4 ms·

"When customers clicked on a listing that had been compromised, they were brought to a sophisticated, official-looking site that asked victims to log in and sha

by Kenji 12y ago

"When customers clicked on a listing that had been compromised, they were brought to a sophisticated, official-looking site that asked victims to log in and share bank account details." Please. One glance at the URL ("vip-ohota.com.ua") and the fact that it's not SSL reveals that something fishy is going on. This is very, very basic, even non-tech people should look at the URL when they enter their information. You wouldn't tell a stranger your credit card number, you'd make sure you're talking to the right person.

vegardx 12y ago
A listing shouldn't take you out of Ebay. It's that simple. Ebay needs to fix this issue, yesterday. Non-tech savvy users don't always know what to look for, especially not when they're following what should be legitimate links.
nwh 12y ago
It's unreasonable to expect that of people. URLs are maddeningly maddling to parse even if you know what is going on, if you don't it's almost impossible to explain it. Why is ebay.com.au different to ebay.com.au.edgesuite.net, should I worry if I see that? Why is edgesuite alright for hosting the images on? It's a rabbit warren of edge cases and exceptions that defied all normal levels of explanations.
- Kenji 12y ago
  If it's unreasonable to expect that of people, it's unreasonable of people to expect security.
  - ZeroMinx 12y ago
    Disagree. We technical people instinctively know there's a fundamental difference between those 2 domains. Normal people don't. And why should they? We (tech people) have to get the situation to a point where we don't expect normal people to have to know all these silly details. I'm not doing anything to help achieve this, I'm hoping other people are :)
    - Kenji 12y ago
      But people will always have to be careful about who they're negotiating with and what information they're revealing. You can't engineer that away. And it can't get much simpler than looking for a SSL lock and matching a string.
      - alelefant 12y ago
        You're missing the point, and you make it seem like everyone should be an expert in everything. Not everybody that uses a computer understands the thick stack of technologies at play. It may seem simple to you, but that's you. When my car makes a noise, I take it to Don the Car Care Man because aside from replacing the battery and windshield wipers I can't do much. If they told me I needed to get part X replaced, I'd trust their input and buy part X. When people visit eBay, there is an inherit level of trust placed in that site. It's a legitimate business used around the world. If a listing links outside of eBay and is asking for personal information, not everyone understands that such behavior is a sign of an attack. My grandma doesn't know what a URL is. If I told her to visit my companies website, she would ask where it is in her bookmarks. Just like I would ask where part X in my car goes. To me that's a very basic question; to a car expert they might be thinking: "Good thing this guy is having us take care of the problem".
        Karunamon 12y ago
        How is checking basic stuff an implication that everyone should be an expert in everything?! Someone learned enough to start up a computer, log in, access their web browser, navigate to an online storefront, select products they want to buy, navigate through the checkout process, and enter their details to effect the purchase has already demonstrated the pattern matching skills and knowledge necessary to answer the easy question "Is the picture of the lock there?" and the slightly more involved question "Do the words up match with where the page says I am?" I'd be willing to bet your grandma can understand "When you're shopping somewhere, make sure the lock icon is in that bar at the top of the window before you put your credit card in". This is stuff that's been drilled into people since the early 90's when eCommerce began to become a thing. It's not arcane knowledge, hardly "expert" level, it's a basic skill that anyone who shops online should have. The idea that we can advocate against users having that skill provides dubious benefit to systems security and a handicap to what is the weakest link in any secure process, the human element. Anything we can do to make end users more skeptical is a Good Thing.
  - tehwebguy 12y ago
    Maybe so (I disagree) but this is really an issue of who eBay is trying to serve IMO. On one hand they want the site to be friendly to the power-users that make up what I would guess is the majority of the products that sell, on the other hand are users that are deciding between eBay or Amazon and don't care to know the difference. My guess is that eBay isn't competing with some other auction site or even Craigslist for most buyers, but Amazon.
  - freehunter 12y ago
    It's not always easy even for technical people. For example, I bought a game not long ago. When I bought it, the game wasn't on Steam or Origin or common gaming stores. You bought it directly from their site. So I go to http://www.beamng.com http://www.beamng.com. I click the link that says "buy it now". I'm suddenly redirected to http://sites.fastspring.com/beamng/product/alpha http://sites.fastspring.com/beamng/product/alpha Both of these sites are unencrypted, and the second site has nothing to do with the first site. Do I book it out of there? All signs say yes. I wanted to buy a game from BeamNG, not from Fast Spring, whatever the hell that is. I've never even heard of them. If we train users to follow the best practices, this game would never have a single sale. If people want to buy this game, they have to ignore that. How do we teach exceptions? Now we're getting into the territory where it's too difficult to teach to people who aren't techies. If I have a cough, I take Robitussin. If it doesn't go away, I go to the doctor because I am not a medical expert. It's not that I can't be taught how to tell what is wrong with me, its that it's unreasonable for me to know that and still keep my day job. If I knew that, I would be a doctor. If users knew every exception to security, they would be security engineers.
wdewind 12y ago
A general rule: as a technologist if you find yourself blaming the user, you are doing it wrong.

by Kenji 12y ago

vegardx 12y ago

A listing shouldn't take you out of Ebay. It's that simple. Ebay needs to fix this issue, yesterday. Non-tech savvy users don't always know what to look for, especially not when they're following what should be legitimate links.

nwh 12y ago

It's unreasonable to expect that of people. URLs are maddeningly maddling to parse even if you know what is going on, if you don't it's almost impossible to explain it. Why is ebay.com.au different to ebay.com.au.edgesuite.net, should I worry if I see that? Why is edgesuite alright for hosting the images on? It's a rabbit warren of edge cases and exceptions that defied all normal levels of explanations.

Kenji 12y ago
If it's unreasonable to expect that of people, it's unreasonable of people to expect security.
- ZeroMinx 12y ago
  Disagree. We technical people instinctively know there's a fundamental difference between those 2 domains. Normal people don't. And why should they? We (tech people) have to get the situation to a point where we don't expect normal people to have to know all these silly details. I'm not doing anything to help achieve this, I'm hoping other people are :)
  - Kenji 12y ago
    But people will always have to be careful about who they're negotiating with and what information they're revealing. You can't engineer that away. And it can't get much simpler than looking for a SSL lock and matching a string.
    - alelefant 12y ago
      You're missing the point, and you make it seem like everyone should be an expert in everything. Not everybody that uses a computer understands the thick stack of technologies at play. It may seem simple to you, but that's you. When my car makes a noise, I take it to Don the Car Care Man because aside from replacing the battery and windshield wipers I can't do much. If they told me I needed to get part X replaced, I'd trust their input and buy part X. When people visit eBay, there is an inherit level of trust placed in that site. It's a legitimate business used around the world. If a listing links outside of eBay and is asking for personal information, not everyone understands that such behavior is a sign of an attack. My grandma doesn't know what a URL is. If I told her to visit my companies website, she would ask where it is in her bookmarks. Just like I would ask where part X in my car goes. To me that's a very basic question; to a car expert they might be thinking: "Good thing this guy is having us take care of the problem".
      - Karunamon 12y ago
        How is checking basic stuff an implication that everyone should be an expert in everything?! Someone learned enough to start up a computer, log in, access their web browser, navigate to an online storefront, select products they want to buy, navigate through the checkout process, and enter their details to effect the purchase has already demonstrated the pattern matching skills and knowledge necessary to answer the easy question "Is the picture of the lock there?" and the slightly more involved question "Do the words up match with where the page says I am?" I'd be willing to bet your grandma can understand "When you're shopping somewhere, make sure the lock icon is in that bar at the top of the window before you put your credit card in". This is stuff that's been drilled into people since the early 90's when eCommerce began to become a thing. It's not arcane knowledge, hardly "expert" level, it's a basic skill that anyone who shops online should have. The idea that we can advocate against users having that skill provides dubious benefit to systems security and a handicap to what is the weakest link in any secure process, the human element. Anything we can do to make end users more skeptical is a Good Thing.
- tehwebguy 12y ago
  Maybe so (I disagree) but this is really an issue of who eBay is trying to serve IMO. On one hand they want the site to be friendly to the power-users that make up what I would guess is the majority of the products that sell, on the other hand are users that are deciding between eBay or Amazon and don't care to know the difference. My guess is that eBay isn't competing with some other auction site or even Craigslist for most buyers, but Amazon.
- freehunter 12y ago
  It's not always easy even for technical people. For example, I bought a game not long ago. When I bought it, the game wasn't on Steam or Origin or common gaming stores. You bought it directly from their site. So I go to http://www.beamng.com http://www.beamng.com. I click the link that says "buy it now". I'm suddenly redirected to http://sites.fastspring.com/beamng/product/alpha http://sites.fastspring.com/beamng/product/alpha Both of these sites are unencrypted, and the second site has nothing to do with the first site. Do I book it out of there? All signs say yes. I wanted to buy a game from BeamNG, not from Fast Spring, whatever the hell that is. I've never even heard of them. If we train users to follow the best practices, this game would never have a single sale. If people want to buy this game, they have to ignore that. How do we teach exceptions? Now we're getting into the territory where it's too difficult to teach to people who aren't techies. If I have a cough, I take Robitussin. If it doesn't go away, I go to the doctor because I am not a medical expert. It's not that I can't be taught how to tell what is wrong with me, its that it's unreasonable for me to know that and still keep my day job. If I knew that, I would be a doctor. If users knew every exception to security, they would be security engineers.

wdewind 12y ago

A general rule: as a technologist if you find yourself blaming the user, you are doing it wrong.