Live data from Hacker News

eBay customers’ personal data was compromised in March

ebayinc.com

51–60 of 146 posts

Re: eBay customers’ personal data was compromised in March

#51
post #43

And neither eBay nor PayPal allow me to paste a secure password from KeePassX. sigh Edit: I can now paste on eBay (not sure what went wrong the first time) but PayPal is still actively preventing pasting a new password.

I’ve not used Keepassx, but I have no trouble pasting from Lastpass…

Re: eBay customers’ personal data was compromised in March

#52
post #18

The spin is atrocious. The big story is not the headline, that users must change passwords. The big story is that ebay leaked personally identifiable information. Naturally this is buried four paragraphs down. The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. Don't patronize me…

> customers’ name, encrypted password, email address, physical address, phone number and date of birth

Holy crap, isn't that enough to do some social engineering and get a new credit card or something equally serious?!

Re: eBay customers’ personal data was compromised in March

#53
post #17

> The company also said it has no evidence of unauthorized access or compromises to personal or financial information for PayPal users. PayPal data is stored separately on a secure network, and all PayPal financial information is encrypted. Ebay being hacked kind of scares the hell out of me because PayPal has my checking account information with direct access to withdraw funds. A hacker could rob me blind. Like seri…

I know it's not always practical for everyone, so I can't give it as general advice, but this kind of situation is exactly why I isolate my "real" checking account. My primary account (the one to which my paychecks are deposited) doesn't have a debit card, and I never use the account number. I have a different account that I use for online services like PayPal, and for recurring charges online that require a credit/d…

This is also sort of how I operate.

I have one checking account that my paycheck goes into, and I pay monthly/yearly recurring bills out of this account. There is nothing online for this account, the only way money gets out is that I get my bank to send somebody a check.

I set up a weekly auto-transfer to a separate account which my wife and I carry around debit cards for. This is for groceries, gas, and personal shopping stuff, including online.

Re: eBay customers’ personal data was compromised in March

#55
post #39

Earlier quoted context omitted.

Doesn't that make it the perfect question? For someone to answer the question correctly, they have to demonstrate that they don't even need to do so, because they already know the thing you wanted to protect?

Along that reasoning... I'm from your bank. Please give me your account # and PIN.

No, that doesn't work: if you really think that is a good argument, then everyone is also a fool for believing "enter your password here to log in"; remember that you are answering a password reset challenge question at the same site you would normally enter your password.

Re: eBay customers’ personal data was compromised in March

#56
Week 1: "We have no reason to believe that any confidential information has been compromised."

Week 2: "We have observed some limited and negligible instances of credit card information being compromised that coincidentally happened to be linked to eBay accounts. We consider this purely coincidental and feel it is no cause for concern."

Week 3: "Oh god they took everything."

Re: eBay customers’ personal data was compromised in March

#57
post #49
post #43

And neither eBay nor PayPal allow me to paste a secure password from KeePassX. sigh Edit: I can now paste on eBay (not sure what went wrong the first time) but PayPal is still actively preventing pasting a new password.

I can do that just fine, must be your browser interfering.

You're right. It seems to be working now. When I first tried, I could paste into any field but the change password fields.

However on PayPal, when pasting I received a little tooltip-style popup saying something along the lines of "Please do not copy and paste passwords.", followed by their password criteria.

Pasting into other fields (including the login page password field) worked perfectly fine.

Re: eBay customers’ personal data was compromised in March

#58
post #31
post #18

The spin is atrocious. The big story is not the headline, that users must change passwords. The big story is that ebay leaked personally identifiable information. Naturally this is buried four paragraphs down. The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. Don't patronize me…

Don't forget that it was nearly three months ago. Why weren't users informed immediately? Do I need to update my PayPal account too? (my email is the same, but both passwords are long and randomised so not too bothered). So now they know my email address and my home address - and my date of birth, always convenient. Oh and as someone pointed out, I have PayPal automatically linked to my eBay account. Great. Which phy…

Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch?

P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?

Re: eBay customers’ personal data was compromised in March

#59

Earlier quoted context omitted.

>> "PayPal went full retard." I'm not usually big on political correctness but you could so easily replace that phrase with something that's not taking the piss out of people.

I suppose I could. I was going for the "Tropic Thunder" line. But really, political correctness? Has anyone ever called an actually mentally handicapped person "retarded" in the past thirty years?

Probably 1000x in the last 30 seconds. There's a lot of people.
Post reply on HN