Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay customers’ personal data was compromised in March

ebayinc.com

Post reply on HN
Print view View original

111–120 of 146 posts

Re: eBay customers’ personal data was compromised in March

#111

Post by w-ll »

Crito wrote: post #93
smellf wrote: post #82

Earlier quoted context omitted.

Ebay claims that 20 characters is the max, but it's a lie - mine is 29. Likewise, Newegg claims that you have to have special characters, but my password has none. I'd suggest trying the password you want and seeing if it gets rejected. In a lot of cases, some programmer may have fixed the crazy password scheme and forgotten to update the page text.

Are you sure that your password is actually 29 characters? Try changing some of the last nine characters and see if it will still let you log in; they may just be dropping the last nine silently.

Amazon was doing this with password over 8 characters for a long time. It was inevitably fixed.

Re: eBay customers’ personal data was compromised in March

#112

Post by ExpendableGuy »

So I logged into eBay for the first time in over a year to change my password, and noticed that eBay edited my reply to a buyer's feedback.

Has anyone else heard about eBay doing this? I have no way to edit it back to the way it was from what I can tell. It's infuriating -- they changed the word "Buyer" to "Seller" to make it sound like my reply to feedback was referring to myself.

Re: eBay customers’ personal data was compromised in March

#113

Post by vhost- »

bentcorner wrote: post #53
archon wrote: post #17

Earlier quoted context omitted.

I know it's not always practical for everyone, so I can't give it as general advice, but this kind of situation is exactly why I isolate my "real" checking account. My primary account (the one to which my paychecks are deposited) doesn't have a debit card, and I never use the account number. I have a different account that I use for online services like PayPal, and for recurring charges online that require a credit/d…

This is also sort of how I operate. I have one checking account that my paycheck goes into, and I pay monthly/yearly recurring bills out of this account. There is nothing online for this account, the only way money gets out is that I get my bank to send somebody a check. I set up a weekly auto-transfer to a separate account which my wife and I carry around debit cards for. This is for groceries, gas, and personal sho…

Are your accounts with two separate banks? Last time I tried to open another account with a separate bank, I got denied because I opened an account within the past year.

Re: eBay customers’ personal data was compromised in March

#114

Post by twistedpair »

davb wrote: post #73
twistedpair wrote: post #64

Earlier quoted context omitted.

You can paste in PayPal passwords on the password reset tool this week , but it's a new tool from last week when I last reset it. Wonder what made them update it?

I tried this around an hour ago and can't paste, it's being explicitly blocked. Perhaps my region (UK) still uses the old password change page? For clarification, I'm using the change password function once logged in and not doing a forgotten password reset.

I'm referring to a new Bootstrappy dialog (blue and white candy buttons) available when you login from Paypal.com

Re: eBay customers’ personal data was compromised in March

#115

Post by smellf »

darylfritz wrote: post #60

eBay's password character limit is 20 characters. I use a password manager and detest sites that limit your password length to < 100 characters.

The text on the page says that, but I had no problem using a 29 character password. I was upgrading from one with 23 characters though, maybe they grandfathered me in?

Re: eBay customers’ personal data was compromised in March

#116

Post by smellf »

unreal37 wrote: post #61
darylfritz wrote: post #60

eBay's password character limit is 20 characters. I use a password manager and detest sites that limit your password length to < 100 characters.

Do you find many sites that allow 100 character passwords? That surprises me.

It shouldn't matter at all - the hashing should be done on the client so they wouldn't need to worry about server resources, and all output from a given has function is the same size. Some hash functions may have upper limits, but I doubt it. Ever md5 a multi-GB iso you downloaded from the Internet to verify its integrity? It's the same thing.

Re: eBay customers’ personal data was compromised in March

#117

Post by bentcorner »

vhost- wrote: post #113
bentcorner wrote: post #53

Earlier quoted context omitted.

This is also sort of how I operate. I have one checking account that my paycheck goes into, and I pay monthly/yearly recurring bills out of this account. There is nothing online for this account, the only way money gets out is that I get my bank to send somebody a check. I set up a weekly auto-transfer to a separate account which my wife and I carry around debit cards for. This is for groceries, gas, and personal sho…

Are your accounts with two separate banks? Last time I tried to open another account with a separate bank, I got denied because I opened an account within the past year.

It's with the same bank. I got another debit card for it but keep in stored away and never use it.

Re: eBay customers’ personal data was compromised in March

#118

Post by ars »

vhost- wrote: post #113
bentcorner wrote: post #53

Earlier quoted context omitted.

This is also sort of how I operate. I have one checking account that my paycheck goes into, and I pay monthly/yearly recurring bills out of this account. There is nothing online for this account, the only way money gets out is that I get my bank to send somebody a check. I set up a weekly auto-transfer to a separate account which my wife and I carry around debit cards for. This is for groceries, gas, and personal sho…

Are your accounts with two separate banks? Last time I tried to open another account with a separate bank, I got denied because I opened an account within the past year.

Not the OP but I do the same - two accounts, one for PayPal, and my real one.

It's two checking accounts in the same bank. Just call your bank and ask them to make you another account.

With my bank I don't even have to call them, I can make one from the account page.

By having it in the same bank I can leave the PayPal account always at 0, and transfer the money easily to the other account.

Re: eBay customers’ personal data was compromised in March

#119

Post by k3oni »

andrewpi wrote: post #74
twistedpair wrote: post #58

Earlier quoted context omitted.

Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?

You think that's bad? Charles Schwab Bank only allows you 8 characters for the password. No special characters either.

Have the same issue with my bank.. err credit union. You can't use any special character in the password.

Who comes up with these damn ideas when you are dealing people's money and information?

Re: eBay customers’ personal data was compromised in March

#120

Post by stevekemp »

kmfrk wrote: post #97
jr203fj2fuf wrote: post #35

Earlier quoted context omitted.

http://pages.ebay.com/help/account/closing-account.html

But does that actually delete all user records?

It certainly deletes the public-facings parts you can verify.

However note that they claim it will take up to 180 days to delete your account. (I went through this last year, getting sufficiently annoyed to close both Ebay & Paypal accounts.)

Post reply on HN