5 ms·
eBay user data for sale?
- kanzure 12y agoHa! That's cute. The joke is that anyone can send any relevant transaction hash that they see straight by email. Obviously, if they were serious, they would offer a unique Bitcoin address to each prospective buyer.
- hughes 12y agoHacking as a spectator sport: we get to watch the blockchain for buyers![0] [0] https://blockchain.info/address/1e4aLP3jKD9wRAcSRNVb7VHbd7KbcdPfA https://blockchain.info/address/1e4aLP3jKD9wRAcSRNVb7VHbd7Kb...
- rwmj 12y agoOr at least for people gullible enough to send $1000 speculatively to a random person on the internet.
- pyalot2 12y agoClearly there's some unsolved problem there. Somebody come up with some proof of data algorithm and associated blockchain...
- aqme28 12y agoProtocol question: What's to stop me from emailing one of those txn-ids to KbcdPfA@hushmail.com and stealing the dump?
- nwh 12y agoNothing. People make this mistake when doing legitimate things too. You're meant to make a new address for every single client. The response could be that they only send to unique TXID that haven't been used before, but you can always race it out by sending the email first.
- glomph 12y agoSmart sellers would require you to sign your message with the bitcoin address that paid.
- ForHackernews 12y agoI have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?
- andrewmunsell 12y agoThere aren't any plain text passwords, but there are email addresses, physical addresses, phone numbers, and DOBs.
- rwmj 12y agoIt's the DoB which is the giveaway (that this is fake). eBay doesn't collect date of birth, but does collect lots of other authentication information. EDIT: I stand corrected, see the reply by sp332 below.
- sp332 12y agoeBay says the data includes DoB. https://blog.ebay.com/ebay-inc-ask-ebay-users-change-passwords/ https://blog.ebay.com/ebay-inc-ask-ebay-users-change-passwor... [edit: better link] Maybe they only collect it for certain customers?
- crest 12y agoIn that case ebay users should probably change their date of birth too ;-).
- mikeash 12y agoAnd physical address and phone number.
- ForHackernews 12y agoFake your own death and run away to Argentina.
- daveove 12y agoJust reset my password and was greeted by this message: To protect the security and privacy of our customers, we’re asking all eBay users to reset their passwords on or after May 21, 2014. If you already reset your password and forgot it, please follow the reset process below. Learn more
- kerridge0 12y agoquick somebody automatically send thousands of "spam" claim emails whenever a payment is made!
- Eye_of_Mordor 12y agoWhy didn't they sell it on eBay?
- nofinator 12y agoEXCELLENT SELLER!!1 FAST SHIPPING! WOULD BUY FROM HACKER AGAIN!!1 A++++++++++++!
- davidw 12y ago1.453 bitcoin. Reference to the fall of Constantinople, or patternicity at work?
- coldcode 12y agoAll personally identifiable data should be stored in a non usable form. You'd think people by now would know that eventually your data will leave your protection.
- bsaul 12y agoBut then, why store them ?
- TkTech 12y agoI believe that he's implying they would be hashed just like your password and used solely for verification with another system (like transaction authorization).
- valarauca1 12y agoI don't think hashing an address is a very good way to store it, recovery might take a while. Likely the poster means person information. Name, date of birth, address, back up email, phone number should be encrypted. Even just using the users password as a key would be better then clear text.
- rplnt 12y agoWouldn't it be easier to "guess" the passwords then? If you know both input and output.
- valarauca1 12y agoIt wouldn't be difficult, but a bandage is better then leaving a gaping wound. Yes it would be better store a second salt and do a scrypt style password generation.
- tomp 12y agoWhy the ":s"? Are they supposed to offer it for free? Jokes aside, this, hopefully followed by a (class-action?) lawsuit, is the only way that the companies will learn how to properly store user data. The engineers have been talking about "best practices" for a very long time, but it appears managers only understand the language of money.
- deleted 12y ago[deleted]
- akerl_ 12y agoLet's not attempt to justify profiting from stolen personal data. This isn't a glorious mission to save the world from poor security practices, this is somebody trying to make money selling people's personal information.
- tomp 12y agoYou're a brilliant hacker, you lurk on security and blackhat forums, you know exploits inside and out. One day, you decide to check the security of some big consumer websites, and you find a security hole. What do you do (choose your adventure style)? * You're a white-hat honest hacker, and all you want is for the internet to be a safer place. You decide to report the vulnerability to the company. Unfortunately, after you sent the email to their engineering team, they told you that the security hole you found isn't critical and refuse to award you a bounty. The rest of the emails go unanswered. You try sending emails to some other departments, including customer support, sales, and legal. No response. 2 months after that, when you're taking a dump on the toilet, federal agents burst into your apartment, knock you down and arrest you without even giving you the chance to wipe your ass. You're charged with industrial espionage, breach of security, and conspiracy to defraud. It turns out that someone did read your emails, checked out the logs, found traces of you researching the security hole. Your defense that you were trying to help is summarily dismissed and you rot in jail. * You think most people are too serious and need to relax. You decide to have some fun. You download tons of embarrassing data from the company website, write them an untraceable email demanding 1000 BTC and public disclosure of your skills. You're pretty sure they will refuse your request, which they soon do. You troll the company by disclosing that they were hacked, and decide to sell the security hole to the highest bidder. You also sell chinks of data to random hackers and credit card scammers. You retire to a tropical island, drink martini and surf all day.
- sogen 12y agoHey, you can buy it cheaper! 0.5 BTC here http://pastebin.com/Tfs07HDp http://pastebin.com/Tfs07HDp
- pdx 12y agohttps://blockchain.info/address/1Kfxm6Y5bRDnC9JLwq6vpYYcw439zgvVzB https://blockchain.info/address/1Kfxm6Y5bRDnC9JLwq6vpYYcw439...
- rcthompson 12y agoSo, should I also change my security question?
- bkurtz13 12y agoI'm really getting tired of having to change my cat's name.
- rcthompson 12y agoHey, that's nothing! Now I have to change my mother's maiden name!
- twistedpair 12y agoPoor kitty. You should just give it a wildcard name.
- ForHackernews 12y agoHere, Mr. (Fuzz|Purr|Meow)[aeo](les|ly|ey)!
- praeivis 12y agoThey should start auction on e-bay. ijs.
- scottydelta 12y agoHaha, smartasses :D
- hamidr 12y ago:D
- JonnieCache 12y agoNow that is a nice route to some fast cash. (I'm assuming that no CSV file will actually be forthcoming.) Kudos to to whoever moved quickly on this one. A fool and his money...
- CompuHacker 12y agoNone of the sample e-mail addresses contains "ebay", as in "example+ebay@gmail.com". I just thought that was interesting.
- jasonkostempski 12y agoDoes eBay even allow you to enter that? What benefit would that provide?
- TeMPOraL 12y agoexample+ebay@gmail.com and example@gmail.com point to the same GMail inbox; you can use the part after + sign to filter incoming mail. A quite useful feature, I must say.
- jack-r-abbit 12y agoI had no idea that feature existed! Nice.
- ptk 12y agoI love that feature as well, but I must say that I'm thwarted by faulty email address verification logic at least 75% of the time and end up resorting to my no-frills address.
- CompuHacker 12y agoIt's a feature of gmail to provide unique addresses. It might protect your other accounts that use your base e-mail address from an automated attack vs. the compromised data. It doesn't matter much if the database goes public, though.
- SoftwareMaven 12y agoIt doesn't cost you anything, and few things piss me off when I'm signing up for a service than when it won't let me use an RFC-valid email address because it has stupid validation in place.
- 12y ago
- platz 12y agoWhy is this on the HN front page?
- nwh 12y agoIs there anything to suggest this is real? Classic scam would be to just sell a bunch of random data, people tried that when Mt Gox was compromised. People apparently provided "samples" on IRC with either random data or data from other leaks presented as being from the Bitcoin exchange. A quick google search shows • http://pastebin.com/L7CYznfK http://pastebin.com/L7CYznfK • http://pastebin.com/4YRgEwPb http://pastebin.com/4YRgEwPb that have the same message with different bitcoin addresses.
- icebraining 12y agoAnd more here (from the list of public pastes): http://pastebin.com/YA2b6xCZ http://pastebin.com/YA2b6xCZ http://pastebin.com/u4feDLAQ http://pastebin.com/u4feDLAQ http://pastebin.com/NQWEnW2v http://pastebin.com/NQWEnW2v
- runn1ng 12y agoSlightly racist observation about the sample data: there is surprisingly large amount of Asian-sounding and Middle-East-sounding names there. Not sure how the data was chosen, but I would expect more... white-sounding names.
- kapkapkap 12y agoIt says sample "from apac region" right in the pastebin.
- runn1ng 12y agoOh. I missed that. That makes sense then.
- MrMeker 12y agoThe announcement says the sample is from the "apac" region, which I think is Asia-Pacific.
- hnriot 12y agothat's not racist at all, just unobservant. It's not racism to think a name sounds Asian. How did we get so confused about terms like racism and feminism.
- mpg33 12y ago$750 for a copy...seems reasonably
- twistedpair 12y agoWorth more than $1000, wouldn't you think? Or perhaps Ebay will buy it regardless of the price, in hopes of quashing this?
- icebraining 12y agoNobody said s/he would only sell it once. It's $1000 per copy. Assuming it's true, of course.
- ssw1n 12y agoIt would be hilarious if the seller accept bids for that on eBay ....
- dang 12y agoThere is no evidence yet that this is real, so we're burying the post.
- Velox 12y agoJust because there is no evidence doesn't mean that it should be ignored. Lots of things don't yet have evidence but it is still worth letting people know so that they are ready to take the appropriate action when the time comes. Let's face it. Lots of posts on HN are pure speculation but they don't get buried. In this case, leaving it up won't do any harm? If it's not real, then no problem. You may have convinced a few people that they should change their passwords though, but that is a good thing. If it is real, then people will already have changed their passwords. It is win win. Personally, I'm getting really sick of the mods deciding what news is and isn't relevant and/or suitable for me.
- dang 12y agoNo one is purporting to decide what's suitable for you personally. It's a question of what belongs on the HN front page. If the speculation were coming from a known source, this might be a harder call. But an anonymous pastebin that no one has any evidence for? That falls below any standard. So what you're really saying is that HN should have no editors at all, and that's not how HN has ever worked.
- dcx 12y agoThis was a good call. eBay has just officially denied that the user data is theirs [1], and there are claims online that the data was from a separate previous breach [2]. This is almost definitely a scam. [1] http://www.digitalnewsasia.com/security/ebay-hackers-offer-details-of-malaysian-users-as-proof http://www.digitalnewsasia.com/security/ebay-hackers-offer-d... [2] http://www.reddit.com/r/netsec/comments/267015/ebay_user_database_compromised_all_users_urged_to/chogdu3 http://www.reddit.com/r/netsec/comments/267015/ebay_user_dat...
- daveove 12y agoSee my post below - ebay states this when you reset your password: To protect the security and privacy of our customers, we’re asking all eBay users to reset their passwords on or after May 21, 2014. If you already reset your password and forgot it, please follow the reset process below. Learn more Try with an ebay account and then revisit this decision.
- numberwhun 12y agoEven if it is real, the losers haven't been paid anything: https://blockchain.info/address/1e4aLP3jKD9wRAcSRNVb7VHbd7KbcdPfA https://blockchain.info/address/1e4aLP3jKD9wRAcSRNVb7VHbd7Kb...