Hacker News Reader

Comment by philfreo | Hacker News Reader

Off-topic, but since you guys have ignored: 3 emails from me, and a tweet...

I sent you an XSS vulnerability to whitehat@coinbase.com according to https://coinbase.com/whitehat almost 3 weeks ago and haven't received so much as a confirmation "thanks we are looking into it" email from you guys.

View on HN

Coinbase guys: if you'd like, we're happy to offer you a free 3 months of website vulnerability scanning to hopefully help you find and squash any vulnerabilities like this. Just email me at borski@tinfoilsecurity.com.

To anyone considering or currently using coinbase: this comment (if verifiably true) should be a GIANT red flashing light warning you to tread carefully.

It was frustrating that I didn't receive any contact from Coinbase until after posting on here HN, however I'd like to point out a couple things:

- This was a relatively minor XSS vulnerability which required a bit of social engineering to pull off, rather than being a traditional XSS that most HN readers would need to worry about.

- Their delayed response was likely due to the relative minor nature of this vulnerability.

- I still feel safe using Coinbase

- They're taking care of it and treating me well :)

We'll take a look. Thanks for the reminder!

This scares me.

Enable 2 factor authentication. IIRC Coinbase doesn't use it per user action, but at least having it has the potential to save you some headaches.

Reply on news.ycombinator.com