9 ms·
Coinbase Merchant Data Leak?
- bcl 14y agoThese are buy it now / donation pages. These are NOT checkout pages for coinbase users.
- cargo8 14y agoWhile this is bad, I do feel like anyone using a hosted wallet like Coinbase where you directly link a bank account (which I think is rare among bitcoin exchanges, etc) can't be expecting full anonymity. Coinbase is a registered company and if they have bank accounts linked then their identities are compromised anyway if the company were to get subpoenaed, I'd imagine. If they want anonymity they should be personally holding their own wallet. Most exchanges only allow some sort of cash order deposit, for this reason exactly.
- jgrahamc 14y ago20 reddit.com upvotes: 0.20BTC https://coinbase.com/checkouts/35297a275c385a75d231fd4a6edd56ca https://coinbase.com/checkouts/35297a275c385a75d231fd4a6edd5... So that's currently $1.34 per upvote. Seems like a lot.
- dabeeeenster 14y agoIt's not when the price of coins is 5 USD per coin...
- nwh 14y agoCoinbase started in June 2012, the lowest it has been since then is $10USD.
- rheide 14y agoThis is shamefully bad. There is no excuse for this.
- joelrunyon 14y agoI was going to add on to this, but I think that's all that needs to be said. This is bad.
- dangoldin 14y agoEspecially more so if people used it to buy illegal drugs and now have their checkout info available in Google..
- pathy 14y agoWhy are the checkout pages even public? No robots.txt, a lot of private information listed and public. Shameful. I know little about web development but this seems rather obvious, even to me.
- Zirro 14y agoUsing a robots.txt-file to hide data that shouldn't be public in the first place is a rather bad idea. Because the robots.txt itself is public, it actually highlights the location of the "private" data.
- benmanns 14y agoAnd, Google had to find a link to this content somehow, which means it's publicly accessible from some Coinbase page.
- manojlds 14y agoThat is what I am wondering. Here I am building a web site and wondering how to make Google index sites behind authentication and such, and here is a site that has got everything indexed.
- benmanns 14y agoAfter reading Coinbase's response, it seems that the pages were not linked to by Coinbase, but by users posting links to their checkout page on the Internet.
- ntumlin 14y agoWhat's a good alternative to robots.txt?
- dpcx 14y agoBlocking access to googlebot for those pages is the easiest. But robots.txt would work, if you just did Ignore /checkouts/
- thomasjames 14y agoThe cryptocurrency company that's never heard of cryptography. Bringing you your world in plain text.
- abailin 14y agoCan somebody explain how Google was able to index all these checkout pages? Presumably they were only sent over email.
- dabeeeenster 14y agoThat's a damn good question. I'd also like to know why these pages are still public? It's like, PULL THE PLUG, THEN FIX THIS, THEN PLUG BACK IN.
- nwh 14y agoGoogle uses the "completion" feature of Google Chrome to collect new URLs to scrape. If you have that on, they crawl after your visit.
- ry0ohki 14y agoI'm also convinced they use Google Analytics to find new URLs. I've seen URLs that I only had in AJAX calls indexed before (and I fired events to GA on these URLs).
- patio11 14y agoThey have expressly denied that in the past. (Where "that" is "using user data for Google Analytics to expand the crawl set". They're also on the record as saying "no use of toolbar data.") The more likely thing you are experiencing is Google reading your AJAX URLs, either by evaluating JS or by using heuristics. Google is known to do both of these, but a lot of HNers get surprised when I mention it, so FYI.
- underdown 14y agoI once had a spammer hit one of my contact forms a few hundred times on a page set up to capture traffic from South Dakota. there was a corresponding goal set up in Google Analytics that triggered and a week or so later the S Dakota page popped up as a site link on SERPS. Certainly doesn't prove anything but the page got essentially zero traffic and had no external inbound links and wasn't weighted very heavily in term of site architecture. Makes me wonder if there isn't some careful parsing of words in their claims. /removestinfoilhat
- uvdiv 14y ago(YC S12)
- niggler 14y agoI wouldn't be surprised if that were edited out. It has happened in the past with other criticisms of coinbase.
- wilfra 14y ago*it has happened in the past with all sorts of submissions (both positive and negative) about all sorts of companies because it is part of the rules of HN. Is the rule applied 100% of the time so that nobody will be able to find any exceptions? No. We're talking about humans here. But they are pretty consistent. Especially for stuff that hits the front page.
- niggler 14y ago"But they are pretty consistent." Discussed last time there was a front-page article: https://news.ycombinator.com/item?id=5428402 https://news.ycombinator.com/item?id=5428402 I pointed out that "Coinbase (YC S12) hires first engineer" http://news.ycombinator.com/item?id=5011361 http://news.ycombinator.com/item?id=5011361 didn't conform to the standards.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- wilfra 14y agoAs I said, there are exceptions. Humans do this, not algorithms. It's thus understandable how you found a two point submission that nobody ever saw which was overlooked.
- bti 14y agoAmateur hour over there. I originally signed up because they were a YC backed startup. Thankfully I never got around to doing any actual transactions.
- fyi80 14y agoYC is an investment fund and business networking program. It provides no technical base. Which is a bid silly, since (1) almost every YC-backed companty uses the the same technical infrastructure as many others, and (2) Paul Graham made his fortune building a self-service platform to build ecommerce websites just like YC business websites. Free YC startup idea: Build an ecommerce platform and tecnical management for hosting startups. There's no reason YC should be promoting this legend of "CS whiz kids" as "technical founders". Just set up a solid ecommerce platform, and take on YC founders with business ideas to run their business on the YC stack. The result will be much better websites, and a bunch of high-paying jobs for the engineers who can build quality sites. YC can be the next Yahoo Stores. Heck, Paul Graham can probably buy Yahoo Stores division that bought ViaWeb in the first place.
- h2s 14y agoJesus H Christ, this is quite a fuck up. Over on /r/bitcoin there's a comment linking to a transaction involving 229BTC worth of "Avalance Spa Powder", which is one of those synthetic drugs of ambiguous legality. That's quite a violation of trust on Coinbase's part. Their reputation is nuked. (Edit: Please note that I am 100% wrong about this. Why don't I just shut the fuck up for once?).
- apaprocki 14y agoSimilarly, search for "Tube Ace" in the dataset. Not something you want your personal e-mail address forever associated with.
- niggler 14y ago"Their reputation is nuked." If someone was looking to leave coinbase, who else provides a similar service?
- dragontamer 14y agoIMO, all Wallet web-apps are doomed to failure. The POINT of bitcoin is to be decentralized. Just carry the bitcoin key in your phone directly. https://play.google.com/store/apps/details?id=de.schildbach.wallet https://play.google.com/store/apps/details?id=de.schildbach.... Why do people think they need a web app for this sort of thing?
- tocomment 14y agoWhy isn't there a version for iPhone. This looks really useful. There's probably an opportunity there.
- dragontamer 14y agoI didn't realize Apple was full of jerks. http://www.bitpak.com/ http://www.bitpak.com/ About a week later, someone from Apple called me on the phone to let me know that BitPak had been removed from the App Store. The guy on the phone sounded like a nervous teenager. I asked him why this had happened, and he said “Because that Bitcoin thing is not legal in all jurisdictions for which BitPak is for sale”. I inquired as to which jurisdictions Bitcoin was deemed to be illlegal in, and he told me “that is up to you to figure out”. I asked him which laws Bitcoin violated, and again, he replied that “that is up to you to determine”. I told the kid on the phone that he has in fact told me nothing and was most unhelpful.
- deleted 14y ago[deleted]
- shocks 14y agoI considered posting this, but wasn't sure how the HN community would react. Glad someone else did. Here's something scary: https://www.facebook.com/harley.skyberg?ref=ts&fref=ts https://www.facebook.com/harley.skyberg?ref=ts&fref=ts bought https://coinbase.com/checkouts/dd24f66b49e34b97d2bbe0e3a9a2eeb4 https://coinbase.com/checkouts/dd24f66b49e34b97d2bbe0e3a9a2e... Oh dear.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- apaprocki 14y agoHe's the person selling, not the person buying. These pages are essentially merchant 'buy' buttons.
- DanBC 14y agoWell, someone using his email address sold / bought it; it's possible someone else did it. (Reputation attack; etc). Is there a date attached to that? (To work out rough quantities). It seems like a significant quantity. While we might not agree with what law enforcement do about drug and borderline-legal substances we know that law enforcement does take vigorous action. As do the US tax people. I guess his yearly audits suddenly got worse.
- Irregardless 14y agoWow, this company went through YC? I hope they only invested bitcoins... It's one thing to lose people's bitcoins or randomly delay/cancel transactions (both of which Coinbase has been accused of). People know that bitcoin is still young and the companies supporting it are inexperienced, so they expect that. But exposing personal info and purchase history goes beyond any definition of 'unacceptable' or 'incompetent'. Over in the Reddit thread, they're already linking Facebook accounts with illicit transactions. Users from Bitcointalk told Coinbase a week ago that they were starting to get phishing emails, which means someone has been mining this data for a while now. Yet there it is, still available through a simple Google search.
- niggler 14y ago"Yet there it is, still available through a simple Google search." Let's say, for some reason, you have some information from a site you own that you want to remove from Google search. How long does it take to remove it?
- apaprocki 14y agoI've had to do it before (business reasons) and it did not take that long -- on the order of 24-36 hours.
- nwh 14y agoThere's a link in the webmaster tool asking for speedy deletion. I'm assuming that means gone within hours.
- jlgaddis 14y agoRight, but only the owners/admins for that domain can use it. In other words, I couldn't request that a page on coinbase.org be removed -- only the Coinbase folks can.
- deleted 14y ago[deleted]
- 14y ago
- randlet 14y agoSearching google for coinbase checkouts: https://encrypted.google.com/search?q=site:https://coinbase.com/checkouts/ https://encrypted.google.com/search?q=site:https://coinbase.... Yikes.
- tptacek 14y agoIf the first 6 or so SERPs are representative of Bitcoin as a whole, it appears to be a currency that exists primarily to facilitate donations to blogs and websites. No wonder YC funded Coinbase; it let them take another whack at Tipjoy!
- DanBC 14y agoI'm fascinated at the data revealed by leaks. I really hope someone is scraping this to create some nice graphs and charts.
- mdelias 14y agoLink to close your account: https://coinbase.com/account/cancel https://coinbase.com/account/cancel
- DanBC 14y agoEDIT: I wrote this before people suggested that this 'leak' is just a list of people selling stuff, and not people buying stuff. Oh well. I leave my comment here, mostly because of bath-salts-guy - selling a large quantity of stuff of dubious legality should probably be done more carefully. Sorry to Coinbase people for jumping onto a pile-on before getting correct information. --- Regular people are hopeless when it comes to privacy and anonymity. Just look at something simple like "Don't chose a ridiculously easy password", and then look at any leaked password list. When users fail so hard at the trivial stuff (where we've had advice on best practice for years) how are they expected to succeed at tricky stuff like crypto currencies? This lack of user knowledge makes any coinbase[1] failures particularly bad. It's bad because you're supposed to protect your users. It's also bad because it's a failed business opportunity - 'hand hold naive users through a complex crypto process' is an unfilled niche. I was excited about Coinbase. I really wanted them to do well. But this? It's going to take some work to recover from this.
- MattBearman 14y agoI'm quite surprised that over an hour after this was posted, these checkout pages are STILL public! If I were running Coinbase I'd have put the site into some kind of 'down for maintenance' state immediately, and then put all my effort into plugging the leak. Of course the Google et al indexes are a more difficult problem, but at least stop any more from leaking. Edit: It has been pointed out that these are seller pages, with sellers details only, so not a data leak at all. I retract my previous statement :)
- smallegan 14y agoIf they turn off the checkout pages nobody can check out using their service. These are the SELLER's pages with the sellers info.
- atourgates 14y agoThat's because it's not a leak. These are checkout pages that sellers have chosen to make public.
- JimmaDaRustla 14y agoBut...but...but it's a beta!! Sorry, had to do it ;)
- tibbon 14y agoThis has been said again and again- the main thing that Coinbase needs to do right now is to get better about their communications with the public. Its understandable that a fast-growing startup in a new field, doing transaction-based work, will hit some bumps along the way. But they need to keep the community in the loop better. Twitter, blog, posting to threads like this (they know HN exists!)
- cocoflunchy 14y agoI think we should all calm down and look at this in a little more detail. A simple look at https://coinbase.com/merchants https://coinbase.com/merchants will show you a screenshot of a merchant page that looks exactly the same as those 'exposed' by google (https://encrypted.google.com/search?q=site:https://coinbase.com/checkouts/ https://encrypted.google.com/search?q=site:https://coinbase....) Until proved otherwise, I believe these pages to be merchant pages actually selling the items, as the copy also suggests ("Send 1.00BTC to...", "Comfirm payment"). The confusion must come, I suppose, from the ambiguous urls that contain /checkouts/... and from people not really liking Coinbase? Edit: Funny how this is a perfect example of the 'URLs are for people, not computers' argument that is number 2 on HN right now.
- Geee 14y agoDamn.. These are not transactions! These are public anyway on the merchant's site. Just try out https://coinbase.com/docs/merchant_tools/payment_pages https://coinbase.com/docs/merchant_tools/payment_pages and press the button. It goes to the checkout page similar to these.
- pungoyal 14y agothese are merchant pages, not actual transaction invoices. checkout - a poor choice of name of the resource for the job it intends to do ;]
- fyi80 14y agoYou know, when people were posting every blog rant about Haskell, at least a small bit of knowledge was being circulated. This bitcoin fad is dredging the bottom of the barrel -- dozens of upvoted comments written by people who can't tell the difference between an advertisement and a transaction confirmation.
- jstalin 14y agoI want to like coinbase, but 100% of the time that I try to buy bitcoins it says that it has run through its daily allotment and to try again in 24 hours.
- drcode 14y agoThe irony is that bitcoins is the perfect technology for preventing these kinds of data leaks- If only some more capable developers could start opening bitcoin businesses.
- rdl 14y agoOh my god, someone found merchant pages offering stuff for sale. They shouldn't be indexed, but on the 1-10 scale of security vulnerabilities, this is about a 1.05. OTOH finding it is not very far off what Weev got 3.5 years in federal prison for, though, under CFAA.
- danielpal 14y agoI don't understand why there's a big issue with being indexed? In fact they should be indexed if they remove the e-mail address from the page. Isn't the goal of this pages to sell more? Don't people use search engines to find stuff to buy? The whole thing is just a big misunderstanding.
- rdl 14y agoI think people are right to be on a "hair trigger" w.r.t. vulnerabilities at wallet providers, given the atrocious track record of almost everyone involved in the bitcoin industry for security. OTOH, Coinbase and Coinlab (the new Mt. Gox) are the entities I'd trust the most not to be outright fraudulent, since they're venture funded. The founders stand to gain far more by being honest than running off with BTC, and the reputation of investors (including YC) would be harmed far more by fraud, so the only real risk is outside compromise, employee compromise, etc. Coinbase has done a better job on security than any other BTC entity I've seen (although I've looked at them more closely than all but a few other providers).
- EarthLaunch 14y agoThese threads are full of misinformation and knee-jerk reactions to a problem so minor that it is barely worth noticing. And the title ("Coinbase User Data Leak?") is misleading - where's the zealous title editing now? The Reddit thread is even worse. This is more revealing of the HN community than it is of Coinbase, who hasn't done anything wrong. Disgusting.
- bredren 14y agoHaters gonna hate.
- r-shirt 14y agoI trusted coinbase to cashout two years worth of bitcoin paid to my online t-shirt business. First they ignored me for two weeks[0], then they promised the funds would be deposited yesterday. They're still not deposited today[1]. [0]: http://www.reddit.com/r/Bitcoin/comments/1bdd8p/iama_bitcoinaccepting_merchant_with_serious/ http://www.reddit.com/r/Bitcoin/comments/1bdd8p/iama_bitcoin... [1]: http://i.imgur.com/fNoXvMH.png http://i.imgur.com/fNoXvMH.png and http://i.imgur.com/brlY2Ry.png http://i.imgur.com/brlY2Ry.png
- barmstrong 14y agoAdded a response on Reddit also: http://www.reddit.com/r/Bitcoin/comments/1bdd8p/iama_bitcoinaccepting_merchant_with_serious/c95yd66 http://www.reddit.com/r/Bitcoin/comments/1bdd8p/iama_bitcoin... Should now be resolved with all funds paid out - but the delayed response was definitely our fault as we ramp up support. Thank you for bearing with us!
- iblaine 14y agoPlease read past the headline. There is a lot of uneducated sensationalism criticism going on. The data leak has exposed info that is already public, and basically harmless. Given someone with enough time and effort can turn this public info into a seedy crime, like using the contact list for phishing, the average coinbase user is far removed from this so called 'data leak.'
- jwcrux 14y agoMy Twitter bot, @dumpmon, found a leak of these here: http://pastebin.com/raw.php?i=b34a2X3b http://pastebin.com/raw.php?i=b34a2X3b