3 ms·
Rate limiting Do we have to spell it out to them?
by revelation 13y ago
Rate limiting
Do we have to spell it out to them?
- relate 13y agoFrom the text: "For example, we employ rate limits around sensitive actions, such as requesting money, to prevent them from being abused at scale."
- sillysaurus3 13y agoThey don't appear to be rate limiting their API that allows enumeration of first and last names. Also, We’d also like to address the claim of a “leaked” list of Coinbase emails and user names. This list (the size of which is less than one half of one percent of Coinbase users) was not the result of a data breach at Coinbase. There are 2,040 names on the leaked list. Fun fact: that means there are about 408,000 Coinbase users total.
- MichaelGG 13y agoThe list duplicates every entry, probably another silly tactic by the "attacker" to fluff up his feathers.
- sillysaurus3 13y agoI wonder if that means there are around 200,000 Coinbase users? Depends whether they noticed the dupes. Good catch.
- trevorcreech 13y agoActually over a million: http://blog.coinbase.com/post/78016535692/a-major-coinbase-milestone-1-million-consumer-wallets http://blog.coinbase.com/post/78016535692/a-major-coinbase-m...
- sillysaurus3 13y agoThat's wallets, not users. That press release was impressive, and I've always wondered how many users they actually had. I didn't expect to find out through a security blog post, but it's fun to know.
- ztratar 13y agoUp this comment goes! Why are they not addressing it? I'm confused.
- FredEE 13y agoWe are pushing some changes to rate limiting - this wasn't clear in the original post and I just edited. Thanks for the heads up.
- korzun 13y agoSo why are you blowing this off and now all of a sudden writing rate limiting? The only reason he got 1000+ emails is because you guys messed up. Not even going into the whole idea of you releasing that end point with name leakage without somebody going 'oh hey.. do we have rate limiting?'. Mistakes like this are signs of amateur hour.
- MichaelGG 13y agoSuppose they limit it to 100 emails before blocking your account. The guy can just sign up with 10 accounts. Or 5. This "attacker" would still post it and make a big fuss. Most likely they're implementing rate-limiting to appease people and prevent an ongoing spam issue. Or perhaps it was on their list for a while and just hasn't been an issue until now.
- korzun 13y agoIn regards to rate limiting, it would be a much smaller number prior to block. If it's IP based at let's say 10 over X attacker would have to lease 100 IP's. In any case, rate limiting is the quickest mitigation prior to actual fix of the data leak in question.
- oijaf888 13y agoGiven it's easily parallelizable, assuming the cost of enumeration is significantly lower than other methods and the value of the data is high enough, how does that actually solve anything? All it does is requires someone to rent time on botnets or similar which doesn't seem like it would raise the cost a huge amount at scale.
- jamesbrownuhh 13y agoAlready a largely solved problem. If you try enumerating email addresses by running through queries at Hotmail or Yahoo, for example, they'll shut the doors on you in a matter of seconds. Think you can just use thousands of IPs instead? Go for it - they trust 'new' and rarely-seen IP addresses even less, and bring up the shutters all the faster. It's not a new problem, and there's lots of best practice to learn from, for anyone who wants to do it right.
- baddox 13y agoIs it possible that they simply have a more generous rate limit than what you think they should have?