7 ms·

Don't forget that it was nearly three months ago. Why weren't users informed immediately? Do I need to update my PayPal account too? (my email is the same, bu

by joshvm 12y ago

Don't forget that it was nearly three months ago. Why weren't users informed immediately? Do I need to update my PayPal account too? (my email is the same, but both passwords are long and randomised so not too bothered). So now they know my email address and my home address - and my date of birth, always convenient. Oh and as someone pointed out, I have PayPal automatically linked to my eBay account. Great. Which physical address? My default delivery? My invoice address? So a quick update from the BBC: "something it only became aware of a fortnight ago" They only just realised, essentially. Although it's worrying that it took an eCommerce site so long to catch it. And that's still two weeks when eBay knew and nobody else did.

sschueller 12y ago
Isn't there a law in California that requires data breach disclosure? Is there a time frame in that law? Three months is way to long and I am sure criminals will use what they get as soon as possible.
- panarky 12y ago
  Yes, "the disclosure shall be made in the most expedient time possible and without unreasonable delay". http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 http://leginfo.legislature.ca.gov/faces/codes_displaySection... If the breach affects more than 500 California residents, an online report must be filed with the Attorney General. You can search breach reports, and I could not find any from ebay. http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name_value=ebay&field_sb24_breach_date_value%5Bmin%5D%5Bdate%5D=2014-01-01&field_sb24_breach_date_value%5Bmax%5D%5Bdate%5D=2014-05-21 http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name... You can also file a complaint against businesses that fail to disclose breaches here: http://oag.ca.gov/contact/consumer-complaint-against-business-or-company http://oag.ca.gov/contact/consumer-complaint-against-busines...
twistedpair 12y ago
Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?
- oneeyedpigeon 12y ago
  I discovered yesterday that Microsoft (yes, Microsoft!) limits their passwords to between 8 and 16 characters. I'm not sure ANYONE really knows how to implement security even half-properly; I really wish OpenID had taken off.
- rupert_murdaaa 12y ago
  this always gets me, and every time i ask i can't seem to find a direct answer why so many sites have this 20 character limit. bank of america does as well, with the additional restriction that you can't use the following characters: $ < > & ^ ! []. bluecross/blueshield allows up to 30 characters, but only numbers and letters. if passwords are being hashed, which i guess i would have to believe they are, at least in the BOA case, what's the point of restricting character counts (especially to 20), or choosing random characters to exclude?
  - devicenull 12y ago
    Legacy systems. There's almost certainly some ancient backend system that deals with passwords, and can't handle long passwords or certain special characters. I would not assume that bank passwords are being hashed properly.
  - sokoloff 12y ago
    Choosing random characters to exclude (or alternately, only permitting a subset of characters) can make the task of validating that you aren't subject to an injection attack easier. Note that this validation may take the form of validating to someone, shall we say, less than fully competent, or it could be an actual means to protect yourself. The additional search space from 62^N to 200^N isn't especially worth worrying about, IMO. http://msdn.microsoft.com/en-us/library/bb355989.aspx http://msdn.microsoft.com/en-us/library/bb355989.aspx (to cite just one way that these things come into being; someone finds that you can do input validation easily, and they do it, maybe because they're overly cautious, maybe because someone they need to convince is overly cautious, maybe some other reason) IMO, this is not an especially terrible "flaw" in a site.
Alupis 12y ago
> Information security and customer data protection are of paramount importance to eBay Inc Which is exactly why we took 3 months to inform you, you've been hacked. It's because we care. Don't you see?
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]

by joshvm 12y ago

sschueller 12y ago

Isn't there a law in California that requires data breach disclosure? Is there a time frame in that law? Three months is way to long and I am sure criminals will use what they get as soon as possible.

panarky 12y ago
Yes, "the disclosure shall be made in the most expedient time possible and without unreasonable delay". http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 http://leginfo.legislature.ca.gov/faces/codes_displaySection... If the breach affects more than 500 California residents, an online report must be filed with the Attorney General. You can search breach reports, and I could not find any from ebay. http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name_value=ebay&field_sb24_breach_date_value%5Bmin%5D%5Bdate%5D=2014-01-01&field_sb24_breach_date_value%5Bmax%5D%5Bdate%5D=2014-05-21 http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name... You can also file a complaint against businesses that fail to disclose breaches here: http://oag.ca.gov/contact/consumer-complaint-against-business-or-company http://oag.ca.gov/contact/consumer-complaint-against-busines...

twistedpair 12y ago

Damn, PayPal updated their password reset UI in the last week, but you can still only enter 20 characters for a site that holds cold hard (electronic) cash. Really guys? If you're really hashing them, why does the length matter? The DB column width doesn't need to change. Want us to submit a patch? P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?

oneeyedpigeon 12y ago
I discovered yesterday that Microsoft (yes, Microsoft!) limits their passwords to between 8 and 16 characters. I'm not sure ANYONE really knows how to implement security even half-properly; I really wish OpenID had taken off.
rupert_murdaaa 12y ago
this always gets me, and every time i ask i can't seem to find a direct answer why so many sites have this 20 character limit. bank of america does as well, with the additional restriction that you can't use the following characters: $ < > & ^ ! []. bluecross/blueshield allows up to 30 characters, but only numbers and letters. if passwords are being hashed, which i guess i would have to believe they are, at least in the BOA case, what's the point of restricting character counts (especially to 20), or choosing random characters to exclude?
- devicenull 12y ago
  Legacy systems. There's almost certainly some ancient backend system that deals with passwords, and can't handle long passwords or certain special characters. I would not assume that bank passwords are being hashed properly.
- sokoloff 12y ago
  Choosing random characters to exclude (or alternately, only permitting a subset of characters) can make the task of validating that you aren't subject to an injection attack easier. Note that this validation may take the form of validating to someone, shall we say, less than fully competent, or it could be an actual means to protect yourself. The additional search space from 62^N to 200^N isn't especially worth worrying about, IMO. http://msdn.microsoft.com/en-us/library/bb355989.aspx http://msdn.microsoft.com/en-us/library/bb355989.aspx (to cite just one way that these things come into being; someone finds that you can do input validation easily, and they do it, maybe because they're overly cautious, maybe because someone they need to convince is overly cautious, maybe some other reason) IMO, this is not an especially terrible "flaw" in a site.

Alupis 12y ago

> Information security and customer data protection are of paramount importance to eBay Inc Which is exactly why we took 3 months to inform you, you've been hacked. It's because we care. Don't you see?

deleted 12y ago

[deleted]

deleted 12y ago

[deleted]