Hacker News Reader

Comment by beaner | Hacker News Reader

There is no full list. The "exploit" doesn't give you email addresses you don't already have. This is why it was not considered a vulnerability.

View on HN

Since Coinbase is a financial-esque firm that deals with and stores peoples money/BTC it is not at all alright for this to be treated as public information, even if someone already had the email address.

I know CB is not a financial company and they are not obligated to provide the same protections to consumers/customers.

Phishing is not the only reason why a customer would not like their bank to confirm that they have an account.

As a matter of fact in this situation, when someone sends a fund request, CB should never let the requesting party know the name of the account holder, unless the account holder explicitly gives them permission, maybe not even then.

With any other organization law enforcement would require a warrant to get basic confirmation if a customer has an account and the name on the account.

I work on dating sites, some of them a bit risqué.

On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".

How do you handle users attempting to register a new account with an email address that already exists?

If you say, "we don't allow two accounts with the same email address", you have the same issue as coinbase.

For the case of people attempting to sign up a second time with the same email address, don't change anything shown from the webpage. Instead of sending a verification email, send an email informing them that someone is trying to sign up again with the same email address, and include an expiring password reset link in that email. If you see too many users forgetting that they've already signed up, and getting frustrated by filling out too much data in forms before finding out they've already signed up, then consider moving the email verification step earlier in the signup process.

So you'll allow a user to go all the way through the process of registration, create a new password, get temporary access to your site... and then what... not save that password? So a re-login attempt won't work?

I can't see how you can avoid making the experience for the duplicate user exactly the same as a new user.

> ... get temporary access to your site...

> I can't see how you can avoid making the experience for the duplicate user exactly the same as a new user.

The workflow diverges at the email verification step, before you grant any access to the site. Existing users get an email informing them that someone has tried to sign up a second time using their email address while new users get the standard email verification email.

I highly recommend not allowing account creation before email address verification. I have a difficult to spell last name, so I have one email address that contains my initials and a common word instead of my last name. You'd be surprised the number of people who don't know their own email address and the number of sites that allow people to sign up (and apparently transact significantly) without verifying email addresses. Off the top of my head, if I wanted to, I could steal one person's tax accounting account (I got confirmation that they filed their state taxes this year, and later confirmation their state accepted their filing), another person's car rental account, and a third person's business's trash service account. From time to time the one person tries to reset their car rental account password. I imagine I could reset the passwords for all of these accounts (and others) and get the last 4 digits of their credit card numbers and other personal information and use that as a starting point for gaining access to other accounts they own. In the case of the tax account, I could probably re-download the tax paperwork and get their SSN. Neither the tax accounting company nor the car rental agency replied when I informed them that accounts were set up with the wrong email addresses. (I also get business quotes from time to time. Hopefully some day I'll get email from a business or person who knows the person who keeps trying to reset their car rental account.)

If you have enough users who forget they already have an account and your signup process makes them get too far before verifying their email address, consider moving email verification earlier in your workflow.

Do you setup a timed sleep to make sure that you return results in exactly the same time regardless of path taken?

For the record, the right way to do this is to just log the request to your database, and have a background process pull the log and take appropriate action later.

Not sure if sarcasm..

This is a real attack vector. It's called a timing attack: http://en.wikipedia.org/wiki/Timing_attack

I am familiar with timing attacks. The thought of someone attempting to apply it over the internet to verify whether an email is registered on a dating site seems laughable.

Applying it over the Internet is quite feasible, especially with simple code. If it connects to a remote SMTP server, the delay may very well be noticeable enough without doing any complicated timing. It might be just about as easy as scraping the page for "user not found" versus "email sent".

I assume that was the original point - that on risque dating sites, the recover password system tries to hide membership.

It gives the full name associated with an email address. A more dramatic but analogous situation would be if an attacker were able to attain password info or credit card info associated with an email address.

Just because email address is known does not imply that other personal information should be given away.

Does it leak the fact that you have a coinbase account? That seems private as well.

If someone has your email address it is impossible for coinbase or any service to stop that person from checking if you have an account. All they have to do it try registering a new account with your address and see if it lets them (as most services don't allow multiple accounts to use the same email address).

It doesn't need to be impossible. The problem could be designed away: on form submission send an email saying 'looks like you already have an account' or 'welcome... next steps' and just show a 'check your email' message in the browser.

That sounds innocuous. But it's easy for, say, mobile badware to harvest contact lists. By targeting non-anonymous bitcoin holders as a "seed" list and using exposed contact lists like LinkedIn contacts, you can ratchet your way up into disclosing a lot of people who would prefer not to be known, lest the become phishing targets.

Doesn't seem innocuous. Maybe coinbase ought to be making pseudonymity more easily accessible.

It does confirm email addresses you can guess though (which are not necessarily email addresses you have, until they're confirmed), along with leaking other information about that user.

What other information is it leaking?

From what I gather, first name and last name.

Stopping email address validation is, I think, impossible for a company like Coinbase, but revealing the name doesn't have to happen.

On the other hand, providing the first and last name could be very valuable to the users, though. If I send coins to bob@example.com, I'd like to see the real name behind that address.

On the other other hand, if anyone can make any first and last name they wish, then the safety of that goes away. Maybe I make b0b@example.com with the same real name.

EDIT The users agreed to have their names given to people they transact with. Does that include strangers attempting to transact with them? I'm thinking "no" but can see the other side.

If you want a service that allows the sender to verify name before sending, make it a feature that both:

(1) is opt-in on the recipient's side and fails with something like "that recipient email address doesn't have an account, the name doesn't match, or they haven't decided to allow name verification"

AND

(2) is only available on payments above your highest guess at the expected value of matching an account-email-name triple for spearphishing, and the error messages (and timings) are identical if the name doesn't match or the given email address doesn't have an account.

I imagine there are few profitable attacks where an answer "yes, email_address with name has a Coinbase account" costs a minimum of 100 USD to an attacker and getting an answer "Either email_address doesn't have an account, that name doesn't match our records, or they've chosen not to share their name" costs 0 USD. However, I'd have to think a bit more about that 100 USD minimum.

What danielweber said, the listed real name with Coinbase. I'm not so sold that it's a Big Deal™, but it's certainly not completely leakproof with regard to user data either.

I think you meant to say :

"This is the bullshit excuse they are trying to use to make it SEEM like its not a vulnerability."

Coinbase is deliberately misleading their users regarding privacy if they do not fix this issue!

Reply on news.ycombinator.com