Hacker News Reader

Comment by revelation | Hacker News Reader

Rate limiting

Do we have to spell it out to them?

We are pushing some changes to rate limiting - this wasn't clear in the original post and I just edited. Thanks for the heads up.

So why are you blowing this off and now all of a sudden writing rate limiting?

The only reason he got 1000+ emails is because you guys messed up.

Not even going into the whole idea of you releasing that end point with name leakage without somebody going 'oh hey.. do we have rate limiting?'.

Mistakes like this are signs of amateur hour.

Suppose they limit it to 100 emails before blocking your account. The guy can just sign up with 10 accounts. Or 5. This "attacker" would still post it and make a big fuss.

Most likely they're implementing rate-limiting to appease people and prevent an ongoing spam issue. Or perhaps it was on their list for a while and just hasn't been an issue until now.

In regards to rate limiting, it would be a much smaller number prior to block.

If it's IP based at let's say 10 over X attacker would have to lease 100 IP's.

In any case, rate limiting is the quickest mitigation prior to actual fix of the data leak in question.

From the text:

"For example, we employ rate limits around sensitive actions, such as requesting money, to prevent them from being abused at scale."

They don't appear to be rate limiting their API that allows enumeration of first and last names. Also,

We’d also like to address the claim of a “leaked” list of Coinbase emails and user names. This list (the size of which is less than one half of one percent of Coinbase users) was not the result of a data breach at Coinbase.

There are 2,040 names on the leaked list. Fun fact: that means there are about 408,000 Coinbase users total.

The list duplicates every entry, probably another silly tactic by the "attacker" to fluff up his feathers.

I wonder if that means there are around 200,000 Coinbase users? Depends whether they noticed the dupes. Good catch.

Actually over a million: http://blog.coinbase.com/post/78016535692/a-major-coinbase-m...

That's wallets, not users. That press release was impressive, and I've always wondered how many users they actually had. I didn't expect to find out through a security blog post, but it's fun to know.

Given it's easily parallelizable, assuming the cost of enumeration is significantly lower than other methods and the value of the data is high enough, how does that actually solve anything? All it does is requires someone to rent time on botnets or similar which doesn't seem like it would raise the cost a huge amount at scale.

Already a largely solved problem. If you try enumerating email addresses by running through queries at Hotmail or Yahoo, for example, they'll shut the doors on you in a matter of seconds. Think you can just use thousands of IPs instead? Go for it - they trust 'new' and rarely-seen IP addresses even less, and bring up the shutters all the faster. It's not a new problem, and there's lots of best practice to learn from, for anyone who wants to do it right.

Is it possible that they simply have a more generous rate limit than what you think they should have?

Up this comment goes! Why are they not addressing it? I'm confused.

Reply on news.ycombinator.com