7 ms·

The spin is atrocious. The big story is not the headline, that users must change passwords. The big story is that ebay leaked personally identifiable informati

by panarky 12y ago

The spin is atrocious. The big story is not the headline, that users must change passwords. The big story is that ebay leaked personally identifiable information. Naturally this is buried four paragraphs down. The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. Don't patronize me with empty platitudes like "changing passwords is a best practice". Tell me to brace for an inevitable wave of phishing and identity attacks. Tell me that bad guys will try to steal my other online accounts with this information. Tell me to trust no one because bad guys now look legit with my home address, phone number and DOB. Pro tip: put the real story in the headline. That's also a "best practice".

joshvm 12y ago
Don't forget that it was nearly three months ago. Why weren't users informed immediately? Do I need to update my PayPal account too? (my email is the same, but both passwords are long and randomised so not too bothered). So now they know my email address and my home address - and my date of birth, always convenient. Oh and as someone pointed out, I have PayPal automatically linked to my eBay account. Great. Which physical address? My default delivery? My invoice address? So a quick update from the BBC: "something it only became aware of a fortnight ago" They only just realised, essentially. Although it's worrying that it took an eCommerce site so long to catch it. And that's still two weeks when eBay knew and nobody else did.
- sschueller 12y ago
  Isn't there a law in California that requires data breach disclosure? Is there a time frame in that law? Three months is way to long and I am sure criminals will use what they get as soon as possible.
  - panarky 12y ago
    Yes, "the disclosure shall be made in the most expedient time possible and without unreasonable delay". http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 http://leginfo.legislature.ca.gov/faces/codes_displaySection... If the breach affects more than 500 California residents, an online report must be filed with the Attorney General. You can search breach reports, and I could not find any from ebay. http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name_value=ebay&field_sb24_breach_date_value%5Bmin%5D%5Bdate%5D=2014-01-01&field_sb24_breach_date_value%5Bmax%5D%5Bdate%5D=2014-05-21 http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name... You can also file a complaint against businesses that fail to disclose breaches here: http://oag.ca.gov/contact/consumer-complaint-against-business-or-company http://oag.ca.gov/contact/consumer-complaint-against-busines...
- twistedpair 12y ago
  Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?
  - oneeyedpigeon 12y ago
    I discovered yesterday that Microsoft (yes, Microsoft!) limits their passwords to between 8 and 16 characters. I'm not sure ANYONE really knows how to implement security even half-properly; I really wish OpenID had taken off.
  - rupert_murdaaa 12y ago
    this always gets me, and every time i ask i can't seem to find a direct answer why so many sites have this 20 character limit. bank of america does as well, with the additional restriction that you can't use the following characters: $ < > & ^ ! []. bluecross/blueshield allows up to 30 characters, but only numbers and letters. if passwords are being hashed, which i guess i would have to believe they are, at least in the BOA case, what's the point of restricting character counts (especially to 20), or choosing random characters to exclude?
    - devicenull 12y ago
      Legacy systems. There's almost certainly some ancient backend system that deals with passwords, and can't handle long passwords or certain special characters. I would not assume that bank passwords are being hashed properly.
    - sokoloff 12y ago
      Choosing random characters to exclude (or alternately, only permitting a subset of characters) can make the task of validating that you aren't subject to an injection attack easier. Note that this validation may take the form of validating to someone, shall we say, less than fully competent, or it could be an actual means to protect yourself. The additional search space from 62^N to 200^N isn't especially worth worrying about, IMO. http://msdn.microsoft.com/en-us/library/bb355989.aspx http://msdn.microsoft.com/en-us/library/bb355989.aspx (to cite just one way that these things come into being; someone finds that you can do input validation easily, and they do it, maybe because they're overly cautious, maybe because someone they need to convince is overly cautious, maybe some other reason) IMO, this is not an especially terrible "flaw" in a site.
- Alupis 12y ago
  > Information security and customer data protection are of paramount importance to eBay Inc Which is exactly why we took 3 months to inform you, you've been hacked. It's because we care. Don't you see?
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
planetjones 12y ago
my thoughts exactly - this is a terribly spun statement by eBay. My personal data has now been leaked to unknown parties and they make light of it by droning on about "best practice" and passwords.
vijucat 12y ago
> customers’ name, encrypted password, email address, physical address, phone number and date of birth Holy crap, isn't that enough to do some social engineering and get a new credit card or something equally serious?!
- kemayo 12y ago
  Not directly -- I don't think I've ever seen a (U.S.) credit card application which didn't also want your social security number. That said, it's a pretty good start.
non-sense 12y ago
Oh Gosh! The oversimplification is mind boggling. Being an ecommerce and payments website they should have been very clear about the impact this breach has on our privacy. Angry.
anujnayar 12y ago
hi everyone - PayPal not affected. https://www.paypal-community.com/t5/PayPal-Forward/eBay-To-Ask-Users-to-Change-Their-Passwords-No-Evidence-PayPal/ba-p/815612 https://www.paypal-community.com/t5/PayPal-Forward/eBay-To-A.... More details on ebay Inc microsite https://info.ebayinc.com https://info.ebayinc.com
unclebucknasty 12y ago
>Don't patronize me with empty platitudes like "changing passwords is a best practice". Made me retch too. Pardon me, but how did your security snafu get to be about telling me what I ought to do? Some sort of amateur reverse psychology? A Jedi mind-trick? Kind of implies that we somehow have responsibility for it too. "Yes, yes, we allowed this to happen, but if you'd only make yourself aware of best practices, you wouldn't have anything to worry about." Very condescending. Just tell me what I need to do to mitigate your screw up. Skip the security lesson and misdirection. I also don't see an apology, but merely "regrets". I'm guessing their legal department weighed in on this one, but that omission, along with the spin, and the whole picture just reads like a big CYA and a "screw you!" to customers.

by panarky 12y ago

joshvm 12y ago

Don't forget that it was nearly three months ago. Why weren't users informed immediately? Do I need to update my PayPal account too? (my email is the same, but both passwords are long and randomised so not too bothered). So now they know my email address and my home address - and my date of birth, always convenient. Oh and as someone pointed out, I have PayPal automatically linked to my eBay account. Great. Which physical address? My default delivery? My invoice address? So a quick update from the BBC: "something it only became aware of a fortnight ago" They only just realised, essentially. Although it's worrying that it took an eCommerce site so long to catch it. And that's still two weeks when eBay knew and nobody else did.

sschueller 12y ago
Isn't there a law in California that requires data breach disclosure? Is there a time frame in that law? Three months is way to long and I am sure criminals will use what they get as soon as possible.
- panarky 12y ago
  Yes, "the disclosure shall be made in the most expedient time possible and without unreasonable delay". http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 http://leginfo.legislature.ca.gov/faces/codes_displaySection... If the breach affects more than 500 California residents, an online report must be filed with the Attorney General. You can search breach reports, and I could not find any from ebay. http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name_value=ebay&field_sb24_breach_date_value%5Bmin%5D%5Bdate%5D=2014-01-01&field_sb24_breach_date_value%5Bmax%5D%5Bdate%5D=2014-05-21 http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name... You can also file a complaint against businesses that fail to disclose breaches here: http://oag.ca.gov/contact/consumer-complaint-against-business-or-company http://oag.ca.gov/contact/consumer-complaint-against-busines...
twistedpair 12y ago
Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?
- oneeyedpigeon 12y ago
  I discovered yesterday that Microsoft (yes, Microsoft!) limits their passwords to between 8 and 16 characters. I'm not sure ANYONE really knows how to implement security even half-properly; I really wish OpenID had taken off.
- rupert_murdaaa 12y ago
  this always gets me, and every time i ask i can't seem to find a direct answer why so many sites have this 20 character limit. bank of america does as well, with the additional restriction that you can't use the following characters: $ < > & ^ ! []. bluecross/blueshield allows up to 30 characters, but only numbers and letters. if passwords are being hashed, which i guess i would have to believe they are, at least in the BOA case, what's the point of restricting character counts (especially to 20), or choosing random characters to exclude?
  - devicenull 12y ago
    Legacy systems. There's almost certainly some ancient backend system that deals with passwords, and can't handle long passwords or certain special characters. I would not assume that bank passwords are being hashed properly.
  - sokoloff 12y ago
    Choosing random characters to exclude (or alternately, only permitting a subset of characters) can make the task of validating that you aren't subject to an injection attack easier. Note that this validation may take the form of validating to someone, shall we say, less than fully competent, or it could be an actual means to protect yourself. The additional search space from 62^N to 200^N isn't especially worth worrying about, IMO. http://msdn.microsoft.com/en-us/library/bb355989.aspx http://msdn.microsoft.com/en-us/library/bb355989.aspx (to cite just one way that these things come into being; someone finds that you can do input validation easily, and they do it, maybe because they're overly cautious, maybe because someone they need to convince is overly cautious, maybe some other reason) IMO, this is not an especially terrible "flaw" in a site.
Alupis 12y ago
> Information security and customer data protection are of paramount importance to eBay Inc Which is exactly why we took 3 months to inform you, you've been hacked. It's because we care. Don't you see?
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]

planetjones 12y ago

my thoughts exactly - this is a terribly spun statement by eBay. My personal data has now been leaked to unknown parties and they make light of it by droning on about "best practice" and passwords.

vijucat 12y ago

> customers’ name, encrypted password, email address, physical address, phone number and date of birth Holy crap, isn't that enough to do some social engineering and get a new credit card or something equally serious?!

kemayo 12y ago
Not directly -- I don't think I've ever seen a (U.S.) credit card application which didn't also want your social security number. That said, it's a pretty good start.

non-sense 12y ago

Oh Gosh! The oversimplification is mind boggling. Being an ecommerce and payments website they should have been very clear about the impact this breach has on our privacy. Angry.

anujnayar 12y ago

hi everyone - PayPal not affected. https://www.paypal-community.com/t5/PayPal-Forward/eBay-To-Ask-Users-to-Change-Their-Passwords-No-Evidence-PayPal/ba-p/815612 https://www.paypal-community.com/t5/PayPal-Forward/eBay-To-A.... More details on ebay Inc microsite https://info.ebayinc.com https://info.ebayinc.com

unclebucknasty 12y ago

>Don't patronize me with empty platitudes like "changing passwords is a best practice". Made me retch too. Pardon me, but how did your security snafu get to be about telling me what I ought to do? Some sort of amateur reverse psychology? A Jedi mind-trick? Kind of implies that we somehow have responsibility for it too. "Yes, yes, we allowed this to happen, but if you'd only make yourself aware of best practices, you wouldn't have anything to worry about." Very condescending. Just tell me what I need to do to mitigate your screw up. Skip the security lesson and misdirection. I also don't see an apology, but merely "regrets". I'm guessing their legal department weighed in on this one, but that omission, along with the spin, and the whole picture just reads like a big CYA and a "screw you!" to customers.