Hacker News Reader

Comment by jeremymcanally | Hacker News Reader

Do you publish that you have a Coinbase account? That's the issue. Now these people are valuable targets for spear phishing and other attacks on their e-mail accounts because it's known that they have hot access to at least some amount of Bitcoin. Without that information, an attacker is shooting blind.

So, this sort of leak or enumeration basically reduces the (though tenuous) degree of security afforded by one's privacy.

View on HN

shrug

Some people certainly do: https://twitter.com/search?q=just%20bought%20coinbase&src=ty...

I agree it's not ideal, but if your security relied on a guessable email address staying private, you're already not in a good place.

Because "well someone else does it" has always been the best reason to behave a certain way...

No, and indeed I don't publish whether or not I have a coinbase account. But it isn't a serious security failure if that somehow got out.

Except for the non-zero possibility it could make the difference between you being murdered during a home invasion, or not.

Last time a politician was worried about non-zero probabilities, the U.S. invaded Iraq. I mean, if changing the probability someone's home gets broken into is our standard of practice nowadays there's a lot of companies which will have to close down today.

I reckon non-anonymous bitcoin holders are at greater risk than the average person with money in the bank, since draining the account of the former is a relative cinch once the keys are divulged. The whole crime could be completed within a few minutes.

That much may be true, but I'd consider that an inherent risk associated with using Bitcoin without using a pseudonym. Maybe I'm naïve but I have to assume people who care about such things are already tracking IP addresses directly from the Bitcoin network swarm itself for later investigation...

Likely Coinbase customers expected Coinbase to keep their real name secure from potential thieves. But they thought wrongly.

The name is an optional field, so no one is being forced here. If you don't fill out your name, this oh-so-clever "hack" doesn't work.

https://twitter.com/SMTDDR/status/438404079438422016

Bonus points: That screenshot also tells you I have an account with Patelco Credit Union.

You trust Patelco CU and Coinbase employees a lot... Watch out, it might backfire...

If an employee of either company steals from me, I'd expect them to be easily caught. If Coinbase decides to steal 1k from everyone then shutdown that would be crazy since the people behind Coinbase are very well known and in SF; I accepted that risk when I signed up. If someone inside Patelco decides to steal from me, that's a heavly regulated financial establishment - I don't think that person could get away with it or that Patelco wouldn't reimburse me.

If someone who is not an employee of either company manages to steal funds from me just based on that screenshot then there is some other security-issue somewhere else and it was bound to happen sooner or later.

Probably something like this[1], which I don't really see how you'd protect yourself against. Like getting hit by a car running a red-light.

1. http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking

I wasn't saying they would steal from you. I was referring you trusting their competence to do their job right and not be social-engineered by some hacker into giving them access to your accounts. Thank you for the downvote.

Reply on news.ycombinator.com