3 ms·
If Coinbase can't admit any amount of fault whatsoever for enabling the large-scale harvesting of their customer list, I'm sorry, but I've lost faith in their s
by wes-exp 13y ago
If Coinbase can't admit any amount of fault whatsoever for enabling the large-scale harvesting of their customer list, I'm sorry, but I've lost faith in their security.
This is a service that stores digital cash. It should be like an online Fort Knox, not "safe as Facebook" like that's some kind of high bar.
- deleted 13y ago[deleted]
- jypepin 13y agothey say the list is less than 0.5% of their total user base. Not sure if you can call this "large-scale".
- wes-exp 13y agoI agree that 1000+ people may not be "large-scale" depending on how we define it, but I do see it as a proof of concept that Coinbase permits large-scale user enumeration. (Not that it has necessarily happened yet)
- jypepin 13y agoYea ok, I got your point :) Now we just need to make sure the data came from coinbase directly, which they refute. They say data comes from other services - mostly bitcoin related ones.
- tptacek 13y agoIf you read the post even a little bit carefully, they refute the idea that this was a harvesting of their database. One compelling bit of evidence they present is that the list is tiny, and their customer list is very large. It's not just that this isn't a "large scale" leak; it's that they say it's not a leak at all; that this data was made available through some other combination of services that exposed it, not Coinbase. They don't provide any additional evidence (but few companies would) --- but it's a plausible argument.
- wes-exp 13y agoCoinbase's tone at https://hackerone.com/reports/5200 https://hackerone.com/reports/5200 convinces me that they just don't care about user account enumeration. Combined with the blog post, my sense is that Coinbase does not deny that systematic enumeration is possible; rather, they deny that we should worry about it. ("it's not a bug, it's a feature")
- tptacek 13y agoI don't know if they do or don't, but I wouldn't be surprised either way, because I sure don't care about user account enumeration. We doc it, but I'm always embarrassed when we do.
- zaidf 13y agothis data was made available through some other combination of services that exposed it, not Coinbase That assumes the acknowledgement of whether a given email address is a member or not is not data in itself. That is arguable. For example, I know that in healthcare, merely confirming whether someone is a patient of yours is a violation. But I agree with the larger point that the original disclosure is overblown.