3 ms·

Off-topic, but since you guys have ignored: 3 emails from me, and a tweet... I sent you an XSS vulnerability to whitehat@coinbase.com according to https://coin

• tnorthcutt 13y ago
  To anyone considering or currently using coinbase: this comment (if verifiably true) should be a GIANT red flashing light warning you to tread carefully.
• alttab 13y ago
  This scares me.
  • nanidin 13y ago
    Enable 2 factor authentication. IIRC Coinbase doesn't use it per user action, but at least having it has the potential to save you some headaches.
• borski 13y ago
  Coinbase guys: if you'd like, we're happy to offer you a free 3 months of website vulnerability scanning to hopefully help you find and squash any vulnerabilities like this. Just email me at borski@tinfoilsecurity.com.
• philfreo 13y ago
  It was frustrating that I didn't receive any contact from Coinbase until after posting on here HN, however I'd like to point out a couple things: - This was a relatively minor XSS vulnerability which required a bit of social engineering to pull off, rather than being a traditional XSS that most HN readers would need to worry about. - Their delayed response was likely due to the relative minor nature of this vulnerability. - I still feel safe using Coinbase - They're taking care of it and treating me well :)
• barmstrong 13y ago
  We'll take a look. Thanks for the reminder!