4 ms·

Update - blog post here: http://blog.coinbase.com/post/81407694500/update-on-coinbase-data-security http://blog.coinbase.com/post/81407694500/update-on-coinbase

by FredEE 13y ago

Update - blog post here: http://blog.coinbase.com/post/81407694500/update-on-coinbase-data-security http://blog.coinbase.com/post/81407694500/update-on-coinbase...

chazandchaz 13y ago
"You’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site." I love this. Look these silly free social sites do it, so it must be ok. Anyone know if BofA or WellsFargo allow user enumeration?
- bushido 13y ago
  > Anyone know if BofA or WellsFargo allow user enumeration You're correct. They don't. Not even to authorities without a warrant. Which is the point I was trying to make in my earlier comment.[0] [0] https://news.ycombinator.com/item?id=7510524 https://news.ycombinator.com/item?id=7510524
- trollfighter 13y ago
  BofA and Wells Fargo suffer from account number enumeration. Wells Fargo has 10-11 digit (depending on if it's WF or previously Wachovia) account numbers. One portion defines the bank branch where the account was opened, another portion defines the account type, and the last digit is a check digit. You can guess at an account number by attempting a deposit (in person or online). There's also the fact that BofA and Wells Fargo have account numbers displayed in cleartext on pieces of paper that are handed to strangers. I'm not arguing the merits of Coinbase's security, but traditional banks don't fare well either. Coinbase can improve. Traditional banks are limited by standards that they can't change.
  - danielweber 13y ago
    I haven't personally seen the system, or tested it, but I'm pretty sure if I tried to enumerate all Bank Of America account numbers I'd get shut down pretty quick.
  - matiasb 13y ago
    Two months ago I was able to enumerate all accounts from a local bank (Paraguay), they used document number and numeric passwords for login. They were showing different error messages when you tried to login with a nonexistent ID. So I started generating random numbers between common document number ranges (1000000-4000000). Our public health system has a web app that lets you check your enrollment status by entering an document #, and there are no CAPTCHAs! So the attack was like this: generate a random document number, send a request to the public health app and get the target's info (name, date of enrollment and other info). The most interesting thing was that I tried to login into all accounts by using the birth date of the target as a password (the bank's password policy: just numbers, a min. of 6 numbers...). Around 40% of the clients were vulnerable.
    - tripzilch 13y ago
      isn't this roughly the sort of thing that got weev thrown in jail?
      - matiasb 13y ago
        Yes, probably. I have communicated the public health app problem (actually they just need to put a CAPTCHA) many times but it seems that nobody cares. About the bank, I was working as a data science consultant at that time, so it was easy for me to knock the door of the security department and tell them about my attack.
dsl 13y ago
Your customers are upset and losing faith. Stop trying to defend yourself and take action.
- hkphooey 13y ago
  I remember a story here a few months ago about a person who had deposited tens of thousands of dollars with Coinbase, and they refused to give the customer his coins. That was a clear sign that the systems and processes at Coinbase were broken. The fact that they didn't help the customer until they took their grievances public indicated to me that either Coinbase don't care about their customers, or they were too busy trying to balance their books because of some proprietary trading gone wrong. Thus I think it was foolish of Coinbase to release the letter condemning MtGox. Now anything that happens to Coinbase makes them look like total hypocrites. People, glass houses, stones etc. It's one thing for a magic card trading company to morph into a Bitcoin exchange and have problems... but for a hot-shot start-up in San Francisco with self-proclaimed tech superstars at the helm and millions in the bank to screw up royally, well, it's just embarrassing.
hkphooey 13y ago
UPDATE: For anybody following Bitcoin news, this is obviously satire, replacing MtGox with CoinBase. Surprised people downvoted this. There are rumors that a joint statement will be released at 5PM Pacific Time... Joint Statement Regarding CoinBase Apr 1st, 2014 The purpose of this document is to summarize a joint statement to the Bitcoin community regarding CoinBase. This tragic violation of the trust of users of CoinBase was the result of one company’s actions and does not reflect the resilience or value of bitcoin and the digital currency industry. There are hundreds of trustworthy and responsible companies involved in bitcoin. These companies will continue to build the future of money by making bitcoin more secure and easy to use for consumers and merchants. As with any new industry, there are certain bad actors that need to be weeded out, and that is what we are seeing today. CoinBase has confirmed its issues in private discussions with other members of the bitcoin community We are confident, however, that strong Bitcoin companies, led by highly competent teams and backed by credible investors, will continue to thrive, and to fulfill the promise that bitcoin offers as the future of payment in the Internet age. In order to re-establish the trust squandered by the failings of CoinBase, responsible bitcoin exchanges are working together and are committed to the future of bitcoin and the security of all customer funds. As part of the effort to re-assure customers, the following services will be coordinating efforts over the coming days to publicly reassure customers and the general public that all funds continue to be held in a safe and secure manner: Kraken, BitStamp, Circle, and BTC China. We strongly believe in transparent, thoughtful, and comprehensive consumer protection measures. We pledge to lead the way. Bitcoin operators, whether they be exchanges, wallet services or payment providers, play a critical custodial role over the bitcoin they hold as assets for their customers. Acting as a custodian should require a high-bar, including appropriate security safeguards that are independently audited and tested on a regular basis, adequate balance sheets and reserves as commercial entities, transparent and accountable customer disclosures, and clear policies to not use customer assets for proprietary trading or for margin loans in leveraged trading. The following industry leaders stand by this statement: Jesse Powell — CEO of Kraken Nejc Kodrič — CEO of Bitstamp.net Bobby Lee — CEO of BTC China Nicolas Cary — CEO of Blockchain.info Jeremy Allaire — CEO of Circle p.s. Yes, this is the MtGox letter... who will be the last man standing? :-)
- kbenson 13y ago

by FredEE 13y ago

Update - blog post here: http://blog.coinbase.com/post/81407694500/update-on-coinbase-data-security http://blog.coinbase.com/post/81407694500/update-on-coinbase...

chazandchaz 13y ago

"You’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site." I love this. Look these silly free social sites do it, so it must be ok. Anyone know if BofA or WellsFargo allow user enumeration?

bushido 13y ago
> Anyone know if BofA or WellsFargo allow user enumeration You're correct. They don't. Not even to authorities without a warrant. Which is the point I was trying to make in my earlier comment.[0] [0] https://news.ycombinator.com/item?id=7510524 https://news.ycombinator.com/item?id=7510524
trollfighter 13y ago
BofA and Wells Fargo suffer from account number enumeration. Wells Fargo has 10-11 digit (depending on if it's WF or previously Wachovia) account numbers. One portion defines the bank branch where the account was opened, another portion defines the account type, and the last digit is a check digit. You can guess at an account number by attempting a deposit (in person or online). There's also the fact that BofA and Wells Fargo have account numbers displayed in cleartext on pieces of paper that are handed to strangers. I'm not arguing the merits of Coinbase's security, but traditional banks don't fare well either. Coinbase can improve. Traditional banks are limited by standards that they can't change.
- danielweber 13y ago
  I haven't personally seen the system, or tested it, but I'm pretty sure if I tried to enumerate all Bank Of America account numbers I'd get shut down pretty quick.
- matiasb 13y ago
  Two months ago I was able to enumerate all accounts from a local bank (Paraguay), they used document number and numeric passwords for login. They were showing different error messages when you tried to login with a nonexistent ID. So I started generating random numbers between common document number ranges (1000000-4000000). Our public health system has a web app that lets you check your enrollment status by entering an document #, and there are no CAPTCHAs! So the attack was like this: generate a random document number, send a request to the public health app and get the target's info (name, date of enrollment and other info). The most interesting thing was that I tried to login into all accounts by using the birth date of the target as a password (the bank's password policy: just numbers, a min. of 6 numbers...). Around 40% of the clients were vulnerable.
  - tripzilch 13y ago
    isn't this roughly the sort of thing that got weev thrown in jail?
    - matiasb 13y ago
      Yes, probably. I have communicated the public health app problem (actually they just need to put a CAPTCHA) many times but it seems that nobody cares. About the bank, I was working as a data science consultant at that time, so it was easy for me to knock the door of the security department and tell them about my attack.

dsl 13y ago

Your customers are upset and losing faith. Stop trying to defend yourself and take action.

hkphooey 13y ago
I remember a story here a few months ago about a person who had deposited tens of thousands of dollars with Coinbase, and they refused to give the customer his coins. That was a clear sign that the systems and processes at Coinbase were broken. The fact that they didn't help the customer until they took their grievances public indicated to me that either Coinbase don't care about their customers, or they were too busy trying to balance their books because of some proprietary trading gone wrong. Thus I think it was foolish of Coinbase to release the letter condemning MtGox. Now anything that happens to Coinbase makes them look like total hypocrites. People, glass houses, stones etc. It's one thing for a magic card trading company to morph into a Bitcoin exchange and have problems... but for a hot-shot start-up in San Francisco with self-proclaimed tech superstars at the helm and millions in the bank to screw up royally, well, it's just embarrassing.

hkphooey 13y ago

UPDATE: For anybody following Bitcoin news, this is obviously satire, replacing MtGox with CoinBase. Surprised people downvoted this. There are rumors that a joint statement will be released at 5PM Pacific Time... Joint Statement Regarding CoinBase Apr 1st, 2014 The purpose of this document is to summarize a joint statement to the Bitcoin community regarding CoinBase. This tragic violation of the trust of users of CoinBase was the result of one company’s actions and does not reflect the resilience or value of bitcoin and the digital currency industry. There are hundreds of trustworthy and responsible companies involved in bitcoin. These companies will continue to build the future of money by making bitcoin more secure and easy to use for consumers and merchants. As with any new industry, there are certain bad actors that need to be weeded out, and that is what we are seeing today. CoinBase has confirmed its issues in private discussions with other members of the bitcoin community We are confident, however, that strong Bitcoin companies, led by highly competent teams and backed by credible investors, will continue to thrive, and to fulfill the promise that bitcoin offers as the future of payment in the Internet age. In order to re-establish the trust squandered by the failings of CoinBase, responsible bitcoin exchanges are working together and are committed to the future of bitcoin and the security of all customer funds. As part of the effort to re-assure customers, the following services will be coordinating efforts over the coming days to publicly reassure customers and the general public that all funds continue to be held in a safe and secure manner: Kraken, BitStamp, Circle, and BTC China. We strongly believe in transparent, thoughtful, and comprehensive consumer protection measures. We pledge to lead the way. Bitcoin operators, whether they be exchanges, wallet services or payment providers, play a critical custodial role over the bitcoin they hold as assets for their customers. Acting as a custodian should require a high-bar, including appropriate security safeguards that are independently audited and tested on a regular basis, adequate balance sheets and reserves as commercial entities, transparent and accountable customer disclosures, and clear policies to not use customer assets for proprietary trading or for margin loans in leveraged trading. The following industry leaders stand by this statement: Jesse Powell — CEO of Kraken Nejc Kodrič — CEO of Bitstamp.net Bobby Lee — CEO of BTC China Nicolas Cary — CEO of Blockchain.info Jeremy Allaire — CEO of Circle p.s. Yes, this is the MtGox letter... who will be the last man standing? :-)

kbenson 13y ago