Live data from Hacker News

eBay user data for sale?

pastebin.com

11–20 of 110 posts

Re: eBay user data for sale?

#11

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

I've had an eBay account for 10+ years. I thought a "hey, we screwed up, please change your password" type email would be nice.

Re: eBay user data for sale?

#12
Just reset my password and was greeted by this message: To protect the security and privacy of our customers, we’re asking all eBay users to reset their passwords on or after May 21, 2014. If you already reset your password and forgot it, please follow the reset process below. Learn more

Re: eBay user data for sale?

#13

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

My guess would be this is less about passwords (which - wild guess here - are probably fairly well-secured) and more about ancillary user meta data.

Re: eBay user data for sale?

#15

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

There aren't any plain text passwords, but there are email addresses, physical addresses, phone numbers, and DOBs.

It's the DoB which is the giveaway (that this is fake). eBay doesn't collect date of birth, but does collect lots of other authentication information.

EDIT: I stand corrected, see the reply by sp332 below.

Re: eBay user data for sale?

#16

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

eBay didn't say what kind of encryption they had, only that they were encrypted. Personally I'm more concerned about the personal information in the leaked data that wasn't protected at all! So sure, change your password, but it won't change the fact that someone got your name, email address, physical address, phone number, and date of birth.

Re: eBay user data for sale?

#17
post #16

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

eBay didn't say what kind of encryption they had, only that they were encrypted. Personally I'm more concerned about the personal information in the leaked data that wasn't protected at all! So sure, change your password, but it won't change the fact that someone got your name, email address, physical address, phone number, and date of birth.

On the plus side, think of how nice it will be to get a happy birthday phone call from a hacker.

Re: eBay user data for sale?

#18

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

The passwords look like this:

    pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc=
I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

Re: eBay user data for sale?

#20
post #15

Earlier quoted context omitted.

There aren't any plain text passwords, but there are email addresses, physical addresses, phone numbers, and DOBs.

It's the DoB which is the giveaway (that this is fake). eBay doesn't collect date of birth, but does collect lots of other authentication information. EDIT: I stand corrected, see the reply by sp332 below.

eBay says the data includes DoB. https://blog.ebay.com/ebay-inc-ask-ebay-users-change-passwor... [edit: better link] Maybe they only collect it for certain customers?
Post reply on HN