Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay customers’ personal data was compromised in March

ebayinc.com

Post reply on HN
Print view View original

121–130 of 146 posts

Re: eBay customers’ personal data was compromised in March

#121

Post by danielweber »

addandsubtract wrote: post #89
andrewpi wrote: post #74

Earlier quoted context omitted.

You think that's bad? Charles Schwab Bank only allows you 8 characters for the password. No special characters either.

The 2 banks I have to deal with online both require 5 characters. Fwiw, they at least lock your account after 3 wrong entries.

I still get mail from Bank Of America -- where I no longer have an account because their fraud department decided to stop paying my mortgage -- about someone trying to log into my account. About once a week. I could spam filter it but it reminds me not to go back.

Re: eBay customers’ personal data was compromised in March

#122

Post by danielweber »

simplestyle wrote: post #63
archon wrote: post #17

Earlier quoted context omitted.

I know it's not always practical for everyone, so I can't give it as general advice, but this kind of situation is exactly why I isolate my "real" checking account. My primary account (the one to which my paychecks are deposited) doesn't have a debit card, and I never use the account number. I have a different account that I use for online services like PayPal, and for recurring charges online that require a credit/d…

For those of us who don't have this setup, suppose this kind of breach does occur and money is taken from a checking account. Is this covered by the bank somehow? Can that money be returned?

In the US, consumer level accounts are protected against unauthorized withdrawals. (The bottleneck for the crooks is finding a sucker who will change a reversible transaction into an irreversible transaction.)

It might take you some time to get it back, but the bank is legally required to get it back to you.

For business accounts this protection does not apply.

Re: eBay customers’ personal data was compromised in March

#123

Post by csixty4 »

rupert_murdaaa wrote: post #69
twistedpair wrote: post #58

Earlier quoted context omitted.

Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?

this always gets me, and every time i ask i can't seem to find a direct answer why so many sites have this 20 character limit. bank of america does as well, with the additional restriction that you can't use the following characters: $ & ^ ! []. bluecross/blueshield allows up to 30 characters, but only numbers and letters. if passwords are being hashed, which i guess i would have to believe they are, at least in the…

Two reasons spring to mind:

1. Legacy systems. The system that was built 15 years ago might have limited the field for performance or storage reasons and it was never updated. Or maybe the Palm Pilot app only supports 20 characters in a text field and nobody has the source code but there's still a dedicated bunch of 200 users who do $50,000 in sales every year and nobody wants to piss them off. Or maybe they're just afraid the monster has gotten too big and they don't know what'll break if they change anything. Better to play it conservative so you're not the person who shut a group of users out of the system.

2. Just because. True story: I was working on an internal app for a company years back and I asked my manager if there were any particular password restrictions we needed to honor, any kind of company policies or weird accessibility concerns or something [1]. So what does he do? He emails the marketing stakeholder and asks her what the password rules should be. She doesn't know anything about security, so she concocts something completely arbitrary based on stuff she's seen on other sites. 6-10 characters, at least one number & one symbol, etc. And those were the requirements I had to implement, because that's what the stakeholder wants, even though that was the answer to completely the wrong question.

> if passwords are being hashed, which i guess i would have to believe they are

I wouldn't assume that. Think about a bank where you have call center staff who know a certain customer by name because he calls every Thursday saying he can't remember which of his grandkids' names he used as a password and could you please tell him because the rent is due Monday and he needs to transfer money from savings to checking because his Social Security check is late this month. And so on. You know how old guys are with their stories. You're reading one now. The CSR doesn't want to walk him through the steps of resetting his password over the phone…again. The faster he can get him logged in, the sooner he'll go away.

"We need a way to display that guy's password to a CSR," the head of the department tells the CEO over golf, knowing if he gets the department's average call time under two minutes he gets an extra $100,000 this year. So, the edict comes down from the highest levels of the company that the passwords have to be encrypted & reversible instead of hashed.

Now, this story is completely fictitious, but I've been in similar situations where the all-important call-center & support metrics trumped security. It happens. It shouldn't, but it happens.

[1] Maybe even a legacy Palm Pilot app…

Re: eBay customers’ personal data was compromised in March

#124

Post by mikeash »

rblatz wrote: post #108
mikeash wrote: post #42

Earlier quoted context omitted.

It really shouldn't be. I had a card compromised in the Target breach and they sent me a new one without my intervention. I've had fraudulent charges made before, and it's been trivial to get it fixed. I've never had a checking account compromise, but I'm pretty sure it would be a massive pain in the ass by comparison.

The Target compromise wasn't a minor pain for everyone. A friend's bank reissued her credit card. Which caused a payment she had made to Time Warner fail. She was also in the middle of moving, which caused even more headache and a potential hit on her credit for late payment, because apparently Time Warner doesn't even attempt to notify you if your payment fails.

I'd put the blame entirely on Time Warner for that one. The Target breach is entirely incidental to the store. The same thing would have happened if the card had expired naturally, or been closed for other reasons.

Re: eBay customers’ personal data was compromised in March

#125

Post by peterwwillis »

orbitingpluto wrote: post #50
k-mcgrady wrote: post #47

Earlier quoted context omitted.

>> "PayPal went full retard." I'm not usually big on political correctness but you could so easily replace that phrase with something that's not taking the piss out of people.

I suppose I could. I was going for the "Tropic Thunder" line. But really, political correctness? Has anyone ever called an actually mentally handicapped person "retarded" in the past thirty years?

The point isn't to just not call a 'mentally handicapped' person by a slur. It's to prevent the stereotyping of a whole class of people by comparing them to someone doing something wrong or unintelligent. In "Paypal went full retard", what you're really saying is that Paypal did something that is so wrong that only a mentally challenged person would do that, which promotes a stereotype that mentally challenged people do bad things.

By the way, the euphemism treadmill of this subject has proceeded to the point where "mentally handicapped" and "mentally challenged" are also now politically-incorrect. The preferred term is now "intellectually disabled" or "learning disabled" (which to me is far more insulting than "mentally retarded", from a literal perspective, but less evasive than "developmentally delayed").

Re: eBay customers’ personal data was compromised in March

#126

Post by jessaustin »

w-ll wrote: post #111
Crito wrote: post #93

Earlier quoted context omitted.

Are you sure that your password is actually 29 characters? Try changing some of the last nine characters and see if it will still let you log in; they may just be dropping the last nine silently.

Amazon was doing this with password over 8 characters for a long time. It was inevitably fixed.

s/inevitably/finally/

Unfortunately there's nothing inevitable about this! b^)

Re: eBay customers’ personal data was compromised in March

#128

Post by avd74 »

twistedpair wrote: post #58
joshvm wrote: post #31

Earlier quoted context omitted.

Don't forget that it was nearly three months ago. Why weren't users informed immediately? Do I need to update my PayPal account too? (my email is the same, but both passwords are long and randomised so not too bothered). So now they know my email address and my home address - and my date of birth, always convenient. Oh and as someone pointed out, I have PayPal automatically linked to my eBay account. Great. Which phy…

Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?

In mid february I created a gmail account and only used it to subscribe to Paypal (didn't touch Ebay). The Paypal account is associated to a NY home address.

On March 15th I received at that email address a "New York Lotto" phishing email. That is the only spam I got so far on that email account.

So I would assume that they have at least some Paypal subscribers data, including email and home city (and maybe address).

Re: eBay customers’ personal data was compromised in March

#129

Post by jacquesm »

ars wrote: post #118
vhost- wrote: post #113

Earlier quoted context omitted.

Are your accounts with two separate banks? Last time I tried to open another account with a separate bank, I got denied because I opened an account within the past year.

Not the OP but I do the same - two accounts, one for PayPal, and my real one. It's two checking accounts in the same bank. Just call your bank and ask them to make you another account. With my bank I don't even have to call them, I can make one from the account page. By having it in the same bank I can leave the PayPal account always at 0, and transfer the money easily to the other account.

Make sure that second account has a flag that says it can not be overdrawn under any circumstances.

Banks are not always as smart as they should be and sometimes allow an account of a customer 'in good standing' or with a credit balance on another account to be overdrawn. Especially when it is done via direct debit.

This sort of thing can really bite you.

Re: eBay customers’ personal data was compromised in March

#130

Post by bentcorner »

bentcorner wrote: post #53
archon wrote: post #17

Earlier quoted context omitted.

I know it's not always practical for everyone, so I can't give it as general advice, but this kind of situation is exactly why I isolate my "real" checking account. My primary account (the one to which my paychecks are deposited) doesn't have a debit card, and I never use the account number. I have a different account that I use for online services like PayPal, and for recurring charges online that require a credit/d…

This is also sort of how I operate. I have one checking account that my paycheck goes into, and I pay monthly/yearly recurring bills out of this account. There is nothing online for this account, the only way money gets out is that I get my bank to send somebody a check. I set up a weekly auto-transfer to a separate account which my wife and I carry around debit cards for. This is for groceries, gas, and personal sho…

Also, the primary reason was to help us balance our budget. I've tried software to do it, but:

a) My wife isn't into tech as much as I am and has a much lower threshold for acceptable complexity

b) More importantly, any software that I found had a large maintenance burden. Having her ask "do we have enough to go to dinner tonight?" requires me to have the books up-to-date almost on a daily basis. Too much work.

Now, the question of how much do we have to spend for specific activities has a very simple answer: how much is in the "spending" bank account, and it's easy to prorate that over a week's time.

A previous attempt at this was over a month's time frame, but that's too long of a time span. It's easy to overspend earlier in the month and fail to mentally take into account bigger things near the end of the month.

I also tried being "squishy" with the amount, moving it around depending on how much we overspent for the previous week (e.g., put something on our credit card because we actually needed to). This also doesn't work out too well, because it impairs predictability, even if it balances the books better. Plus, I want to get us off the mindset of using the credit card when we overspend a week. I was, frankly, being a tightwad with the weekly amounts and loosened it up a little to give us a bit more buffer.

Setting a weekly fixed amount made our money conversations easier. I'm still undoing financial damage from earlier (paying off credit card debt and building up savings for yearly bills), but this is an abstraction my wife doesn't need to worry about (she knows about it but doesn't need to deal with it).

This was all tangential to protecting yourself from badness, but it was a nice side effect.

Post reply on HN