EBay Inc. To Ask All eBay Users To Change Passwords

On PayPal, it's got really annoying Javascripts that stop you copying and pasting passwords. I use a password manager, so all my passwords are random and unique.

martinml• 12 years ago

I edited the 'value' attribute of the input elements and pasted my password there. Maximum of 20 chars also :\

PaulHoule2• 12 years ago

If you make people change their password there is some chance people just won't do it and won't ever use eBay again... Bye!

jeroen• 12 years ago

The cost of fraudulent activity is probably much higher than the missed revenue from those people.

PaulHoule2• 12 years ago

I dunno.

My wife quit using eBay when her Paypal account got locked out and she'd have to send a fax to unlock it.

I quit using eBay because the auctions stopped and it wasn't possible to get good deals anymore. The AMZN marketplace works better for most of what I buy and if I want something funky there is always etsy.

This is just one more step in eBay's slow decline.

jcr2• 12 years ago

Since I never knew that "www.paypal-community.com" existed, I checked the basics:

  $ nslookup www.paypal-community.com
  Server:         66.174.92.14
  Address:        66.174.92.14#53

  Non-authoritative answer:
  www.paypal-community.com        canonical name = ppl.lithium.com.
  Name:   ppl.lithium.com
  Address: 208.74.205.40

  $ whois paypal-community.com 
  Registrant Name: Host Master
  Registrant Organization: PayPal Inc.
  Registrant Street: 2211 North First Street
  Registrant City: San Jose
  Registrant State/Province: CA
  Registrant Postal Code: 95131
  Registrant Country: US
  Registrant Phone: +1.4083767400
  Registrant Phone Ext:
  Registrant Fax:
  Registrant Fax Ext:
  Registrant Email: hostmaster@ebay.com

  $ whois 208.74.205.40
  NetRange:       208.74.204.0 - 208.74.207.255
  CIDR:           208.74.204.0/22
  OriginAS:
  NetName:        LITHIUM-NET1
  NetHandle:      NET-208-74-204-0-1
  Parent:         NET-208-0-0-0-0
  NetType:        Direct Assignment
  RegDate:        2007-02-09
  Updated:        2012-02-24
  Ref:            http://whois.arin.net/rest/net/NET-208-74-204-0-1
  OrgName:        Lithium Technologies, Inc.
  OrgId:          LITHI
  Address:        225 Bush Street
  Address:        15th floor
  City:           San Francisco
  StateProv:      CA
  PostalCode:     94104
  Country:        US
  RegDate:        2007-01-04
  Updated:        2014-02-25
  Ref:            http://whois.arin.net/rest/org/LITHI
  ...

And of course: http://www.networking4all.com/en/support/tools/site+check/re...

Many pages on paypal-community.com have a "Powered By Lithium" banner, so they seem to be the folks who wrote the "community forum" software.

http://www.lithium.com/

And they're mentioned in the paypal privacy policy:

https://www.paypal.com/uk/webapps/mpp/ua/privacy-full

nwh2• 12 years ago

Almost as bad as Google's ridiculously scammy looking blogspot URLs it uses for official blog posts.

nodata5• 12 years ago

You can put anything you like in the WHOIS database.

jcr2• 12 years ago

Of course it's easy to forge whois data, but that's why you also check the IP address, ASN, SSL Cert, ...

andrey-p• 12 years ago

Lithium is indeed a forum community thing. My housemate works for them as a forum moderator for eBay.

To the topic at hand, I'm not really sure whether the title of the blog post or its contents scare me more.

reuven• 12 years ago

I got e-mail from eBay yesterday (Tuesday), saying that there had been suspicious activity on my account, and that the account was locked, until I changed the password. I haven't bought anything on eBay in a few years. The message said that any charges that my account had incurred had been reversed.

It's probably a sign of the times that I was sure that this was a phishing message. I checked it a whole bunch of ways before deciding that yes, I should change my eBay password. Even so, rather than click on a link in the e-mail message, I went to ebay.com in my browser, and went through the procedure to change my password.

I checked the activity log for my account, and it didn't show anything. So I'm still not sure if this means my account was broken into or used.

If everyone is indeed being asked to change their passwords, then the message I received was a bad way to say it.

mrobert• 12 years ago

For those having trouble navigating Ebay's dashboards to find out how to change the password, here's a link to the page that describes how to do that:

http://pages.ebay.com/help/account/change-password.html

And the direct link:

https://signin.ebay.com/ws/eBayISAPI.dll?ChangePasswordAndCr...

ja27• 12 years ago

That was one of the hardest-to-find password changes I've ever seen.

x1798DE• 12 years ago

What is the point of ebay redirecting HTTPS versions of their site to an HTTP version? They have an EV cert and everything for the login page. Is it spite?

nodata5• 12 years ago

There is no information here at all. Flagged.

mpclark4• 12 years ago

That's just silly. The headline, the subject matter and the fact that it's on a company domain all add up to plenty of information. The fact that it appears to have been prematurely posted adds more interest.

nodata5• 12 years ago

It's speculation with no information at all. This isn't HN Rumors, and that link doesn't even go to a tweet - it goes to a page full of no information.

mihai_ionic• 12 years ago

I just made a PayPal account just the other day.

Now I'm really glad that I used `makepasswd --chars 20`, even though I had to paste the password into the input element's value with Inspect Element.

mpclark4• 12 years ago

Now confirmed by a press release:

http://www.businesswire.com/news/home/20140521005813/en/eBay...

jmac-sjc• 12 years ago

So, will the Board of Directors hold anyone accountable to ?millions? of records being stolen (they have 128 million possible)? For now no CC info was believed lost, but they likely don't have any way to know unless they see fraudulent usage...

EBay Inc. To Ask All eBay Users To Change Passwords

Related Stories