6 ms·

You’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site. And yet, most banks & payment processor

by zorpner 13y ago

You’ll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site. And yet, most banks & payment processors do not do this, for good reason. Seems like Coinbase is suffering from some domain confusion.

barmstrong 13y ago
As mentioned in the blog post, payment services also commonly allow user enumeration, including Paypal, Venmo, Square Cash, and others. The reason you don't see it with banks is that they don't allow you to send money to an email address.
- waterside81 13y ago
  Maybe in the US they don't, but in Canada you can. I'm quite sure in most of Europe & Australia you can as well.
  - patmcc 13y ago
    Interac e-Transfers (the only widely used method for doing this I'm aware of) do let you send money to someone via an email address, but it's a notification channel, nothing more. An account enumeration isn't possible with it, the actual email is sent some time after the money for the transfer has left the source account, and the sender doesn't get any information about the delivery of the email. I suppose you could send e-Transfers to random email addresses and then see if any are accepted, but that would cost you an absolute minimum of $0.01 per attempt and would probably have a terrible response rate. Source: this is my day job. Edit: sorry, forgot to mention this is Canada-specific.
  - jgani 13y ago
    You can't in Australia Source: I live in Australia
- dzlobin 13y ago
  I don't know about the other large US banks, but Chase definitely does and has been for years.
- dobbsbob 13y ago
  Those systems are insured, and a lot more effort to steal and clean funds. Bitcoin is one stop fraud: get the coins and you're good to go. Don't need a drop to ship electronics, don't need proxies or remote desktop IPs to fool paypal/stripe fraud filters. If I were a criminal blackhat would be nice to have user enumeration to confirm names on Coinbase so I could send personalized wallet stealing emails pretending to be from Coinbase.
- bushido 13y ago
  Respectfully, could you list a couple of benefits of enumerating a user's name if someone is requesting funds that outweigh the risk even in the slightest? The question is not for sending money but receiving or requesting money. I personally can't think of a single benefit to getting this information at time of requesting funds. As a matter of fact, if the name was enumerated when sending money that would to some (very small) degree be acceptable as the sender stood to have a financial loss. edit: grammar
achille 13y ago
You conveniently left out their next sentence "... many leading payment services allow user enumeration, including Paypal, Venmo, Square Cash, and many others..."
- zorpner 13y ago
  Because I was talking about banks & processors, not payment services. Paypal will cut you off hard if you attempt to bulk enumerate users/businesses by e-mail address, so this is even more disingenuous on the part of Coinbase.
  - megatron7 13y ago
    There's only one explanation for why you can't get service for problems unless you're featured on reddit, why they don't care about security, and why they're flagrantly dishonest in their comparisons: because they don't respect us, at all.
    - ericd 13y ago
      Or they're a tiny company trying to push in all areas at the same time, and they have to prioritize, and sometimes things they'd want to do fall through the cracks or they just haven't had a chance to do them yet. If you've ever been at a small company, you know that this is the much more likely scenario. Requiring them to have already implemented all of the security measures of Paypal, which has been around for more than a decade and is orders of magnitude larger than them, is sort of ridiculous. If you don't trust them to hold on to your coins, use them purely an exchange and then pull them off onto an offline wallet.
      - megatron7 13y ago
        Being small does not explain total customer service failure, the lack of daily reconciliation reports (which would spot things like $x0,000 deposits that weren't tied to a purchase), or the dishonesty about the ability to enumerate emails on other payment platforms without getting banned. That said, this is HN, so I'm already banned for saying something very slightly critical of a YC company, even though that company is fucking up hard.
MBCook 13y ago
'We didn't do anything wrong, this isn't a bug, nothing to see here.' despite obvious evidence to the contrary. Very confidence inducing.
- doktrin 13y ago
  For those of us getting caught up on these events - what evidence are you referring to? So far I've seen : 1) A list of email addresses on pastebin, accompanied by a surreal claim of daily FBI & IRS data transfers and gag orders 2) Homakov's email to whitehat@ concerning a potential iframe vuln What am I missing?
  - genwin 13y ago
    If I'm reading correctly: Coinbase provided confirmation that the email addresses on pastebin are Coinbase customers, and also provided the associated names. Coinbase doesn't think that's a serious issue.
    - deleted 13y ago
      [deleted]
  - MBCook 13y ago
    They were given a bug report with three issues: 1) It's possible to determine if someone has a Coinbase account (no rate limit) 2) It's possible to find out someone's name if they have a Coinbase account (no rate limit) 3) Coinbase can be used to spam people through unsolicited messages (no rate limit). Their response basically equates to "so what, nothing's wrong". They ignored the initial reports and marked the bug as won't fix. Someone used this vulnerability to pull a bunch of example addresses and their response is "so what, nothing's wrong, probably wasn't us". But these are three serious issues. 1) Why should anyone be able to figure this out without being a registered application? This is especially true given #3. And the lack of rate limiting is just irresponsible. 2) Why should anyone be able to ask Coinbase what my name is? Even if they allowed that, why can you do it without being a registered user of their API? Again, the lack of rate limiting is also irresponsible. 3) I understand it's purposeful that they'll treat anyone as having an account for the purposes of on boarding, that make sense. But the ability to send emails to anyone on the internet without risking my reputation is asking for trouble. Again, this should be heavily rate limited unless you've registered with them. Anyone can sign up for an Amazon SES account, but you have to go through a few hoops before you can start sending out 500 messages a second. These statements read like Baghdad Bob to me. We don't agree, nothing is wrong, go about your business as if nothing had happened. If their initial response was "that's all correct, we're looking into rate limiting and maybe requiring you to register to make API calls" that would have been the end of it. If I want to send money to someone, I should call Coinbase and they should send the request. The response to me should be "sent" or "error". Imagine if whenever I paid a bill with my credit card the return was not just "success" or "failure" but "success", "current balance", and "mother's maiden name". Disclosing that extra information is totally unnecessary.
kenrikm 13y ago
"It’s clear there was no data breach because no other user information is provided." That strikes me as an assumption. There's no way for them to know that there was no breach based off of the fact that no other information was provided. There are other ways to know that you were not breached, this one comes across as a very weak / naive reason.
- meowface 13y ago
  Even if certain users were in fact somehow phished or deceived by this, it would be a stretch to say that is a "breach". Regardless, I do think Coinbase should try to prevent user enumeration.
tptacek 13y ago
It is not my experience that financial services companies are substantially better than startups on cosmetic security issues like username enumeration.
- akerl_ 13y ago
  Very true, but if my social sharing website has a username disclosure, it's generally a feature. If my bank does this, it is, as you note, a security issue. Not the worst possible security issue, but still definitely not a feature.
- slg 13y ago
  Some financial services are even worse. One of the largest banks/brokerage sites truncates passwords at 8 characters without notifying the user. It is possible for the user to save their password as "password104n35dsu348a21p9sdj28x". They might feel pretty safe with the length, (pseudo) randomness, and complexity of that password, but someone would be able to log into their account by simply entering "password". However, the big differentiating factor between startups and financial service companies is the faith in them "making it right" when something does go wrong. At this point, we have little reason to believe that one huge security issue won't simply kill a startup like Coinbase and leave all of its account holders out in the cold. It seems pretty safe to say that wouldn't happen with any major bank in the US.

by zorpner 13y ago

barmstrong 13y ago

As mentioned in the blog post, payment services also commonly allow user enumeration, including Paypal, Venmo, Square Cash, and others. The reason you don't see it with banks is that they don't allow you to send money to an email address.

waterside81 13y ago
Maybe in the US they don't, but in Canada you can. I'm quite sure in most of Europe & Australia you can as well.
- patmcc 13y ago
  Interac e-Transfers (the only widely used method for doing this I'm aware of) do let you send money to someone via an email address, but it's a notification channel, nothing more. An account enumeration isn't possible with it, the actual email is sent some time after the money for the transfer has left the source account, and the sender doesn't get any information about the delivery of the email. I suppose you could send e-Transfers to random email addresses and then see if any are accepted, but that would cost you an absolute minimum of $0.01 per attempt and would probably have a terrible response rate. Source: this is my day job. Edit: sorry, forgot to mention this is Canada-specific.
- jgani 13y ago
  You can't in Australia Source: I live in Australia
dzlobin 13y ago
I don't know about the other large US banks, but Chase definitely does and has been for years.
dobbsbob 13y ago
Those systems are insured, and a lot more effort to steal and clean funds. Bitcoin is one stop fraud: get the coins and you're good to go. Don't need a drop to ship electronics, don't need proxies or remote desktop IPs to fool paypal/stripe fraud filters. If I were a criminal blackhat would be nice to have user enumeration to confirm names on Coinbase so I could send personalized wallet stealing emails pretending to be from Coinbase.
bushido 13y ago
Respectfully, could you list a couple of benefits of enumerating a user's name if someone is requesting funds that outweigh the risk even in the slightest? The question is not for sending money but receiving or requesting money. I personally can't think of a single benefit to getting this information at time of requesting funds. As a matter of fact, if the name was enumerated when sending money that would to some (very small) degree be acceptable as the sender stood to have a financial loss. edit: grammar

achille 13y ago

You conveniently left out their next sentence "... many leading payment services allow user enumeration, including Paypal, Venmo, Square Cash, and many others..."

zorpner 13y ago
Because I was talking about banks & processors, not payment services. Paypal will cut you off hard if you attempt to bulk enumerate users/businesses by e-mail address, so this is even more disingenuous on the part of Coinbase.
- megatron7 13y ago
  There's only one explanation for why you can't get service for problems unless you're featured on reddit, why they don't care about security, and why they're flagrantly dishonest in their comparisons: because they don't respect us, at all.
  - ericd 13y ago
    Or they're a tiny company trying to push in all areas at the same time, and they have to prioritize, and sometimes things they'd want to do fall through the cracks or they just haven't had a chance to do them yet. If you've ever been at a small company, you know that this is the much more likely scenario. Requiring them to have already implemented all of the security measures of Paypal, which has been around for more than a decade and is orders of magnitude larger than them, is sort of ridiculous. If you don't trust them to hold on to your coins, use them purely an exchange and then pull them off onto an offline wallet.
    - megatron7 13y ago
      Being small does not explain total customer service failure, the lack of daily reconciliation reports (which would spot things like $x0,000 deposits that weren't tied to a purchase), or the dishonesty about the ability to enumerate emails on other payment platforms without getting banned. That said, this is HN, so I'm already banned for saying something very slightly critical of a YC company, even though that company is fucking up hard.

MBCook 13y ago

'We didn't do anything wrong, this isn't a bug, nothing to see here.' despite obvious evidence to the contrary. Very confidence inducing.

doktrin 13y ago
For those of us getting caught up on these events - what evidence are you referring to? So far I've seen : 1) A list of email addresses on pastebin, accompanied by a surreal claim of daily FBI & IRS data transfers and gag orders 2) Homakov's email to whitehat@ concerning a potential iframe vuln What am I missing?
- genwin 13y ago
  If I'm reading correctly: Coinbase provided confirmation that the email addresses on pastebin are Coinbase customers, and also provided the associated names. Coinbase doesn't think that's a serious issue.
  - deleted 13y ago
    [deleted]
- MBCook 13y ago
  They were given a bug report with three issues: 1) It's possible to determine if someone has a Coinbase account (no rate limit) 2) It's possible to find out someone's name if they have a Coinbase account (no rate limit) 3) Coinbase can be used to spam people through unsolicited messages (no rate limit). Their response basically equates to "so what, nothing's wrong". They ignored the initial reports and marked the bug as won't fix. Someone used this vulnerability to pull a bunch of example addresses and their response is "so what, nothing's wrong, probably wasn't us". But these are three serious issues. 1) Why should anyone be able to figure this out without being a registered application? This is especially true given #3. And the lack of rate limiting is just irresponsible. 2) Why should anyone be able to ask Coinbase what my name is? Even if they allowed that, why can you do it without being a registered user of their API? Again, the lack of rate limiting is also irresponsible. 3) I understand it's purposeful that they'll treat anyone as having an account for the purposes of on boarding, that make sense. But the ability to send emails to anyone on the internet without risking my reputation is asking for trouble. Again, this should be heavily rate limited unless you've registered with them. Anyone can sign up for an Amazon SES account, but you have to go through a few hoops before you can start sending out 500 messages a second. These statements read like Baghdad Bob to me. We don't agree, nothing is wrong, go about your business as if nothing had happened. If their initial response was "that's all correct, we're looking into rate limiting and maybe requiring you to register to make API calls" that would have been the end of it. If I want to send money to someone, I should call Coinbase and they should send the request. The response to me should be "sent" or "error". Imagine if whenever I paid a bill with my credit card the return was not just "success" or "failure" but "success", "current balance", and "mother's maiden name". Disclosing that extra information is totally unnecessary.

kenrikm 13y ago

"It’s clear there was no data breach because no other user information is provided." That strikes me as an assumption. There's no way for them to know that there was no breach based off of the fact that no other information was provided. There are other ways to know that you were not breached, this one comes across as a very weak / naive reason.

meowface 13y ago
Even if certain users were in fact somehow phished or deceived by this, it would be a stretch to say that is a "breach". Regardless, I do think Coinbase should try to prevent user enumeration.

tptacek 13y ago

It is not my experience that financial services companies are substantially better than startups on cosmetic security issues like username enumeration.

akerl_ 13y ago
Very true, but if my social sharing website has a username disclosure, it's generally a feature. If my bank does this, it is, as you note, a security issue. Not the worst possible security issue, but still definitely not a feature.
slg 13y ago
Some financial services are even worse. One of the largest banks/brokerage sites truncates passwords at 8 characters without notifying the user. It is possible for the user to save their password as "password104n35dsu348a21p9sdj28x". They might feel pretty safe with the length, (pseudo) randomness, and complexity of that password, but someone would be able to log into their account by simply entering "password". However, the big differentiating factor between startups and financial service companies is the faith in them "making it right" when something does go wrong. At this point, we have little reason to believe that one huge security issue won't simply kill a startup like Coinbase and leave all of its account holders out in the cold. It seems pretty safe to say that wouldn't happen with any major bank in the US.