There is no evidence yet that this is real, so we're burying the post.
eBay user data for sale?
81–90 of 110 posts
Re: eBay user data for sale?
#82None of the sample e-mail addresses contains "ebay", as in "example+ebay@gmail.com". I just thought that was interesting.
Does eBay even allow you to enter that? What benefit would that provide?
example+ebay@gmail.com and example@gmail.com point to the same GMail inbox; you can use the part after + sign to filter incoming mail. A quite useful feature, I must say.
Re: eBay user data for sale?
#83None of the sample e-mail addresses contains "ebay", as in "example+ebay@gmail.com". I just thought that was interesting.
Does eBay even allow you to enter that? What benefit would that provide?
It's a feature of gmail to provide unique addresses. It might protect your other accounts that use your base e-mail address from an automated attack vs. the compromised data. It doesn't matter much if the database goes public, though.
Re: eBay user data for sale?
#84None of the sample e-mail addresses contains "ebay", as in "example+ebay@gmail.com". I just thought that was interesting.
Does eBay even allow you to enter that? What benefit would that provide?
It doesn't cost you anything, and few things piss me off when I'm signing up for a service than when it won't let me use an RFC-valid email address because it has stupid validation in place.
Re: eBay user data for sale?
#85None of the sample e-mail addresses contains "ebay", as in "example+ebay@gmail.com". I just thought that was interesting.
Does eBay even allow you to enter that? What benefit would that provide?
Why wouldn't they?
I do this with almost every website as a way to segregate or block mail if needed. It's pretty eye opening to see what companies trade or sell your email addresses.
Re: eBay user data for sale?
#86Earlier quoted context omitted.
Let's do the math: A PBKDF2 cost factor/iteration count of 12000 and 32-byte output means each candidate passphrase costs 12002 SHA256 blocks. I can buy a crappy bitcoin miner which will do 2GH/s for about USD19. Let's say we're going to use the Gawker leak as our dictionary. That's ~200,000 candidate passwords. For a given user, I can therefore find their password (if it exists in the Gawker set) in 12002 * 200000 =…
Bitcoin miners can not be re-purposed. They take a header input and output only nonces, not hash results.
I think the point is that if there's a bitcoin miner doing 2GH/sec for $19, the operation is cheap.
Re: eBay user data for sale?
#87Earlier quoted context omitted.
I don't think hashing an address is a very good way to store it, recovery might take a while. Likely the poster means person information. Name, date of birth, address, back up email, phone number should be encrypted. Even just using the users password as a key would be better then clear text.
Wouldn't it be easier to "guess" the passwords then? If you know both input and output.
It wouldn't be difficult, but a bandage is better then leaving a gaping wound. Yes it would be better store a second salt and do a scrypt style password generation.
Re: eBay user data for sale?
#88Earlier quoted context omitted.
Bitcoin miners can not be re-purposed. They take a header input and output only nonces, not hash results.
I think the point is that if there's a bitcoin miner doing 2GH/sec for $19, the operation is cheap.
No, the cost is due to scale. Producing ASIC chips involves millions of dollars of setup.
Re: eBay user data for sale?
#89None of the sample e-mail addresses contains "ebay", as in "example+ebay@gmail.com". I just thought that was interesting.
Does eBay even allow you to enter that? What benefit would that provide?
I know what it does, I use it to categorize stuff I email to myself (+reading, +reference, etc.). I just don't see how it would help filtering against some who also knows what it does. Maybe they don't show up in the list because they stripped it out already.
Re: eBay user data for sale?
#90I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?
properly salted hashs can still harm many peple. You could still run a brute force on the top 10k most common passwords and with ~150m averge computer users, you're going to get a few. And you have their email address. There's a good chance they're using the same password for email. Now you have their email.
With user-individual salts and assuming 100ms for a password trial, 100ms * 150e6 * 10e3 is approximately 4750 years, and while this can be done in parallel, it's not exactly a small amount of resources you'd have to devote to get these relatively simple passwords.