Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay is port scanning visitors to their website

blog.nem.ec

Post reply on HN
Print view View original

131–140 of 148 posts

Re: eBay is port scanning visitors to their website

#131

Post by lazyjones »

meowface wrote: post #74
lazyjones wrote: post #8

I thought it would be obvious that eBay is doing this to identify bots (usually on servers) vs. real users (on client-only devices).

That is one of the main purposes, yes. I have no problem with it, personally. Many HN users are very privacy-conscious and consider it not acceptable for any purpose, though; including that one. I think both positions are fine.

> Many HN users are very privacy-conscious and consider it not acceptable for any purpose, though; including that one

It's an opinion, I suppose, but it doesn't seem to be based on reasonable expectations. Anyone can portscan anyone else, lots of security researchers have published their findings from portscanning large IP address ranges etc. ... If I don't want other people to see or access open ports on my system, I can firewall them.

Re: eBay is port scanning visitors to their website

#132

Post by detaro »

lazyjones wrote: post #131
meowface wrote: post #74

Earlier quoted context omitted.

That is one of the main purposes, yes. I have no problem with it, personally. Many HN users are very privacy-conscious and consider it not acceptable for any purpose, though; including that one. I think both positions are fine.

> Many HN users are very privacy-conscious and consider it not acceptable for any purpose, though; including that one It's an opinion, I suppose, but it doesn't seem to be based on reasonable expectations. Anyone can portscan anyone else, lots of security researchers have published their findings from portscanning large IP address ranges etc. ... If I don't want other people to see or access open ports on my system,…

External portscans are quite different from using your own machine to portscan itself/the local network.

Re: eBay is port scanning visitors to their website

#133

Post by matheusmoreira »

dpenguin wrote: post #111
matheusmoreira wrote: post #93

Earlier quoted context omitted.

> Fraud detection is a necessary evil for all financial transaction companies in order to keep costs low for everyone else. That doesn't mean they should be allowed to behave like cybercriminals. The risk of fraud doesn't give them a free pass to abuse our trust and invade our privacy. They aren't entitled to know what software people run on their own computers. Especially if they learn this information through under…

Is “behaving like cyber criminals” bad though? Just because it’s doing something out of the ordinary in terms of tech doesn’t mean it’s bad. Fighting cybercrime is always a cat and mouse game akin to counter terrorism, counter espionage or even plain cops and robbers. You need to think like your enemy, have informers, etc etc, while not harming the good citizens. That’s what is going on here. Are there cops who misus…

It's true that the consequences of being port scanned by some website are probably negligible. However, that is not the real problem.

The real problem is the audacity of these people. They think they can do whatever they want. Not only that, they think they are justified in doing it. They need this information for their own purposes, so they just take it from people without asking, without even informing them. In their minds, what they did was not objectionable. They needed to do it, so they didn't do anything wrong. Those fraudsters left them no choice: they just had to invade the privacy of every single person who visited their website.

It's the same logic every abuser uses. It betrays a fundamental lack of respect for the people who use their service. It's impossible to have trust without this respect.

Re: eBay is port scanning visitors to their website

#134

Post by sq_ »

vetrom wrote: post #128
sq_ wrote: post #127

Earlier quoted context omitted.

I feel like the only good option at this point when purchasing a prebuilt desktop or a laptop is to nuke the drive and do a clean install of Windows. Seems like the only way to ensure that you've killed the crapware and any partitions meant to preserve/reinstall it.

Sometimes that isn't even enough. Windows for example ships with a feature called the "Windows Platform Binary Table" that will load and run DLLs embedded in a machine's ACPI tables.

Wow. Didn't know that existed. Hard to see what legitimate, user-serving purpose that would serve. Or at least how the good of it's inclusion would outweigh possible harms.

Re: eBay is port scanning visitors to their website

#135

Post by ww520 »

aspenmayer wrote: post #124
woodrowbarlow wrote: post #109

Earlier quoted context omitted.

the BSOD minidump should tell you which driver crashed. GUIs exist for analyzing minidumps, it might even be feasible to talk someone through the process over the phone.

One example of a GUI analysis tool for these kinds of memory dumps is WhoCrashed ; another is BlueScreenView . https://www.resplendence.com/whocrashed http://www.nirsoft.net/utils/blue_screen_view.html

Good to know. Thanks.

Re: eBay is port scanning visitors to their website

#136

Post by dpenguin »

matheusmoreira wrote: post #133
dpenguin wrote: post #111

Earlier quoted context omitted.

Is “behaving like cyber criminals” bad though? Just because it’s doing something out of the ordinary in terms of tech doesn’t mean it’s bad. Fighting cybercrime is always a cat and mouse game akin to counter terrorism, counter espionage or even plain cops and robbers. You need to think like your enemy, have informers, etc etc, while not harming the good citizens. That’s what is going on here. Are there cops who misus…

It's true that the consequences of being port scanned by some website are probably negligible. However, that is not the real problem. The real problem is the audacity of these people. They think they can do whatever they want. Not only that, they think they are justified in doing it. They need this information for their own purposes, so they just take it from people without asking, without even informing them. In the…

This notion of invasion of privacy is all relative. If they ask you for your mother’s maiden name or first pet or the city where you had your first kiss, you are okay typing it in a form for them.

If they try to infer the active port numbers on your computer to see if there’s a Remote Desktop installed by a bot, you’re not okay.

What’s the alternative? Do you want them to disclose everything they do in a marketing article even though 99.99% of people will have no clue what that means and 10 of the 100 people that bother to read and understand will use it against them. To what end? To gain your trust? You - who has already given them your credit card number, mothers maiden name and city where you first got intimate with your first partner?

Re: eBay is port scanning visitors to their website

#137

Post by Google234 »

bencollier49 wrote: post #108
Google234 wrote: post #39

Earlier quoted context omitted.

Why is it bad to have it both ways?

Because it's at the expense of the customer.

Fraud is at the expense of the seller and raises prices for the customer. I don’t see how this is at the expense of the customer, I just visit eBay and buy something if I want to.

Re: eBay is port scanning visitors to their website

#138

Post by mycall »

vetrom wrote: post #128
sq_ wrote: post #127

Earlier quoted context omitted.

I feel like the only good option at this point when purchasing a prebuilt desktop or a laptop is to nuke the drive and do a clean install of Windows. Seems like the only way to ensure that you've killed the crapware and any partitions meant to preserve/reinstall it.

Sometimes that isn't even enough. Windows for example ships with a feature called the "Windows Platform Binary Table" that will load and run DLLs embedded in a machine's ACPI tables.

Is there software that will enumerate ACPI for DLLs?

Re: eBay is port scanning visitors to their website

#139

Post by mycall »

the_pwner224 wrote: post #130
ilikenwf wrote: post #118

Earlier quoted context omitted.

This won't actually disable websockets if I recall. There's a blocklist that may make it into uBO in the future that blocks 3rd party access to localhost and other IANA reserved IP addresses, though. https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3A...

That link is incorrect. https://github.com/uBlockOrigin/uBlock-issues/issues/1070

That thread was a fun rabbit hole. !/s

Re: eBay is port scanning visitors to their website

#140

Post by aabbcc1241 »

sq_ wrote: post #127
ezoe wrote: post #103

Earlier quoted context omitted.

A preinstalled local server, presumably running in kernel space for it cause BSOD, crash when connected from localhost and attempted TLS handshake? The preinstalled crapware never changes.

I feel like the only good option at this point when purchasing a prebuilt desktop or a laptop is to nuke the drive and do a clean install of Windows. Seems like the only way to ensure that you've killed the crapware and any partitions meant to preserve/reinstall it.

If you want to stay clean, nuke the drive and install linux instead
Post reply on HN