3 ms·

I assume someone took a huge list of emails and ran them through the Coinbase API as described in https://hackerone.com/reports/5200 https://hackerone.com/repor

I assume someone took a huge list of emails and ran them through the Coinbase API as described in https://hackerone.com/reports/5200 https://hackerone.com/reports/5200 and retrieved their full names, and is now scaremongering. I do not think they are enumerating users from the coinbase database, but who knows. edit: The recent adobe email list comes to mind.

300bps 13y ago
You're right. As a Coinbase customer, neither my name or Coinbase-only email address was in this list. What you describe is exactly the exploit that was disclosed and exactly what the person exploiting it seems to have done based on the content of the list. Of course, Coinbase argues that this is a feature and not a bug.
- naterator 13y ago
  > neither my name or Coinbase-only email address was in this list That doesn't really mean anything, since it clearly says at the top: "Here is a partial list of Coinbase user emails and their full names. Full list much bigger." Which could be bullshit and scaremongering. But it certainly could be true that they have a large number of Coinbase user's emails.
  - 300bps 13y ago
    >Which could be bullshit and scaremongering. It could also be that you are reading too much into it. >"Here is a partial list of Coinbase user emails and their full names. Full list much bigger." Where does it say in that sentence that he the OP has access to the "full list"? It doesn't say that. It implies it, which you picked right up on. But he doesn't explicitly say, "Here is a partial list of the full list in my possession".
- dignati 13y ago
  The author already claims that this is only a partial list and that he didn't disclose everything he has access to.
mjhoyer 13y ago
That was my first thought. This feels off, I doubt Coinbase database was hacked and this is just using their API flaw and some previously leaked email database.

300bps 13y ago

You're right. As a Coinbase customer, neither my name or Coinbase-only email address was in this list. What you describe is exactly the exploit that was disclosed and exactly what the person exploiting it seems to have done based on the content of the list. Of course, Coinbase argues that this is a feature and not a bug.

naterator 13y ago
> neither my name or Coinbase-only email address was in this list That doesn't really mean anything, since it clearly says at the top: "Here is a partial list of Coinbase user emails and their full names. Full list much bigger." Which could be bullshit and scaremongering. But it certainly could be true that they have a large number of Coinbase user's emails.
- 300bps 13y ago
  >Which could be bullshit and scaremongering. It could also be that you are reading too much into it. >"Here is a partial list of Coinbase user emails and their full names. Full list much bigger." Where does it say in that sentence that he the OP has access to the "full list"? It doesn't say that. It implies it, which you picked right up on. But he doesn't explicitly say, "Here is a partial list of the full list in my possession".
dignati 13y ago
The author already claims that this is only a partial list and that he didn't disclose everything he has access to.

mjhoyer 13y ago

That was my first thought. This feels off, I doubt Coinbase database was hacked and this is just using their API flaw and some previously leaked email database.