4 ms·

As mentioned in the blog post, payment services also commonly allow user enumeration, including Paypal, Venmo, Square Cash, and others. The reason you don't se

As mentioned in the blog post, payment services also commonly allow user enumeration, including Paypal, Venmo, Square Cash, and others. The reason you don't see it with banks is that they don't allow you to send money to an email address.

waterside81 13y ago
Maybe in the US they don't, but in Canada you can. I'm quite sure in most of Europe & Australia you can as well.
- patmcc 13y ago
  Interac e-Transfers (the only widely used method for doing this I'm aware of) do let you send money to someone via an email address, but it's a notification channel, nothing more. An account enumeration isn't possible with it, the actual email is sent some time after the money for the transfer has left the source account, and the sender doesn't get any information about the delivery of the email. I suppose you could send e-Transfers to random email addresses and then see if any are accepted, but that would cost you an absolute minimum of $0.01 per attempt and would probably have a terrible response rate. Source: this is my day job. Edit: sorry, forgot to mention this is Canada-specific.
- jgani 13y ago
  You can't in Australia Source: I live in Australia
dzlobin 13y ago
I don't know about the other large US banks, but Chase definitely does and has been for years.
dobbsbob 13y ago
Those systems are insured, and a lot more effort to steal and clean funds. Bitcoin is one stop fraud: get the coins and you're good to go. Don't need a drop to ship electronics, don't need proxies or remote desktop IPs to fool paypal/stripe fraud filters. If I were a criminal blackhat would be nice to have user enumeration to confirm names on Coinbase so I could send personalized wallet stealing emails pretending to be from Coinbase.
bushido 13y ago
Respectfully, could you list a couple of benefits of enumerating a user's name if someone is requesting funds that outweigh the risk even in the slightest? The question is not for sending money but receiving or requesting money. I personally can't think of a single benefit to getting this information at time of requesting funds. As a matter of fact, if the name was enumerated when sending money that would to some (very small) degree be acceptable as the sender stood to have a financial loss. edit: grammar

waterside81 13y ago

Maybe in the US they don't, but in Canada you can. I'm quite sure in most of Europe & Australia you can as well.

patmcc 13y ago
Interac e-Transfers (the only widely used method for doing this I'm aware of) do let you send money to someone via an email address, but it's a notification channel, nothing more. An account enumeration isn't possible with it, the actual email is sent some time after the money for the transfer has left the source account, and the sender doesn't get any information about the delivery of the email. I suppose you could send e-Transfers to random email addresses and then see if any are accepted, but that would cost you an absolute minimum of $0.01 per attempt and would probably have a terrible response rate. Source: this is my day job. Edit: sorry, forgot to mention this is Canada-specific.
jgani 13y ago
You can't in Australia Source: I live in Australia

dzlobin 13y ago

I don't know about the other large US banks, but Chase definitely does and has been for years.

dobbsbob 13y ago

Those systems are insured, and a lot more effort to steal and clean funds. Bitcoin is one stop fraud: get the coins and you're good to go. Don't need a drop to ship electronics, don't need proxies or remote desktop IPs to fool paypal/stripe fraud filters. If I were a criminal blackhat would be nice to have user enumeration to confirm names on Coinbase so I could send personalized wallet stealing emails pretending to be from Coinbase.

bushido 13y ago

Respectfully, could you list a couple of benefits of enumerating a user's name if someone is requesting funds that outweigh the risk even in the slightest? The question is not for sending money but receiving or requesting money. I personally can't think of a single benefit to getting this information at time of requesting funds. As a matter of fact, if the name was enumerated when sending money that would to some (very small) degree be acceptable as the sender stood to have a financial loss. edit: grammar