3 ms·

How do you know it was an attempt of misleading and not a simple parsing or sorting/fitlering issue in bash or whatever he used to get emails? Maybe the file w

by korzun 13y ago

How do you know it was an attempt of misleading and not a simple parsing or sorting/fitlering issue in bash or whatever he used to get emails? Maybe the file was written to via different threads using cross linked dictionary? Do you know? No, you are speculating someone would double the size of a list as if nobody would ever figure that one out. The bug that was filled was not even open for weeks. Again you are speculating without any facts. http://blog.shubh.am/full-disclosure-coinbase-security/ http://blog.shubh.am/full-disclosure-coinbase-security/ You are comparing 'vulnerability' of a service meant for people to connect and find each other to a service that handles millions of dollars of users money. Ridiculous.

downandout 13y ago
>You are comparing 'vulnerability' of a service meant for people to connect and find each other to a service that handles millions of dollars of users money. Ridiculous. So you are saying that this somehow endangered customer funds?
smtddr 13y ago
You're the one being ridiculous. - There was no email leak from Coinbase. The source of the email list used against the API is unknown at this time. - Someone who's savvy enough to call an an API in a multi-threaded fashion but doesn't know how to: cat email_list.txt | sort | uniq ? meh, unlikely. - User enumeration hardly equals a vulnerability and the name you put on the account doesn't have to be your real name. I have "SMTDDR" on it. All you'd get is "SMTDDR". Really, this is some kind of political-mud-slinging at Coinbase. Wake me up when you can pull my banking info or transfer my coins out of my account.
- korzun 13y ago
  They leaked accounts that are legit, who cares about the source when Coinbase confirmed that this instance with some random unknown list 'only' impacted 1000+ users. Sure, but they could also not care if there are duplicates. You don't need to polish your list output for a proof of concept code, whatever he needed to prove was proven. It's not a vulnerability, it's data leakage. Sure you put a wrong name in, most people did not. And it's not the name that's a concern it's leakage of email addresses that would be prime target for savvy hackers who want bitcoins. If you could run random addresses against an API offered by a vendor that sells safes for high value valuables and get a match which houses have those safes you become a target. Sure most people won't try to break in, but those are are in business of doing so will try.

by korzun 13y ago

downandout 13y ago

>You are comparing 'vulnerability' of a service meant for people to connect and find each other to a service that handles millions of dollars of users money. Ridiculous. So you are saying that this somehow endangered customer funds?

smtddr 13y ago

You're the one being ridiculous. - There was no email leak from Coinbase. The source of the email list used against the API is unknown at this time. - Someone who's savvy enough to call an an API in a multi-threaded fashion but doesn't know how to: cat email_list.txt | sort | uniq ? meh, unlikely. - User enumeration hardly equals a vulnerability and the name you put on the account doesn't have to be your real name. I have "SMTDDR" on it. All you'd get is "SMTDDR". Really, this is some kind of political-mud-slinging at Coinbase. Wake me up when you can pull my banking info or transfer my coins out of my account.

korzun 13y ago
They leaked accounts that are legit, who cares about the source when Coinbase confirmed that this instance with some random unknown list 'only' impacted 1000+ users. Sure, but they could also not care if there are duplicates. You don't need to polish your list output for a proof of concept code, whatever he needed to prove was proven. It's not a vulnerability, it's data leakage. Sure you put a wrong name in, most people did not. And it's not the name that's a concern it's leakage of email addresses that would be prime target for savvy hackers who want bitcoins. If you could run random addresses against an API offered by a vendor that sells safes for high value valuables and get a match which houses have those safes you become a target. Sure most people won't try to break in, but those are are in business of doing so will try.