3 ms·
You're the one being ridiculous. - There was no email leak from Coinbase. The source of the email list used against the API is unknown at this time. - Someone
by smtddr 13y ago
You're the one being ridiculous.
- There was no email leak from Coinbase. The source of the email list used against the API is unknown at this time.
- Someone who's savvy enough to call an an API in a multi-threaded fashion but doesn't know how to: cat email_list.txt | sort | uniq ? meh, unlikely.
- User enumeration hardly equals a vulnerability and the name you put on the account doesn't have to be your real name. I have "SMTDDR" on it. All you'd get is "SMTDDR".
Really, this is some kind of political-mud-slinging at Coinbase. Wake me up when you can pull my banking info or transfer my coins out of my account.
- korzun 13y agoThey leaked accounts that are legit, who cares about the source when Coinbase confirmed that this instance with some random unknown list 'only' impacted 1000+ users. Sure, but they could also not care if there are duplicates. You don't need to polish your list output for a proof of concept code, whatever he needed to prove was proven. It's not a vulnerability, it's data leakage. Sure you put a wrong name in, most people did not. And it's not the name that's a concern it's leakage of email addresses that would be prime target for savvy hackers who want bitcoins. If you could run random addresses against an API offered by a vendor that sells safes for high value valuables and get a match which houses have those safes you become a target. Sure most people won't try to break in, but those are are in business of doing so will try.