Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay customers’ personal data was compromised in March

ebayinc.com

Post reply on HN
Print view View original

71–80 of 146 posts

Re: eBay customers’ personal data was compromised in March

#71

Post by orbitingpluto »

mikeash wrote: post #46
orbitingpluto wrote: post #36

Since PayPal == eBay, I just went to change my PayPal password as well. PayPal went full retard. The security confirmation question? Please supply your full credit card number ending in ####. Um, that's the information I'm trying to protect in the first place. edit: sorry about the "full retard" - trying to quote from Tropic Thunder/RDJ. did not mean to offend

Credit card numbers should be way down on your list of info to protect. They're easy to change and the consequences of a compromise are small (you're not liable for any fraudulent transactions as long as you're paying the least bit attention). Worry about your checking account number and other info, but not your card numbers.

In my case, the credit card was the most important piece of data to protect.

However I just realized that the credit card might be the only legitimate piece of data that they have left to verify against.

Re: eBay customers’ personal data was compromised in March

#72

Post by non-sense »

panarky wrote: post #18

The spin is atrocious. The big story is not the headline, that users must change passwords. The big story is that ebay leaked personally identifiable information. Naturally this is buried four paragraphs down. The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. Don't patronize me…

Oh Gosh! The oversimplification is mind boggling. Being an ecommerce and payments website they should have been very clear about the impact this breach has on our privacy. Angry.

Re: eBay customers’ personal data was compromised in March

#73

Post by davb »

twistedpair wrote: post #64
robin_reala wrote: post #51

Earlier quoted context omitted.

I’ve not used Keepassx, but I have no trouble pasting from Lastpass…

You can paste in PayPal passwords on the password reset tool this week , but it's a new tool from last week when I last reset it. Wonder what made them update it?

I tried this around an hour ago and can't paste, it's being explicitly blocked.

Perhaps my region (UK) still uses the old password change page? For clarification, I'm using the change password function once logged in and not doing a forgotten password reset.

Re: eBay customers’ personal data was compromised in March

#74

Post by andrewpi »

twistedpair wrote: post #58
joshvm wrote: post #31

Earlier quoted context omitted.

Don't forget that it was nearly three months ago. Why weren't users informed immediately? Do I need to update my PayPal account too? (my email is the same, but both passwords are long and randomised so not too bothered). So now they know my email address and my home address - and my date of birth, always convenient. Oh and as someone pointed out, I have PayPal automatically linked to my eBay account. Great. Which phy…

Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?

You think that's bad? Charles Schwab Bank only allows you 8 characters for the password. No special characters either.

Re: eBay customers’ personal data was compromised in March

#75

Post by joeyh »

davb wrote: post #43

And neither eBay nor PayPal allow me to paste a secure password from KeePassX. sigh Edit: I can now paste on eBay (not sure what went wrong the first time) but PayPal is still actively preventing pasting a new password.

I use assword, which works around paste blockers by typing the password into the browser window 1 character at a time.

Re: eBay customers’ personal data was compromised in March

#76

Post by octo_t »

orbitingpluto wrote: post #50
k-mcgrady wrote: post #47

Earlier quoted context omitted.

>> "PayPal went full retard." I'm not usually big on political correctness but you could so easily replace that phrase with something that's not taking the piss out of people.

I suppose I could. I was going for the "Tropic Thunder" line. But really, political correctness? Has anyone ever called an actually mentally handicapped person "retarded" in the past thirty years?

yes, they have.

Re: eBay customers’ personal data was compromised in March

#77

Post by chrismonsanto »

andrewpi wrote: post #74
twistedpair wrote: post #58

Earlier quoted context omitted.

Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?

You think that's bad? Charles Schwab Bank only allows you 8 characters for the password. No special characters either.

You'd think regulations would prohibit nonsense like that.

Re: eBay customers’ personal data was compromised in March

#78

Post by anujnayar »

panarky wrote: post #18

The spin is atrocious. The big story is not the headline, that users must change passwords. The big story is that ebay leaked personally identifiable information. Naturally this is buried four paragraphs down. The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. Don't patronize me…

hi everyone - PayPal not affected. https://www.paypal-community.com/t5/PayPal-Forward/eBay-To-A.... More details on ebay Inc microsite https://info.ebayinc.com

Re: eBay customers’ personal data was compromised in March

#79

Post by Alupis »

joshvm wrote: post #31
panarky wrote: post #18

The spin is atrocious. The big story is not the headline, that users must change passwords. The big story is that ebay leaked personally identifiable information. Naturally this is buried four paragraphs down. The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. Don't patronize me…

Don't forget that it was nearly three months ago. Why weren't users informed immediately? Do I need to update my PayPal account too? (my email is the same, but both passwords are long and randomised so not too bothered). So now they know my email address and my home address - and my date of birth, always convenient. Oh and as someone pointed out, I have PayPal automatically linked to my eBay account. Great. Which phy…

> Information security and customer data protection are of paramount importance to eBay Inc

Which is exactly why we took 3 months to inform you, you've been hacked. It's because we care. Don't you see?

Re: eBay customers’ personal data was compromised in March

#80

Post by anujnayar »

leorocky wrote: post #14

> The company also said it has no evidence of unauthorized access or compromises to personal or financial information for PayPal users. PayPal data is stored separately on a secure network, and all PayPal financial information is encrypted. Ebay being hacked kind of scares the hell out of me because PayPal has my checking account information with direct access to withdraw funds. A hacker could rob me blind. Like seri…

Hi - PayPal was not affected. Info on and an FAQ for eBay users is here. https://info.ebayinc.com
Post reply on HN