Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase user emails and full names leaked

pastebin.com

Post reply on HN
Print view View original

261–270 of 294 posts

Re: Coinbase user emails and full names leaked

#261

Post by MichaelGG »

broolstoryco wrote: post #249
nfm wrote: post #247

Earlier quoted context omitted.

This is a real attack vector. It's called a timing attack: http://en.wikipedia.org/wiki/Timing_attack

I am familiar with timing attacks. The thought of someone attempting to apply it over the internet to verify whether an email is registered on a dating site seems laughable.

Applying it over the Internet is quite feasible, especially with simple code. If it connects to a remote SMTP server, the delay may very well be noticeable enough without doing any complicated timing. It might be just about as easy as scraping the page for "user not found" versus "email sent".

I assume that was the original point - that on risque dating sites, the recover password system tries to hide membership.

Re: Coinbase user emails and full names leaked

#262

Post by genwin »

mpyne wrote: post #257
genwin wrote: post #222

Earlier quoted context omitted.

I reckon non-anonymous bitcoin holders are at greater risk than the average person with money in the bank, since draining the account of the former is a relative cinch once the keys are divulged. The whole crime could be completed within a few minutes.

That much may be true, but I'd consider that an inherent risk associated with using Bitcoin without using a pseudonym. Maybe I'm naïve but I have to assume people who care about such things are already tracking IP addresses directly from the Bitcoin network swarm itself for later investigation...

Likely Coinbase customers expected Coinbase to keep their real name secure from potential thieves. But they thought wrongly.

Re: Coinbase user emails and full names leaked

#263

Post by rahimnathwani »

nwh wrote: post #40
jellicle wrote: post #35

Earlier quoted context omitted.

> Even an end of world bug means that they can only ever lose a small portion of all stored user funds. Were you born yesterday? The steal-all-your-money rate of bitcoin businesses is running right around 100%, and you're going to lecture people that "they can only ever lose a small portion of all stored user funds"? Really?

Coinbase isn't some random website made in a basement. It's a well funded, YC backed, known-founder company that complies with relevant banking law. There's absolutely nothing to suggest that they hold a partial reserve or have any ill intention whatsoever.

Which relevant banking law? AFAIK Coinbase is not a bank.

Re: Coinbase user emails and full names leaked

#264

Post by kbenson »

hkphooey wrote: post #260
FredEE wrote: post #206

Earlier quoted context omitted.

Update - blog post here: http://blog.coinbase.com/post/81407694500/update-on-coinbase...

UPDATE: For anybody following Bitcoin news, this is obviously satire, replacing MtGox with CoinBase. Surprised people downvoted this. There are rumors that a joint statement will be released at 5PM Pacific Time... Joint Statement Regarding CoinBase Apr 1st, 2014 The purpose of this document is to summarize a joint statement to the Bitcoin community regarding CoinBase. This tragic violation of the trust of users of Co…

The possibility of this being misinterpreted as valid is rather high. I think your point could have been made well with a single explaining sentence up front and without the name substitution in the actual content.

Re: Coinbase user emails and full names leaked

#265

Post by hkphooey »

kbenson wrote: post #264
hkphooey wrote: post #260

Earlier quoted context omitted.

UPDATE: For anybody following Bitcoin news, this is obviously satire, replacing MtGox with CoinBase. Surprised people downvoted this. There are rumors that a joint statement will be released at 5PM Pacific Time... Joint Statement Regarding CoinBase Apr 1st, 2014 The purpose of this document is to summarize a joint statement to the Bitcoin community regarding CoinBase. This tragic violation of the trust of users of Co…

The possibility of this being misinterpreted as valid is rather high. I think your point could have been made well with a single explaining sentence up front and without the name substitution in the actual content.

These guys stuck the knife into MtGox... when they themselves are no better.

Check the forums over at BitcoinTalk, for months now, people using Kraken have been unable to withdraw their money, and deposits have been going 'missing'. The fact that support is conducted over a public forum, out of sheer desperation on the customers part, tells you something.

If CoinBase did go down, would you bet against the other providers crafting a public relations message to drum up business for themselves? It's dog eat dog out there - the idea that there is a community of Bitcoin businesses looking out for each other is a joke.

Re: Coinbase user emails and full names leaked

#266

Post by berberous »

oijaf888 wrote: post #133
berberous wrote: post #75

Earlier quoted context omitted.

This is highly likely to be true, and even if it's not, everyone should operate as if it's true. With the meteoric rise in price appreciation, I can't imagine the IRS at some point not requiring that the largest companies directly report users' income or capital gains to them. So don't be tempted to under-report your bitcoin gains. Similarly, the FBI and other money regulators have clearly shown their strong interest…

What form would the IRS require it to be filed as? I don't know of any industry/company that is required to file a monthly/daily 1099 for customers. Even the banks are only required to file that stuff yearly via a Schedule D.

Oops, you are right, I totally read that too fast and didn't catch the allegation of "full" transaction history being provided "daily" for all users. That seems like way more detail than the IRS or FinCEN needs...even the FBI is likely more targeted than that.

Also, I should note I am no expert on this topic, I just think people would be very foolish to cheat on their taxes or commit financial crimes via Coinbase or any very large exchange. One should assume government prosecutors or tax collectors can and do access it just as easily as with the regular banking infrastructure (to whatever extent that is), even if they don't actually do so yet.

Re: Coinbase user emails and full names leaked

#267

Post by amalcon »

MichaelGG wrote: post #233
goatforce5 wrote: post #217

Earlier quoted context omitted.

I work on dating sites, some of them a bit risqué. On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".

Do you setup a timed sleep to make sure that you return results in exactly the same time regardless of path taken?

For the record, the right way to do this is to just log the request to your database, and have a background process pull the log and take appropriate action later.

Re: Coinbase user emails and full names leaked

#268

Post by sillysaurus3 »

socillion wrote: post #255
sillysaurus3 wrote: post #191

Earlier quoted context omitted.

This is the first I've heard that any insurance company is willing to fully insure any bitcoin exchange, and it's wonderful news. Thank you so much for pointing it out! I'll look into it and see whether it's as good as it sounds.

http://www.reddit.com/r/Bitcoin/comments/20dolm/psa_xapo_doe...

Thank you so much for pointing that out. It did seem too good to be true.

Re: Coinbase user emails and full names leaked

#270

Post by socillion »

sillysaurus3 wrote: post #268
socillion wrote: post #255

Earlier quoted context omitted.

http://www.reddit.com/r/Bitcoin/comments/20dolm/psa_xapo_doe...

Thank you so much for pointing that out. It did seem too good to be true.

I'm not sure how much truth there is to that post since I haven't done any due diligence myself, I just remembered seeing it a while back.

From the top comment in that thread, it looks like the company with insurance underwritten by Lloyd's is Elliptic.

Post reply on HN