Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

111–120 of 294 posts

Re: Coinbase user emails and full names leaked

#111

Post by nawitus »

peterwwillis wrote: post #100

Why the fuck would someone keep cash in a central repository if the whole purpose of bitcoin is to be de-centralized? It's like, hey, I have a car so I can get around town any time I want, so let me park it with a bunch of other cars in a dark open lot 2 miles from my house. Sure, I have to take a short bus ride to get to it, and it could be stolen or broken into at any time, but that's the price I pay for convenienc…

>Why the fuck would someone keep cash in a central repository if the whole purpose of bitcoin is to be de-centralized?

Decentralization means the freedom to partially centralize.

>There are no armed guards or vaults and there is no federal insurance for your bitcoin.

You can pay for private insurance, which can cover more money than federal insurances (albeit it's not free). Just like it should be.

Re: Coinbase user emails and full names leaked

#112

Post by yukichan »

NathanKP wrote: post #64

Does anyone know where or if the full list can be found? I have a Coinbase account but I don't see my name on the abbreviated list. I suspect that the person who made this Pastebin just ran a huge list of known leaked emails, or dictionary based emails through the minor information leakage vulnerability discussed yesterday ( https://hackerone.com/reports/5200 ). I would be willing to bet that this brief list is actua…

I just noticed that the hackerone report curl bit includes a coinbase session cookie. Doesn't seem like a good thing to include.

Re: Coinbase user emails and full names leaked

#113

Post by jonknee »

SDGT wrote: post #17
wes-exp wrote: post #11

Earlier quoted context omitted.

Apparent Coinbase response there: "This stance is not unusual on the web: you'll find that user enumeration is possible on Facebook, Google, and nearly every other major internet site" Um, no. If that is what Coinbase believes, I just lost respect for their claims of security.

Would you care explaining why it is that you believe email enumeration to be "insecure"? The data obtained is an email address and a name (only if the user filled in the "name" field). This may as well be treated as public information.

Weev is doing 41 months in Federal prison for the exact same type of "public information".

http://www.theverge.com/2013/3/18/4118484/andrew-weev-auernh...

Re: Coinbase user emails and full names leaked

#114

Post by Uehreka »

josephwegner wrote: post #99
flanbiscuit wrote: post #48

Earlier quoted context omitted.

how do you keep track of all the emails? and did you always do this or did you start at one point having to go back through a lot of old accounts to change emails and passwords?

If you use gmail, you can use youremail+anything@gmail.com, and it will all get forwarded to youremail@gmail.com. This is incredibly handy for noticing who is sending you spam. I'll also use it for sites that I know are going to send me spam, and then immediately create a filter than deletes emails sent to joe+annoyingsite@gmail.com (note: that's not my real email)

I'm kind of surprised that this still works. I would guess that diligent spammers will soon catch on and start stripping anything that comes after the + sign.

Re: Coinbase user emails and full names leaked

#115

Post by aggronn »

peterwwillis wrote: post #100

Why the fuck would someone keep cash in a central repository if the whole purpose of bitcoin is to be de-centralized? It's like, hey, I have a car so I can get around town any time I want, so let me park it with a bunch of other cars in a dark open lot 2 miles from my house. Sure, I have to take a short bus ride to get to it, and it could be stolen or broken into at any time, but that's the price I pay for convenienc…

Isn't this a bit of a mischaracterization?

Coinbase is more like an AC'd storage facility with locks on the doors and people on staff checking IDs than an a "dark open lot 2 miles from my house". Yeah, its not Fort Knox, or even a basic bank vault, but if I think I'm much more likely to lose a thumb drive or have my computer stolen than suffer a catastrophic problem with a storage facility owned by reputable people, how does it not make sense?

That said, I'd probably be thinking about this a lot harder if I had any serious money put away in bitcoin. A storage facility is not an appropriate place to store 5 tons of gold.

Re: Coinbase user emails and full names leaked

#116

Post by fudWrecker »

simon_ wrote: post #82

Relatedly: DO NOT CHEAT ON YOUR TAXES. If you have any BTC profits and do not report them to the IRS this month, they are reasonably likely to catch you and make an example of you.

YOU ARE WRONG. The IRS is .1% in the business of audits and 99.9% in the business of scaring people about the possibility of an audit. Like you just did.

Re: Coinbase user emails and full names leaked

#118

Post by sillysaurus3 »

fudWrecker wrote: post #116
simon_ wrote: post #82

Relatedly: DO NOT CHEAT ON YOUR TAXES. If you have any BTC profits and do not report them to the IRS this month, they are reasonably likely to catch you and make an example of you.

YOU ARE WRONG. The IRS is .1% in the business of audits and 99.9% in the business of scaring people about the possibility of an audit. Like you just did.

That would be 1 in 1,000 people. If a million people in the US have used bitcoin, then that would mean 1,000 of them are going to be audited. That's quite a lot of audits.

And sure, 1 in 1,000 is nice odds, but you're still breaking the law. And some people care about not breaking the law on principle.

Also, if you do something the government doesn't like, then they can retroactively investigate you and bring the full force of the law down on you for tax evasion, which carries harsh penalties.

Re: Coinbase user emails and full names leaked

#119

Post by oijaf888 »

kisielk wrote: post #104
josephwegner wrote: post #99

Earlier quoted context omitted.

If you use gmail, you can use youremail+anything@gmail.com, and it will all get forwarded to youremail@gmail.com. This is incredibly handy for noticing who is sending you spam. I'll also use it for sites that I know are going to send me spam, and then immediately create a filter than deletes emails sent to joe+annoyingsite@gmail.com (note: that's not my real email)

That does nothing to increase the security of your accounts, since effectively the email address is the same.

It keeps phishing attacks from being able to cross services (since if you get a citibank email to your coinbase email that would be a big flag) and it reduces the attack surface on other sites.

I use email.site@domain.com for this purpose and it makes it handy to see who has somehow lost/disclosed my email to third parties and not informed me (FreshDirect for example)

Re: Coinbase user emails and full names leaked

#120

Post by ben0x539 »

beat wrote: post #39
ben0x539 wrote: post #7

Earlier quoted context omitted.

Hi, nothing wrong with anonymity.

There's lots wrong with anonymity. But those wrongs are the price we pay for the benefits of anonymity. Thinking there's "nothing wrong with anonymity" is the kind of intellectual fallacy that makes it so hard to take 'net libertarians seriously.

You're right, of course, and maybe I should have said "nothing wrong with submitting an article to hn without putting an established identity or even your real-life personal safety on the line". I suppose it was my desire to express with that comment my wider frustration regarding stuff like facebook/google+ real name policies that made my opt for a less accurate statement.
Post reply on HN