Requestor Email Disclosure via Email Notification

Summary

When a Coinbase user requests money from another coinbase user, the user that receives the request sees an email that says, in part:

John Smith ([email protected]) sent you a request to pay 1 BTC using Coinbase.

Where John Smith is the sending account's display name (meaning you can make it whatever you want), and [email protected] is the sending account's verified email address. This is done intentionally, as without an identifier like an email address in the request, it would be impossible to tell the difference between the actual John Smith and someone claiming to be John Smith.

If Coinbase users wish to receive money while disclosing less information about themselves, Coinbase allows users to create single use BTC addresses that can receive payments (https://support.coinbase.com/customer/portal/articles/1816349-how-do-i-get-a-bitcoin-address-).

When a user request a payments, Requestors email address was leaked without his/her knowledge , the team says it is intented because that is essentially the only way of ensuring the payment is going where you intended it to go, but the thing is if the user did NOT actually open the email notification, request reciever will not be able to see the email address, because it is not shown in the web and mobile application of coinbase, only name displays in coinbase web and mobile, therefore that defense for social engineering is still there because that is only included in email notification, but not in web and mobile application.

One more thing that the team forgets, you only think of the payers side while not thinking of the requestor side, the requestor did not know that his/her email address was disclosed, meaning if the payer is a malicious minded user, he can perform social engineering back to the requestor SINCE HE ALREADY KNOWS THE VALID EMAIL ADDRESS OF THE REQUESTOR, because the verified email address of the requestor was leaked.

Publicly disclosing so that all coinbase users that will perform request transaction will be aware that their email address was leaked in the email notification of the payers (request reciever).