Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay user data for sale?

pastebin.com

Post reply on HN
Print view View original

61–70 of 110 posts

Re: eBay user data for sale?

#61

Post by [deleted] »

hellbreakslose wrote: post #47
sp332 wrote: post #16

Earlier quoted context omitted.

eBay didn't say what kind of encryption they had, only that they were encrypted. Personally I'm more concerned about the personal information in the leaked data that wasn't protected at all! So sure, change your password, but it won't change the fact that someone got your name, email address, physical address, phone number, and date of birth.

sp332 to be honest here, I am pretty sure if you search your real life name on the internet you will definitely find somewhere that you can buy the information you just mentioned. I am not trying to be mean here, I am just trying to let you know in case you didn't know. Plus you already have your email publicly displayed here ... and i found some weird stuff about amateur ... xxx movies when i googled you T_T

[deleted]

Re: eBay user data for sale?

#62

Post by [deleted] »

tomp wrote: post #26

Why the ":s"? Are they supposed to offer it for free? Jokes aside, this, hopefully followed by a (class-action?) lawsuit, is the only way that the companies will learn how to properly store user data. The engineers have been talking about "best practices" for a very long time, but it appears managers only understand the language of money.

[deleted]

Re: eBay user data for sale?

#63

Post by kapkapkap »

runn1ng wrote: post #57

Slightly racist observation about the sample data: there is surprisingly large amount of Asian-sounding and Middle-East-sounding names there. Not sure how the data was chosen, but I would expect more... white-sounding names.

It says sample "from apac region" right in the pastebin.

Re: eBay user data for sale?

#64

Post by akerl_ »

tomp wrote: post #26

Why the ":s"? Are they supposed to offer it for free? Jokes aside, this, hopefully followed by a (class-action?) lawsuit, is the only way that the companies will learn how to properly store user data. The engineers have been talking about "best practices" for a very long time, but it appears managers only understand the language of money.

Let's not attempt to justify profiting from stolen personal data. This isn't a glorious mission to save the world from poor security practices, this is somebody trying to make money selling people's personal information.

Re: eBay user data for sale?

#65

Post by runn1ng »

kapkapkap wrote: post #63
runn1ng wrote: post #57

Slightly racist observation about the sample data: there is surprisingly large amount of Asian-sounding and Middle-East-sounding names there. Not sure how the data was chosen, but I would expect more... white-sounding names.

It says sample "from apac region" right in the pastebin.

Oh. I missed that. That makes sense then.

Re: eBay user data for sale?

#66

Post by MrMeker »

runn1ng wrote: post #57

Slightly racist observation about the sample data: there is surprisingly large amount of Asian-sounding and Middle-East-sounding names there. Not sure how the data was chosen, but I would expect more... white-sounding names.

The announcement says the sample is from the "apac" region, which I think is Asia-Pacific.

Re: eBay user data for sale?

#67

Post by icebraining »

nwh wrote: post #51

Is there anything to suggest this is real? Classic scam would be to just sell a bunch of random data, people tried that when Mt Gox was compromised. People apparently provided "samples" on IRC with either random data or data from other leaks presented as being from the Bitcoin exchange. A quick google search shows • http://pastebin.com/L7CYznfK • http://pastebin.com/4YRgEwPb that have the same message with different…

And more here (from the list of public pastes):

http://pastebin.com/YA2b6xCZ

http://pastebin.com/u4feDLAQ

http://pastebin.com/NQWEnW2v

Re: eBay user data for sale?

#68

Post by ctz »

surreal wrote: post #29
Mithaldu wrote: post #18

Earlier quoted context omitted.

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

Looks to me like the $ signs are acting as delimiters, and that that hash is made up of: cipher/hash: pbkdf2_sha256 cost factor: 12000 salt: zhMKabMgayvK hash: iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= This exact technique (pretty much) is described here: http://exyr.org/2011/hashing-passwords/ . It's a decent, secure way to hash passwords. Cost factor of 12000 seems solid to me (depends on the hardware they're ru…

Let's do the math:

A PBKDF2 cost factor/iteration count of 12000 and 32-byte output means each candidate passphrase costs 12002 SHA256 blocks.

I can buy a crappy bitcoin miner which will do 2GH/s for about USD19.

Let's say we're going to use the Gawker leak as our dictionary. That's ~200,000 candidate passwords.

For a given user, I can therefore find their password (if it exists in the Gawker set) in 12002 * 200000 = 2.4GH SHA256 applications. That will take 1.2 seconds.

So for all 125 million eBay users, that's about 4 years. This work is trivially parallelisable, so buying more or faster hardware is brutally effective.

Note: there is obviously, and hopefully, a non-negligible probability that a user's password isn't in that set. Brute force of (say) the whole 8 printable-ASCII character password space would take longer but would be guaranteed to find to find about 50% (from Adobe leak) of user's passwords.

Post reply on HN