: post #10
tokenizerrr wrote: post #8

I assume someone took a huge list of emails and ran them through the Coinbase API as described in https://hackerone.com/reports/5200 and retrieved their full names, and is now scaremongering. I do not think they are enumerating users from the coinbase database, but who knows. edit: The recent adobe email list comes to mind.

You're right. As a Coinbase customer, neither my name or Coinbase-only email address was in this list. What you describe is exactly the exploit that was disclosed and exactly what the person exploiting it seems to have done based on the content of the list. Of course, Coinbase argues that this is a feature and not a bug.

> neither my name or Coinbase-only email address was in this list

That doesn't really mean anything, since it clearly says at the top:

"Here is a partial list of Coinbase user emails and their full names. Full list much bigger."

Which could be bullshit and scaremongering. But it certainly could be true that they have a large number of Coinbase user's emails.

Re: Coinbase user emails and full names leaked

#14

Post by dignati »

300bps wrote: post #10
tokenizerrr wrote: post #8

I assume someone took a huge list of emails and ran them through the Coinbase API as described in https://hackerone.com/reports/5200 and retrieved their full names, and is now scaremongering. I do not think they are enumerating users from the coinbase database, but who knows. edit: The recent adobe email list comes to mind.

You're right. As a Coinbase customer, neither my name or Coinbase-only email address was in this list. What you describe is exactly the exploit that was disclosed and exactly what the person exploiting it seems to have done based on the content of the list. Of course, Coinbase argues that this is a feature and not a bug.

The author already claims that this is only a partial list and that he didn't disclose everything he has access to.

Re: Coinbase user emails and full names leaked

#15

Post by [deleted] »

ryanthejuggler wrote: post #9

I'm pissed. My email address is among those leaked. I got two transaction requests, the first for 732342.34425 BTC and the second for 999999.99999999 BTC. The second had registered a username of "⚠ URGENT: Сoinbase hacked. We" so that the email subject line read "⚠ URGENT: Сoinbase hacked. We sent you a payment request." I got my coin out of Inputs.io just a few days before they got hacked, and I've got a low balance…

[deleted]

Re: Coinbase user emails and full names leaked

#16

Post by smtddr »

wes-exp wrote: post #11
jyap wrote: post #5

Earlier quoted context omitted.

Here is the bug closed as "Won't fix" (so yes, it is the same exploit/bug): https://hackerone.com/reports/5200

Apparent Coinbase response there: "This stance is not unusual on the web: you'll find that user enumeration is possible on Facebook, Google, and nearly every other major internet site" Um, no. If that is what Coinbase believes, I just lost respect for their claims of security.

FWIW, https://plus.google.com/people/find

You can find people's G+ profile if you guess the email correctly. I wouldn't be surprised if LinkedIn,Facebook,etc. had the same type of thing. I do think that coinbase-API should be rate-limited or unreplayable, but I'm _much more_ interested in where the email-list input data came from. My email wasn't in this alleged partial list, but if it was I'd like to know where they got my email from to begin with because the source of that email-list is the real problem IMHO.

I will say this though: Coinbase, please make sure there is absolutely no api call that returns banking/CC info!

Re: Coinbase user emails and full names leaked

#17

Post by SDGT »

wes-exp wrote: post #11
jyap wrote: post #5

Earlier quoted context omitted.

Here is the bug closed as "Won't fix" (so yes, it is the same exploit/bug): https://hackerone.com/reports/5200

Apparent Coinbase response there: "This stance is not unusual on the web: you'll find that user enumeration is possible on Facebook, Google, and nearly every other major internet site" Um, no. If that is what Coinbase believes, I just lost respect for their claims of security.

Would you care explaining why it is that you believe email enumeration to be "insecure"?

The data obtained is an email address and a name (only if the user filled in the "name" field). This may as well be treated as public information.

Re: Coinbase user emails and full names leaked

#18

Post by nly »

ryanthejuggler wrote: post #9

I'm pissed. My email address is among those leaked. I got two transaction requests, the first for 732342.34425 BTC and the second for 999999.99999999 BTC. The second had registered a username of "⚠ URGENT: Сoinbase hacked. We" so that the email subject line read "⚠ URGENT: Сoinbase hacked. We sent you a payment request." I got my coin out of Inputs.io just a few days before they got hacked, and I've got a low balance…

You've just become a target. Everyone now knows everyone on that list has Bitcoin and use web wallets, so it's effectively a list of potentially profitable targets for email account compromise.

Please ensure you're using random passwords on every site you use, select the best available security questions, use a password manager, and enable two factor authentication everywhere that allows it.

Also move all your coins in to offline wallets. No online web wallets have a bank grade reputation.

Re: Coinbase user emails and full names leaked

#19

Post by SDGT »

smtddr wrote: post #16
wes-exp wrote: post #11

Earlier quoted context omitted.

Apparent Coinbase response there: "This stance is not unusual on the web: you'll find that user enumeration is possible on Facebook, Google, and nearly every other major internet site" Um, no. If that is what Coinbase believes, I just lost respect for their claims of security.

FWIW, https://plus.google.com/people/find You can find people's G+ profile if you guess the email correctly. I wouldn't be surprised if LinkedIn,Facebook,etc. had the same type of thing. I do think that coinbase-API should be rate-limited or unreplayable, but I'm _much more_ interested in where the email-list input data came from. My email wasn't in this alleged partial list, but if it was I'd like to know where they…

You can just type emails into the gmail account creation form to get results back on if the username was taken.

This whole debacle is making a mountain out of a molehill.

Post reply on HN