Seems easier to just delete my account.
But "they" already have you personal information?
Hackers raid eBay in historic breach, access 145 million records
31–40 of 100 posts
Re: Hackers raid eBay in historic breach, access 145 million records
#32Ok, passwords were encrypted, were they salted? Per-account salts? How was the salt stored? How about the keys? What was the scheme? Actually, it seems like all sites with sensitive user data should disclose full technical details of their password scheme. How could we make that a reality?
You need to know how they store passwords because ... what?
So we can understand the risk of compromise.
Re: Hackers raid eBay in historic breach, access 145 million records
#33Re: Hackers raid eBay in historic breach, access 145 million records
#34How many billion $ companies will it take before we finally rid ourselves of plain-text password authentication (regardless of whether or not it's performed over TLS, or they're using a 'good' hash function for verification)?
The lack of a usable secure password authentication standards for the web is the most pressing issue in web security these days. If there's one thing in the next HTML standard that should be depreciated, it's
Re: Hackers raid eBay in historic breach, access 145 million records
#35Re: Hackers raid eBay in historic breach, access 145 million records
#36"3 months ago"... And "eBay suggest users chanche their password"... Wait, what? I suggest a policy where important breaches in security are disclosed within a short timeframe.
They didn't know about the breach until about two weeks ago [1], though that doesn't normally excuse that they waited two weeks to go public with the knowledge. One reason to hold back this information is if going public would make their investigation harder OR if going public would increase the security risk (e.g. if the security hole used wasn't yet fixed and going public meant disclosing something about how the ha…
Agree. Those should be the only reason not to disclose breaches (to the public).
Re: Hackers raid eBay in historic breach, access 145 million records
#37Too bad security isn't a concern; only the almighty dollar, right?
Cheap excuses for security only add salt to the wound.
Re: Hackers raid eBay in historic breach, access 145 million records
#38From the comments:
"This really won’t affect anything. Most people these days are use to being hacked, spied on and violated."
Re: Hackers raid eBay in historic breach, access 145 million records
#39How many billion $ companies will it take before we finally rid ourselves of plain-text password authentication (regardless of whether or not it's performed over TLS, or they're using a 'good' hash function for verification)? The lack of a usable secure password authentication standards for the web is the most pressing issue in web security these days. If there's one thing in the next HTML standard that should be dep…
There is no usable secure password authentication standard that will protect from password compromise after password database leak. In fact, if you're talking about SRP, it's worse in this regard compared to, say, using bcrypt.