Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay user data for sale?

pastebin.com

Post reply on HN
Print view View original

41–50 of 110 posts

Re: eBay user data for sale?

#41

Post by bsimpson »

nkozyra wrote: post #13
ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

My guess would be this is less about passwords (which - wild guess here - are probably fairly well-secured) and more about ancillary user meta data.

I guess I'm going to have to change my birthdate.

Re: eBay user data for sale?

#44

Post by pyalot2 »

rwmj wrote: post #7
hughes wrote: post #3

Hacking as a spectator sport: we get to watch the blockchain for buyers![0] [0] https://blockchain.info/address/1e4aLP3jKD9wRAcSRNVb7VHbd7Kb...

Or at least for people gullible enough to send $1000 speculatively to a random person on the internet.

Clearly there's some unsolved problem there. Somebody come up with some proof of data algorithm and associated blockchain...

Re: eBay user data for sale?

#47

Post by hellbreakslose »

sp332 wrote: post #16
ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

eBay didn't say what kind of encryption they had, only that they were encrypted. Personally I'm more concerned about the personal information in the leaked data that wasn't protected at all! So sure, change your password, but it won't change the fact that someone got your name, email address, physical address, phone number, and date of birth.

sp332 to be honest here, I am pretty sure if you search your real life name on the internet you will definitely find somewhere that you can buy the information you just mentioned. I am not trying to be mean here, I am just trying to let you know in case you didn't know.

Plus you already have your email publicly displayed here ... and i found some weird stuff about amateur ... xxx movies when i googled you T_T

Re: eBay user data for sale?

#48

Post by unfunco »

Mithaldu wrote: post #18
ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

    $$/
It's more than I expected from eBay, I think because of the likes of LinkedIn and their user credential leak, I expected bad habits from larger companies.

Rainbow tables can't be used against the passwords, so each one will need to be computed individually to either find the result or a collision. That's likely why the seller is only asking for $1000.

Re: eBay user data for sale?

#50

Post by TkTech »

bsaul wrote: post #33
coldcode wrote: post #25

All personally identifiable data should be stored in a non usable form. You'd think people by now would know that eventually your data will leave your protection.

But then, why store them ?

I believe that he's implying they would be hashed just like your password and used solely for verification with another system (like transaction authorization).
Post reply on HN