8 ms·

Does anyone know where or if the full list can be found? I have a Coinbase account but I don't see my name on the abbreviated list. I suspect that the person w

Does anyone know where or if the full list can be found? I have a Coinbase account but I don't see my name on the abbreviated list. I suspect that the person who made this Pastebin just ran a huge list of known leaked emails, or dictionary based emails through the minor information leakage vulnerability discussed yesterday (https://hackerone.com/reports/5200 https://hackerone.com/reports/5200). I would be willing to bet that this brief list is actually all he got back, and he is just lying when he says "Full list much bigger." Since the vulnerability was reliant on knowing the email first, and since my email used on Coinbase is not a known email that I publicize I doubt he would have been able to discover my Coinbase account, nor the Coinbase accounts of anyone else who uses a sufficiently random and unknown email address when signing up.

bvttf 13y ago
For what it's worth, I have a coinbase account linked to a gmail address in the form firstname.lastname, where both are common names. I'd expect it to be in a dictionary based list, and it's not on the pastebin.
- deleted 13y ago
  [deleted]
beaner 13y ago
There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.
- deleted 13y ago
  [deleted]
- Zigurd 13y ago
  That sounds innocuous. But it's easy for, say, mobile badware to harvest contact lists. By targeting non-anonymous bitcoin holders as a "seed" list and using exposed contact lists like LinkedIn contacts, you can ratchet your way up into disclosing a lot of people who would prefer not to be known, lest the become phishing targets. Doesn't seem innocuous. Maybe coinbase ought to be making pseudonymity more easily accessible.
- djf1 13y ago
  It gives the full name associated with an email address. A more dramatic but analogous situation would be if an attacker were able to attain password info or credit card info associated with an email address. Just because email address is known does not imply that other personal information should be given away.
  - loumf 13y ago
    Does it leak the fact that you have a coinbase account? That seems private as well.
    - onewaystreet 13y ago
      If someone has your email address it is impossible for coinbase or any service to stop that person from checking if you have an account. All they have to do it try registering a new account with your address and see if it lets them (as most services don't allow multiple accounts to use the same email address).
      - fcp 13y ago
        It doesn't need to be impossible. The problem could be designed away: on form submission send an email saying 'looks like you already have an account' or 'welcome... next steps' and just show a 'check your email' message in the browser.
- bushido 13y ago
  Since Coinbase is a financial-esque firm that deals with and stores peoples money/BTC it is not at all alright for this to be treated as public information, even if someone already had the email address. I know CB is not a financial company and they are not obligated to provide the same protections to consumers/customers. Phishing is not the only reason why a customer would not like their bank to confirm that they have an account. As a matter of fact in this situation, when someone sends a fund request, CB should never let the requesting party know the name of the account holder, unless the account holder explicitly gives them permission, maybe not even then. With any other organization law enforcement would require a warrant to get basic confirmation if a customer has an account and the name on the account.
- mpyne 13y ago
  It does confirm email addresses you can guess though (which are not necessarily email addresses you have, until they're confirmed), along with leaking other information about that user.
  - tptacek 13y ago
    What other information is it leaking?
    - danielweber 13y ago
      From what I gather, first name and last name. Stopping email address validation is, I think, impossible for a company like Coinbase, but revealing the name doesn't have to happen. On the other hand, providing the first and last name could be very valuable to the users, though. If I send coins to bob@example.com, I'd like to see the real name behind that address. On the other other hand, if anyone can make any first and last name they wish, then the safety of that goes away. Maybe I make b0b@example.com with the same real name. EDIT The users agreed to have their names given to people they transact with. Does that include strangers attempting to transact with them? I'm thinking "no" but can see the other side.
      - KMag 13y ago
        If you want a service that allows the sender to verify name before sending, make it a feature that both: (1) is opt-in on the recipient's side and fails with something like "that recipient email address doesn't have an account, the name doesn't match, or they haven't decided to allow name verification" AND (2) is only available on payments above your highest guess at the expected value of matching an account-email-name triple for spearphishing, and the error messages (and timings) are identical if the name doesn't match or the given email address doesn't have an account. I imagine there are few profitable attacks where an answer "yes, email_address with name has a Coinbase account" costs a minimum of 100 USD to an attacker and getting an answer "Either email_address doesn't have an account, that name doesn't match our records, or they've chosen not to share their name" costs 0 USD. However, I'd have to think a bit more about that 100 USD minimum.
- goatforce5 13y ago
  I work on dating sites, some of them a bit risqué. On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".
  - MichaelGG 13y ago
    Do you setup a timed sleep to make sure that you return results in exactly the same time regardless of path taken?
    - broolstoryco 13y ago
      Not sure if sarcasm..
      - nfm 13y ago
        This is a real attack vector. It's called a timing attack: http://en.wikipedia.org/wiki/Timing_attack http://en.wikipedia.org/wiki/Timing_attack
        broolstoryco 13y ago
        I am familiar with timing attacks. The thought of someone attempting to apply it over the internet to verify whether an email is registered on a dating site seems laughable.
        MichaelGG 13y ago
        Applying it over the Internet is quite feasible, especially with simple code. If it connects to a remote SMTP server, the delay may very well be noticeable enough without doing any complicated timing. It might be just about as easy as scraping the page for "user not found" versus "email sent". I assume that was the original point - that on risque dating sites, the recover password system tries to hide membership.
    - 13y ago
- Allower 13y ago
  I think you meant to say : "This is the bullshit excuse they are trying to use to make it SEEM like its not a vulnerability." Coinbase is deliberately misleading their users regarding privacy if they do not fix this issue!
yukichan 13y ago
I just noticed that the hackerone report curl bit includes a coinbase session cookie. Doesn't seem like a good thing to include.
FredEE 13y ago
Fred from Coinbase here. There is no full list, and there is no leak. We're drafting a more formal response now.
- sillysaurus3 13y ago
  Would you include in your response the reason why you're ignoring Homakov's security flaw reports, which were emailed to you at your whitehat@coinbase.com email address? https://news.ycombinator.com/item?id=7505757 https://news.ycombinator.com/item?id=7505757 A lot of people are getting nervous that you're not taking security seriously at Coinbase. Ignoring whitehat reports would seem to be a serious issue.
  - jakejake 13y ago
    They mentioned something about it on the thread that they were transitioning to a new system - plus the fact that nobody saw it as a vulnerability. I guess that's the reason
    - tptacek 13y ago
      Apropos nothing else and without judging the actual report you're referring to: if you set up a "whitehat@yourdomain" or "security@yourdomain" alias, you need to be responsive. You can't ignore good-faith messages because you don't think they're valid. You have to act like all good-faith messages are urgent. Those aliases are cheap insurance, but they aren't free: they'll cost you some tech support cycles.
      - taylorbuley 13y ago
        Cheap, sure, but they'll cost you plenty in "lost face" when we journos write that you ignored inbound alerts from the person who later published something out of frustration. Not just emails, either. See also event logging: https://www.schneier.com/blog/archives/2014/03/details_of_the_.html https://www.schneier.com/blog/archives/2014/03/details_of_th...
FredEE 13y ago
Update - blog post here: http://blog.coinbase.com/post/81407694500/update-on-coinbase-data-security http://blog.coinbase.com/post/81407694500/update-on-coinbase...
- chazandchaz 13y ago
  "You’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site." I love this. Look these silly free social sites do it, so it must be ok. Anyone know if BofA or WellsFargo allow user enumeration?
  - bushido 13y ago
    > Anyone know if BofA or WellsFargo allow user enumeration You're correct. They don't. Not even to authorities without a warrant. Which is the point I was trying to make in my earlier comment.[0] [0] https://news.ycombinator.com/item?id=7510524 https://news.ycombinator.com/item?id=7510524
  - trollfighter 13y ago
    BofA and Wells Fargo suffer from account number enumeration. Wells Fargo has 10-11 digit (depending on if it's WF or previously Wachovia) account numbers. One portion defines the bank branch where the account was opened, another portion defines the account type, and the last digit is a check digit. You can guess at an account number by attempting a deposit (in person or online). There's also the fact that BofA and Wells Fargo have account numbers displayed in cleartext on pieces of paper that are handed to strangers. I'm not arguing the merits of Coinbase's security, but traditional banks don't fare well either. Coinbase can improve. Traditional banks are limited by standards that they can't change.
    - danielweber 13y ago
      I haven't personally seen the system, or tested it, but I'm pretty sure if I tried to enumerate all Bank Of America account numbers I'd get shut down pretty quick.
    - 13y ago

bvttf 13y ago

For what it's worth, I have a coinbase account linked to a gmail address in the form firstname.lastname, where both are common names. I'd expect it to be in a dictionary based list, and it's not on the pastebin.

deleted 13y ago
[deleted]

beaner 13y ago

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

deleted 13y ago
[deleted]
Zigurd 13y ago
That sounds innocuous. But it's easy for, say, mobile badware to harvest contact lists. By targeting non-anonymous bitcoin holders as a "seed" list and using exposed contact lists like LinkedIn contacts, you can ratchet your way up into disclosing a lot of people who would prefer not to be known, lest the become phishing targets. Doesn't seem innocuous. Maybe coinbase ought to be making pseudonymity more easily accessible.
djf1 13y ago
It gives the full name associated with an email address. A more dramatic but analogous situation would be if an attacker were able to attain password info or credit card info associated with an email address. Just because email address is known does not imply that other personal information should be given away.
- loumf 13y ago
  Does it leak the fact that you have a coinbase account? That seems private as well.
  - onewaystreet 13y ago
    If someone has your email address it is impossible for coinbase or any service to stop that person from checking if you have an account. All they have to do it try registering a new account with your address and see if it lets them (as most services don't allow multiple accounts to use the same email address).
    - fcp 13y ago
      It doesn't need to be impossible. The problem could be designed away: on form submission send an email saying 'looks like you already have an account' or 'welcome... next steps' and just show a 'check your email' message in the browser.
bushido 13y ago
Since Coinbase is a financial-esque firm that deals with and stores peoples money/BTC it is not at all alright for this to be treated as public information, even if someone already had the email address. I know CB is not a financial company and they are not obligated to provide the same protections to consumers/customers. Phishing is not the only reason why a customer would not like their bank to confirm that they have an account. As a matter of fact in this situation, when someone sends a fund request, CB should never let the requesting party know the name of the account holder, unless the account holder explicitly gives them permission, maybe not even then. With any other organization law enforcement would require a warrant to get basic confirmation if a customer has an account and the name on the account.
mpyne 13y ago
It does confirm email addresses you can guess though (which are not necessarily email addresses you have, until they're confirmed), along with leaking other information about that user.
- tptacek 13y ago
  What other information is it leaking?
  - danielweber 13y ago
    From what I gather, first name and last name. Stopping email address validation is, I think, impossible for a company like Coinbase, but revealing the name doesn't have to happen. On the other hand, providing the first and last name could be very valuable to the users, though. If I send coins to bob@example.com, I'd like to see the real name behind that address. On the other other hand, if anyone can make any first and last name they wish, then the safety of that goes away. Maybe I make b0b@example.com with the same real name. EDIT The users agreed to have their names given to people they transact with. Does that include strangers attempting to transact with them? I'm thinking "no" but can see the other side.
    - KMag 13y ago
      If you want a service that allows the sender to verify name before sending, make it a feature that both: (1) is opt-in on the recipient's side and fails with something like "that recipient email address doesn't have an account, the name doesn't match, or they haven't decided to allow name verification" AND (2) is only available on payments above your highest guess at the expected value of matching an account-email-name triple for spearphishing, and the error messages (and timings) are identical if the name doesn't match or the given email address doesn't have an account. I imagine there are few profitable attacks where an answer "yes, email_address with name has a Coinbase account" costs a minimum of 100 USD to an attacker and getting an answer "Either email_address doesn't have an account, that name doesn't match our records, or they've chosen not to share their name" costs 0 USD. However, I'd have to think a bit more about that 100 USD minimum.
goatforce5 13y ago
I work on dating sites, some of them a bit risqué. On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".
- MichaelGG 13y ago
  Do you setup a timed sleep to make sure that you return results in exactly the same time regardless of path taken?
  - broolstoryco 13y ago
    Not sure if sarcasm..
    - nfm 13y ago
      This is a real attack vector. It's called a timing attack: http://en.wikipedia.org/wiki/Timing_attack http://en.wikipedia.org/wiki/Timing_attack
      - broolstoryco 13y ago
        I am familiar with timing attacks. The thought of someone attempting to apply it over the internet to verify whether an email is registered on a dating site seems laughable.
        MichaelGG 13y ago
        Applying it over the Internet is quite feasible, especially with simple code. If it connects to a remote SMTP server, the delay may very well be noticeable enough without doing any complicated timing. It might be just about as easy as scraping the page for "user not found" versus "email sent". I assume that was the original point - that on risque dating sites, the recover password system tries to hide membership.
  - 13y ago
Allower 13y ago
I think you meant to say : "This is the bullshit excuse they are trying to use to make it SEEM like its not a vulnerability." Coinbase is deliberately misleading their users regarding privacy if they do not fix this issue!

yukichan 13y ago

I just noticed that the hackerone report curl bit includes a coinbase session cookie. Doesn't seem like a good thing to include.

FredEE 13y ago

Fred from Coinbase here. There is no full list, and there is no leak. We're drafting a more formal response now.

sillysaurus3 13y ago
Would you include in your response the reason why you're ignoring Homakov's security flaw reports, which were emailed to you at your whitehat@coinbase.com email address? https://news.ycombinator.com/item?id=7505757 https://news.ycombinator.com/item?id=7505757 A lot of people are getting nervous that you're not taking security seriously at Coinbase. Ignoring whitehat reports would seem to be a serious issue.
- jakejake 13y ago
  They mentioned something about it on the thread that they were transitioning to a new system - plus the fact that nobody saw it as a vulnerability. I guess that's the reason
  - tptacek 13y ago
    Apropos nothing else and without judging the actual report you're referring to: if you set up a "whitehat@yourdomain" or "security@yourdomain" alias, you need to be responsive. You can't ignore good-faith messages because you don't think they're valid. You have to act like all good-faith messages are urgent. Those aliases are cheap insurance, but they aren't free: they'll cost you some tech support cycles.
    - taylorbuley 13y ago
      Cheap, sure, but they'll cost you plenty in "lost face" when we journos write that you ignored inbound alerts from the person who later published something out of frustration. Not just emails, either. See also event logging: https://www.schneier.com/blog/archives/2014/03/details_of_the_.html https://www.schneier.com/blog/archives/2014/03/details_of_th...

FredEE 13y ago

Update - blog post here: http://blog.coinbase.com/post/81407694500/update-on-coinbase-data-security http://blog.coinbase.com/post/81407694500/update-on-coinbase...

chazandchaz 13y ago
"You’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site." I love this. Look these silly free social sites do it, so it must be ok. Anyone know if BofA or WellsFargo allow user enumeration?
- bushido 13y ago
  > Anyone know if BofA or WellsFargo allow user enumeration You're correct. They don't. Not even to authorities without a warrant. Which is the point I was trying to make in my earlier comment.[0] [0] https://news.ycombinator.com/item?id=7510524 https://news.ycombinator.com/item?id=7510524
- trollfighter 13y ago
  BofA and Wells Fargo suffer from account number enumeration. Wells Fargo has 10-11 digit (depending on if it's WF or previously Wachovia) account numbers. One portion defines the bank branch where the account was opened, another portion defines the account type, and the last digit is a check digit. You can guess at an account number by attempting a deposit (in person or online). There's also the fact that BofA and Wells Fargo have account numbers displayed in cleartext on pieces of paper that are handed to strangers. I'm not arguing the merits of Coinbase's security, but traditional banks don't fare well either. Coinbase can improve. Traditional banks are limited by standards that they can't change.
  - danielweber 13y ago
    I haven't personally seen the system, or tested it, but I'm pretty sure if I tried to enumerate all Bank Of America account numbers I'd get shut down pretty quick.
  - 13y ago