7 ms·

Apparent Coinbase response there: "This stance is not unusual on the web: you'll find that user enumeration is possible on Facebook, Google, and nearly every ot

by wes-exp 13y ago

Apparent Coinbase response there: "This stance is not unusual on the web: you'll find that user enumeration is possible on Facebook, Google, and nearly every other major internet site" Um, no. If that is what Coinbase believes, I just lost respect for their claims of security.

smtddr 13y ago
FWIW, https://plus.google.com/people/find https://plus.google.com/people/find You can find people's G+ profile if you guess the email correctly. I wouldn't be surprised if LinkedIn,Facebook,etc. had the same type of thing. I do think that coinbase-API should be rate-limited or unreplayable, but I'm _much more_ interested in where the email-list input data came from. My email wasn't in this alleged partial list, but if it was I'd like to know where they got my email from to begin with because the source of that email-list is the real problem IMHO. I will say this though: Coinbase, please make sure there is absolutely no api call that returns banking/CC info!
- SDGT 13y ago
  You can just type emails into the gmail account creation form to get results back on if the username was taken. This whole debacle is making a mountain out of a molehill.
  - vertex-four 13y ago
    Do it enough, and you get a CAPTCHA, do it more, and you get banned by IP. I would assume that the limits are set to a point that it's very difficult to enumerate the database in any reasonable timespan.
  - dangrossman 13y ago
    SMTP's the API for checking if an address exists at any mail provider. Start sending a mail, if the server doesn't tell you there's no such mailbox right then, you can abandon the connection without sending a message through. No CAPTCHAs there either.
    - dspillett 13y ago
      Many mail servers delay account checking for that very reason. They take in all mail - instead of telling the sending MTA that the account doesn't exist the message is accepted and sent to /dev/null. A bounce message may be generated but the automated MTA won't see that as the message will be carrying invalid mail sender information.
    - Ensorceled 13y ago
      Many mail relays, especially spam appliances like Barracuda, will always give an 250 OK to the email address provided to prevent exactly this trick. They then toss as spam or bounce once they get the message.
  - dspillett 13y ago
    In an not-yet-authenticated state your code should do everything it can not to tell a potential hacker something they do not already know. Being able to check if an account exists and being able to read of the full name associated with it are not the worst problems in the world (though knowing the full name could make fishing attacks slightly less unconvincing) but if you take the attitude of never telling an attacker anything no matter how innocuous you think the information is then you are less likely to accidentally let something sensitive slip due to a bug.
SDGT 13y ago
Would you care explaining why it is that you believe email enumeration to be "insecure"? The data obtained is an email address and a name (only if the user filled in the "name" field). This may as well be treated as public information.
- jeremymcanally 13y ago
  Do you publish that you have a Coinbase account? That's the issue. Now these people are valuable targets for spear phishing and other attacks on their e-mail accounts because it's known that they have hot access to at least some amount of Bitcoin. Without that information, an attacker is shooting blind. So, this sort of leak or enumeration basically reduces the (though tenuous) degree of security afforded by one's privacy.
  - eli 13y ago
    shrug Some people certainly do: https://twitter.com/search?q=just%20bought%20coinbase&src=typd&f=realtime https://twitter.com/search?q=just%20bought%20coinbase&src=ty... I agree it's not ideal, but if your security relied on a guessable email address staying private, you're already not in a good place.
    - deleted 13y ago
      [deleted]
      - deleted 13y ago
        [deleted]
    - dspillett 13y ago
      Because "well someone else does it" has always been the best reason to behave a certain way...
      - eli 13y ago
        No, and indeed I don't publish whether or not I have a coinbase account. But it isn't a serious security failure if that somehow got out.
billyhoffman 13y ago
Please discuss which attack vectors you are worried about for this user enumeration issue affecting a public website.

by wes-exp 13y ago

smtddr 13y ago

FWIW, https://plus.google.com/people/find https://plus.google.com/people/find You can find people's G+ profile if you guess the email correctly. I wouldn't be surprised if LinkedIn,Facebook,etc. had the same type of thing. I do think that coinbase-API should be rate-limited or unreplayable, but I'm _much more_ interested in where the email-list input data came from. My email wasn't in this alleged partial list, but if it was I'd like to know where they got my email from to begin with because the source of that email-list is the real problem IMHO. I will say this though: Coinbase, please make sure there is absolutely no api call that returns banking/CC info!

SDGT 13y ago
You can just type emails into the gmail account creation form to get results back on if the username was taken. This whole debacle is making a mountain out of a molehill.
- vertex-four 13y ago
  Do it enough, and you get a CAPTCHA, do it more, and you get banned by IP. I would assume that the limits are set to a point that it's very difficult to enumerate the database in any reasonable timespan.
- dangrossman 13y ago
  SMTP's the API for checking if an address exists at any mail provider. Start sending a mail, if the server doesn't tell you there's no such mailbox right then, you can abandon the connection without sending a message through. No CAPTCHAs there either.
  - dspillett 13y ago
    Many mail servers delay account checking for that very reason. They take in all mail - instead of telling the sending MTA that the account doesn't exist the message is accepted and sent to /dev/null. A bounce message may be generated but the automated MTA won't see that as the message will be carrying invalid mail sender information.
  - Ensorceled 13y ago
    Many mail relays, especially spam appliances like Barracuda, will always give an 250 OK to the email address provided to prevent exactly this trick. They then toss as spam or bounce once they get the message.
- dspillett 13y ago
  In an not-yet-authenticated state your code should do everything it can not to tell a potential hacker something they do not already know. Being able to check if an account exists and being able to read of the full name associated with it are not the worst problems in the world (though knowing the full name could make fishing attacks slightly less unconvincing) but if you take the attitude of never telling an attacker anything no matter how innocuous you think the information is then you are less likely to accidentally let something sensitive slip due to a bug.

SDGT 13y ago

Would you care explaining why it is that you believe email enumeration to be "insecure"? The data obtained is an email address and a name (only if the user filled in the "name" field). This may as well be treated as public information.

jeremymcanally 13y ago
Do you publish that you have a Coinbase account? That's the issue. Now these people are valuable targets for spear phishing and other attacks on their e-mail accounts because it's known that they have hot access to at least some amount of Bitcoin. Without that information, an attacker is shooting blind. So, this sort of leak or enumeration basically reduces the (though tenuous) degree of security afforded by one's privacy.
- eli 13y ago
  shrug Some people certainly do: https://twitter.com/search?q=just%20bought%20coinbase&src=typd&f=realtime https://twitter.com/search?q=just%20bought%20coinbase&src=ty... I agree it's not ideal, but if your security relied on a guessable email address staying private, you're already not in a good place.
  - deleted 13y ago
    [deleted]
    - deleted 13y ago
      [deleted]
  - dspillett 13y ago
    Because "well someone else does it" has always been the best reason to behave a certain way...
    - eli 13y ago
      No, and indeed I don't publish whether or not I have a coinbase account. But it isn't a serious security failure if that somehow got out.

billyhoffman 13y ago

Please discuss which attack vectors you are worried about for this user enumeration issue affecting a public website.