EBay Inc. To Ask All eBay Users To Change Passwords(paypal-community.com)

23 pointsby mpclarkvor 12 Jahren30 comments

EBay Inc. To Ask All eBay Users To Change Passwords

https://www.paypal-community.com/t5/PayPal-Forward/eBay-Inc-To-Ask-All-eBay-Users-To-Change-Passwords/ba-p/815276

11 comments

jcrvor 12 Jahren

Since I never knew that "www.paypal-community.com" existed, I checked the basics:

  $ nslookup www.paypal-community.com
  Server:         66.174.92.14
  Address:        66.174.92.14#53

  Non-authoritative answer:
  www.paypal-community.com        canonical name = ppl.lithium.com.
  Name:   ppl.lithium.com
  Address: 208.74.205.40

  $ whois paypal-community.com 
  Registrant Name: Host Master
  Registrant Organization: PayPal Inc.
  Registrant Street: 2211 North First Street
  Registrant City: San Jose
  Registrant State/Province: CA
  Registrant Postal Code: 95131
  Registrant Country: US
  Registrant Phone: +1.4083767400
  Registrant Phone Ext:
  Registrant Fax:
  Registrant Fax Ext:
  Registrant Email: [email protected]

  $ whois 208.74.205.40
  NetRange:       208.74.204.0 - 208.74.207.255
  CIDR:           208.74.204.0/22
  OriginAS:
  NetName:        LITHIUM-NET1
  NetHandle:      NET-208-74-204-0-1
  Parent:         NET-208-0-0-0-0
  NetType:        Direct Assignment
  RegDate:        2007-02-09
  Updated:        2012-02-24
  Ref:            http://whois.arin.net/rest/net/NET-208-74-204-0-1
  OrgName:        Lithium Technologies, Inc.
  OrgId:          LITHI
  Address:        225 Bush Street
  Address:        15th floor
  City:           San Francisco
  StateProv:      CA
  PostalCode:     94104
  Country:        US
  RegDate:        2007-01-04
  Updated:        2014-02-25
  Ref:            http://whois.arin.net/rest/org/LITHI
  ...

And of course: http://www.networking4all.com/en/support/tools/site+check/re...

Many pages on paypal-community.com have a "Powered By Lithium" banner, so they seem to be the folks who wrote the "community forum" software.

http://www.lithium.com/

And they're mentioned in the paypal privacy policy:

https://www.paypal.com/uk/webapps/mpp/ua/privacy-full

nwhvor 12 Jahren

Almost as bad as Google's ridiculously scammy looking blogspot URLs it uses for official blog posts.

andrey-pvor 12 Jahren

Lithium is indeed a forum community thing. My housemate works for them as a forum moderator for eBay.

To the topic at hand, I'm not really sure whether the title of the blog post or its contents scare me more.

nodatavor 12 Jahren

You can put anything you like in the WHOIS database.

jcrvor 12 Jahren

Of course it's easy to forge whois data, but that's why you also check the IP address, ASN, SSL Cert, ...

reuvenvor 12 Jahren

I got e-mail from eBay yesterday (Tuesday), saying that there had been suspicious activity on my account, and that the account was locked, until I changed the password. I haven't bought anything on eBay in a few years. The message said that any charges that my account had incurred had been reversed.

It's probably a sign of the times that I was sure that this was a phishing message. I checked it a whole bunch of ways before deciding that yes, I should change my eBay password. Even so, rather than click on a link in the e-mail message, I went to ebay.com in my browser, and went through the procedure to change my password.

I checked the activity log for my account, and it didn't show anything. So I'm still not sure if this means my account was broken into or used.

If everyone is indeed being asked to change their passwords, then the message I received was a bad way to say it.

mrobertvor 12 Jahren

For those having trouble navigating Ebay's dashboards to find out how to change the password, here's a link to the page that describes how to do that:

http://pages.ebay.com/help/account/change-password.html

And the direct link:

https://signin.ebay.com/ws/eBayISAPI.dll?ChangePasswordAndCr...

x1798DEvor 12 Jahren

What is the point of ebay redirecting HTTPS versions of their site to an HTTP version? They have an EV cert and everything for the login page. Is it spite?

ja27vor 12 Jahren

That was one of the hardest-to-find password changes I've ever seen.

mpclarkvor 12 Jahren

At the time of posting this to HN the body of the post said simply "Placeholder text."

plingvor 12 Jahren

Still says it. It's on the article index as well:

https://www.paypal-community.com/t5/PayPal-Forward/bg-p/PPFW...

plingvor 12 Jahren

Have changed my eBay password right away just in case this is something major.

However, the paypal password change screen is not responding and returning a blank screen. Terrible!

coffeechequevor 12 Jahren

Me too. I've noticed that finding the "change password" option on eBay is always really hard.

On PayPal, it's got really annoying Javascripts that stop you copying and pasting passwords. I use a password manager, so all my passwords are random and unique.

martinmlvor 12 Jahren

I edited the 'value' attribute of the input elements and pasted my password there. Maximum of 20 chars also :\

_RPMvor 12 Jahren

In case they fix it before the rest of HN wakes up[0].

[0] http://i.imgur.com/O5jLGsm.png

nwhvor 12 Jahren

Full site archive: http://archive.today/ZXNa8

_RPMvor 12 Jahren

You definitely one-upped me here.

mpclarkvor 12 Jahren

Now confirmed by a press release:

http://www.businesswire.com/news/home/20140521005813/en/eBay...

jmac-sjcvor 12 Jahren

So, will the Board of Directors hold anyone accountable to ?millions? of records being stolen (they have 128 million possible)? For now no CC info was believed lost, but they likely don't have any way to know unless they see fraudulent usage...

mihai_ionicvor 12 Jahren

I just made a PayPal account just the other day.

Now I'm really glad that I used `makepasswd --chars 20`, even though I had to paste the password into the input element's value with Inspect Element.

PaulHoulevor 12 Jahren

If you make people change their password there is some chance people just won't do it and won't ever use eBay again... Bye!

jeroenvor 12 Jahren

The cost of fraudulent activity is probably much higher than the missed revenue from those people.

PaulHoulevor 12 Jahren

I dunno.

My wife quit using eBay when her Paypal account got locked out and she'd have to send a fax to unlock it.

I quit using eBay because the auctions stopped and it wasn't possible to get good deals anymore. The AMZN marketplace works better for most of what I buy and if I want something funky there is always etsy.

This is just one more step in eBay's slow decline.

nodatavor 12 Jahren

There is no information here at all. Flagged.

mpclarkvor 12 Jahren

That's just silly. The headline, the subject matter and the fact that it's on a company domain all add up to plenty of information. The fact that it appears to have been prematurely posted adds more interest.

nodatavor 12 Jahren

It's speculation with no information at all. This isn't HN Rumors, and that link doesn't even go to a tweet - it goes to a page full of no information.

mpclarkvor 12 Jahren

Again, it is a very clear message that impacts millions of people and is hosted on a page belonging to the company. There may not be as much information as you'd like, but there's nothing speculative about it.

nodatavor 12 Jahren

It's an unclear message that impacts nobody until it is confirmed. Don't fearmonger.

Edit: they've removed your temporary page now: "The message you are trying to access is not available."

unreal37vor 12 Jahren

They've posted it to their corporate site:

http://www.ebayinc.com/in_the_news/story/ebay-inc-ask-ebay-u...

nodatavor 12 Jahren

Yeah, and now it becomes news.

[deleted]vor 12 Jahren