We changed the title because, as users pointed out, it was misleading.
eBay customers’ personal data was compromised in March
101–110 of 146 posts
Re: eBay customers’ personal data was compromised in March
#102Is this only for ebay US or are other country versions affected too?
everyone.
Re: eBay customers’ personal data was compromised in March
#103I'm so tired of large corporations not taking infosec seriously. This is a shame, in all honesty.
Re: eBay customers’ personal data was compromised in March
#104FWIW, "ebayinc.com" totally screams "phishing attempt" to me.
You have to remember that eBay is an ancient tech company run by the old MBA types that didn't really understand what value to place on engineering. All their internal systems are maintained by vendors, VARs, and contractors. So weird stuff like the ebayinc.com domain is to be expected. As is this hack. Also it'd be interesting to know how it was detected, and how the extent of access was determined. But if my predic…
Take a look at ebay's Account Management interface. Remember what it was like to use the web 15 years ago. Bear in mind that ebay owns PayPal which has quite possibly the worst api I've ever used, along with an interface that is even worse than ebay's. Wonder what the hell this company is doing other than lying back and counting the dollars.
If it wasn't for a tiny amount of 'reputation' which might make others more willing to deal with me, I'd close my ebay account right now.
Re: eBay customers’ personal data was compromised in March
#105Earlier quoted context omitted.
It really shouldn't be. I had a card compromised in the Target breach and they sent me a new one without my intervention. I've had fraudulent charges made before, and it's been trivial to get it fixed. I've never had a checking account compromise, but I'm pretty sure it would be a massive pain in the ass by comparison.
Did the bank charge you for the replacement cards? Is there any real reason not to just regularly - say every 3 months - request a new card for peace of mind?
They did not. That stuff is basically a loss leader for them.
From what I recall with the Target incident, their cost is something like $2-5 for each replacement card, so it's not entirely trivial. If you requested a new one on a regular basis for no good reason, they might put a stop to it one way or another.
As far as peace of mind goes, since the consequences are so mild, I wouldn't worry about it.
Re: eBay customers’ personal data was compromised in March
#106Earlier quoted context omitted.
It really shouldn't be. I had a card compromised in the Target breach and they sent me a new one without my intervention. I've had fraudulent charges made before, and it's been trivial to get it fixed. I've never had a checking account compromise, but I'm pretty sure it would be a massive pain in the ass by comparison.
Did the bank charge you for the replacement cards? Is there any real reason not to just regularly - say every 3 months - request a new card for peace of mind?
The biggest obstacle is that it's an annoyance to update the number for any recurring charges you have set up.
Re: eBay customers’ personal data was compromised in March
#107Shouldn't eBay have emailed all their customers by now? Why are we learning about this through a blog post?
The news "leaked" a bit early. http://grahamcluley.com/2014/05/change-ebay-password/
Re: eBay customers’ personal data was compromised in March
#108Earlier quoted context omitted.
It can still be very inconvenient.
It really shouldn't be. I had a card compromised in the Target breach and they sent me a new one without my intervention. I've had fraudulent charges made before, and it's been trivial to get it fixed. I've never had a checking account compromise, but I'm pretty sure it would be a massive pain in the ass by comparison.
The Target compromise wasn't a minor pain for everyone. A friend's bank reissued her credit card. Which caused a payment she had made to Time Warner fail. She was also in the middle of moving, which caused even more headache and a potential hit on her credit for late payment, because apparently Time Warner doesn't even attempt to notify you if your payment fails.
Re: eBay customers’ personal data was compromised in March
#109Earlier quoted context omitted.
Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?
this always gets me, and every time i ask i can't seem to find a direct answer why so many sites have this 20 character limit. bank of america does as well, with the additional restriction that you can't use the following characters: $ & ^ ! []. bluecross/blueshield allows up to 30 characters, but only numbers and letters. if passwords are being hashed, which i guess i would have to believe they are, at least in the…
Choosing random characters to exclude (or alternately, only permitting a subset of characters) can make the task of validating that you aren't subject to an injection attack easier.
Note that this validation may take the form of validating to someone, shall we say, less than fully competent, or it could be an actual means to protect yourself.
The additional search space from 62^N to 200^N isn't especially worth worrying about, IMO.
http://msdn.microsoft.com/en-us/library/bb355989.aspx (to cite just one way that these things come into being; someone finds that you can do input validation easily, and they do it, maybe because they're overly cautious, maybe because someone they need to convince is overly cautious, maybe some other reason) IMO, this is not an especially terrible "flaw" in a site.
Re: eBay customers’ personal data was compromised in March
#110"The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. However, the database did not contain financial information or other confidential personal information." …So, just my entire identity then? eBay really seem to be down-playing the severity of this.
If a few data strings comprise your entire identity, you should probably think about at least getting some hobbies.