7 ms·

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

by beaner 13y ago

deleted 13y ago
[deleted]
Zigurd 13y ago
That sounds innocuous. But it's easy for, say, mobile badware to harvest contact lists. By targeting non-anonymous bitcoin holders as a "seed" list and using exposed contact lists like LinkedIn contacts, you can ratchet your way up into disclosing a lot of people who would prefer not to be known, lest the become phishing targets. Doesn't seem innocuous. Maybe coinbase ought to be making pseudonymity more easily accessible.
djf1 13y ago
It gives the full name associated with an email address. A more dramatic but analogous situation would be if an attacker were able to attain password info or credit card info associated with an email address. Just because email address is known does not imply that other personal information should be given away.
- loumf 13y ago
  Does it leak the fact that you have a coinbase account? That seems private as well.
  - onewaystreet 13y ago
    If someone has your email address it is impossible for coinbase or any service to stop that person from checking if you have an account. All they have to do it try registering a new account with your address and see if it lets them (as most services don't allow multiple accounts to use the same email address).
    - fcp 13y ago
      It doesn't need to be impossible. The problem could be designed away: on form submission send an email saying 'looks like you already have an account' or 'welcome... next steps' and just show a 'check your email' message in the browser.
bushido 13y ago
Since Coinbase is a financial-esque firm that deals with and stores peoples money/BTC it is not at all alright for this to be treated as public information, even if someone already had the email address. I know CB is not a financial company and they are not obligated to provide the same protections to consumers/customers. Phishing is not the only reason why a customer would not like their bank to confirm that they have an account. As a matter of fact in this situation, when someone sends a fund request, CB should never let the requesting party know the name of the account holder, unless the account holder explicitly gives them permission, maybe not even then. With any other organization law enforcement would require a warrant to get basic confirmation if a customer has an account and the name on the account.
mpyne 13y ago
It does confirm email addresses you can guess though (which are not necessarily email addresses you have, until they're confirmed), along with leaking other information about that user.
- tptacek 13y ago
  What other information is it leaking?
  - danielweber 13y ago
    From what I gather, first name and last name. Stopping email address validation is, I think, impossible for a company like Coinbase, but revealing the name doesn't have to happen. On the other hand, providing the first and last name could be very valuable to the users, though. If I send coins to bob@example.com, I'd like to see the real name behind that address. On the other other hand, if anyone can make any first and last name they wish, then the safety of that goes away. Maybe I make b0b@example.com with the same real name. EDIT The users agreed to have their names given to people they transact with. Does that include strangers attempting to transact with them? I'm thinking "no" but can see the other side.
    - KMag 13y ago
      If you want a service that allows the sender to verify name before sending, make it a feature that both: (1) is opt-in on the recipient's side and fails with something like "that recipient email address doesn't have an account, the name doesn't match, or they haven't decided to allow name verification" AND (2) is only available on payments above your highest guess at the expected value of matching an account-email-name triple for spearphishing, and the error messages (and timings) are identical if the name doesn't match or the given email address doesn't have an account. I imagine there are few profitable attacks where an answer "yes, email_address with name has a Coinbase account" costs a minimum of 100 USD to an attacker and getting an answer "Either email_address doesn't have an account, that name doesn't match our records, or they've chosen not to share their name" costs 0 USD. However, I'd have to think a bit more about that 100 USD minimum.
goatforce5 13y ago
I work on dating sites, some of them a bit risqué. On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".
- MichaelGG 13y ago
  Do you setup a timed sleep to make sure that you return results in exactly the same time regardless of path taken?
  - broolstoryco 13y ago
    Not sure if sarcasm..
    - nfm 13y ago
      This is a real attack vector. It's called a timing attack: http://en.wikipedia.org/wiki/Timing_attack http://en.wikipedia.org/wiki/Timing_attack
      - broolstoryco 13y ago
        I am familiar with timing attacks. The thought of someone attempting to apply it over the internet to verify whether an email is registered on a dating site seems laughable.
        MichaelGG 13y ago
        Applying it over the Internet is quite feasible, especially with simple code. If it connects to a remote SMTP server, the delay may very well be noticeable enough without doing any complicated timing. It might be just about as easy as scraping the page for "user not found" versus "email sent". I assume that was the original point - that on risque dating sites, the recover password system tries to hide membership.
  - 13y ago
Allower 13y ago
I think you meant to say : "This is the bullshit excuse they are trying to use to make it SEEM like its not a vulnerability." Coinbase is deliberately misleading their users regarding privacy if they do not fix this issue!

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

by beaner 13y ago

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

deleted 13y ago

[deleted]

Zigurd 13y ago

That sounds innocuous. But it's easy for, say, mobile badware to harvest contact lists. By targeting non-anonymous bitcoin holders as a "seed" list and using exposed contact lists like LinkedIn contacts, you can ratchet your way up into disclosing a lot of people who would prefer not to be known, lest the become phishing targets. Doesn't seem innocuous. Maybe coinbase ought to be making pseudonymity more easily accessible.

djf1 13y ago

It gives the full name associated with an email address. A more dramatic but analogous situation would be if an attacker were able to attain password info or credit card info associated with an email address. Just because email address is known does not imply that other personal information should be given away.

loumf 13y ago
Does it leak the fact that you have a coinbase account? That seems private as well.
- onewaystreet 13y ago
  If someone has your email address it is impossible for coinbase or any service to stop that person from checking if you have an account. All they have to do it try registering a new account with your address and see if it lets them (as most services don't allow multiple accounts to use the same email address).
  - fcp 13y ago
    It doesn't need to be impossible. The problem could be designed away: on form submission send an email saying 'looks like you already have an account' or 'welcome... next steps' and just show a 'check your email' message in the browser.

bushido 13y ago

Since Coinbase is a financial-esque firm that deals with and stores peoples money/BTC it is not at all alright for this to be treated as public information, even if someone already had the email address. I know CB is not a financial company and they are not obligated to provide the same protections to consumers/customers. Phishing is not the only reason why a customer would not like their bank to confirm that they have an account. As a matter of fact in this situation, when someone sends a fund request, CB should never let the requesting party know the name of the account holder, unless the account holder explicitly gives them permission, maybe not even then. With any other organization law enforcement would require a warrant to get basic confirmation if a customer has an account and the name on the account.

mpyne 13y ago

It does confirm email addresses you can guess though (which are not necessarily email addresses you have, until they're confirmed), along with leaking other information about that user.

tptacek 13y ago
What other information is it leaking?
- danielweber 13y ago
  From what I gather, first name and last name. Stopping email address validation is, I think, impossible for a company like Coinbase, but revealing the name doesn't have to happen. On the other hand, providing the first and last name could be very valuable to the users, though. If I send coins to bob@example.com, I'd like to see the real name behind that address. On the other other hand, if anyone can make any first and last name they wish, then the safety of that goes away. Maybe I make b0b@example.com with the same real name. EDIT The users agreed to have their names given to people they transact with. Does that include strangers attempting to transact with them? I'm thinking "no" but can see the other side.
  - KMag 13y ago
    If you want a service that allows the sender to verify name before sending, make it a feature that both: (1) is opt-in on the recipient's side and fails with something like "that recipient email address doesn't have an account, the name doesn't match, or they haven't decided to allow name verification" AND (2) is only available on payments above your highest guess at the expected value of matching an account-email-name triple for spearphishing, and the error messages (and timings) are identical if the name doesn't match or the given email address doesn't have an account. I imagine there are few profitable attacks where an answer "yes, email_address with name has a Coinbase account" costs a minimum of 100 USD to an attacker and getting an answer "Either email_address doesn't have an account, that name doesn't match our records, or they've chosen not to share their name" costs 0 USD. However, I'd have to think a bit more about that 100 USD minimum.

goatforce5 13y ago

I work on dating sites, some of them a bit risqué. On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".

MichaelGG 13y ago
Do you setup a timed sleep to make sure that you return results in exactly the same time regardless of path taken?
- broolstoryco 13y ago
  Not sure if sarcasm..
  - nfm 13y ago
    This is a real attack vector. It's called a timing attack: http://en.wikipedia.org/wiki/Timing_attack http://en.wikipedia.org/wiki/Timing_attack
    - broolstoryco 13y ago
      I am familiar with timing attacks. The thought of someone attempting to apply it over the internet to verify whether an email is registered on a dating site seems laughable.
      - MichaelGG 13y ago
        Applying it over the Internet is quite feasible, especially with simple code. If it connects to a remote SMTP server, the delay may very well be noticeable enough without doing any complicated timing. It might be just about as easy as scraping the page for "user not found" versus "email sent". I assume that was the original point - that on risque dating sites, the recover password system tries to hide membership.
- 13y ago

Allower 13y ago

I think you meant to say : "This is the bullshit excuse they are trying to use to make it SEEM like its not a vulnerability." Coinbase is deliberately misleading their users regarding privacy if they do not fix this issue!