Meh, this is an extremely poor bug report despite the super-serious introductory tone. The "proof of concept" makes no sense. Quoting:<p><i>1. Scrape email addresses from bitcoin related websites, and organise them into a large list.</i><p>This has nothing to do with Coinbase.<p><i>2. Test for emails which are actual Coinbase accounts, and extract their First and Last names, associated to the emails.</i><p>Ok...<p><i>3. All sorts of panic happens.</i><p>Huh? How?<p>To prove "panic" he then leaps to a screenshot someone posted to Twitter of a money request email he generated. However,<p>a) It's not clear whether this was sent via the coinbase money request feature or whether it was spoofed (or why it would even need to be spoofed).<p>b) It doesn't even show usage of a firstname or lastname to "assist" in the spoofing.. which was the whole point of the bug report.<p>So it remains to be demonstrated how the exposure of firstname/lastname could be exploited to significantly assist phishing, especially when weighed against the other design tradeoffs -- like accidentally irreversibly sending money to the wrong person.<p>The lack of responsiveness to the whitehat email is the bigger problem here, but now that they've joined HackerOne perhaps that will improve.