Bad Programming by eBay Puts Users Who Sign Into the Site At Extreme Risk

[amy]

After signing into the site eBay users are seeing other users names, ID, personal info, bids in their accounts.  This security breach also allowed users to place bids using the other users account.

http://forums.ebay.com/db2/thread.jspa?t...1000164754&tstart=0
http://forums.ebay.com/db2/thread.jspa?t...1000161485&tstart=0


p.s. just a reminder: (besides the inherent dangers present to users who sign into the eBay site)  viewing listings or clicking on links on the eBay site itself puts you at risk of being phished.  many of the pages on eBay contain malicious javascript codes. 

edited to add: the technical issues board on eBay is full of threads started by users who are experiencing the same problem:

http://forums.ebay.com/db2/thread.jspa?t...2000059986&tstart=0
http://forums.ebay.com/db2/thread.jspa?t...1000164710&tstart=0
http://forums.ebay.com/db2/thread.jspa?t...2000059983&tstart=0
http://forums.ebay.com/db2/thread.jspa?t...2000059978&tstart=0

[Jen]

And the answer center and live help are happily saying "clear your cookies, dump your cache".

Musta been one hell of a cookie for a guy in New York to be looking into a Phillipine sellers' account.

Such a bunch of nonsense. 

Instead of clearing cookies, I want them to put down the crack.

[amy]

eBay's sign in is now defaulting to a non-secure http sign in page which increases the risk that customers passwords and other data including credit card info will be compromised as they enter it over an unencrypted very unsecure connection.  The move to a nonsecure login was unannounced so many users don't realize they are using an unsecure connection.  Customers who are lucky enough to notice must hunt for a teeny tiny hard to find link to a secure (SSL) sign in page.

related topic: http://community.tuliptools.com/index.ph...ml#msg6300

edited to add: clicking on the secure SSL link merely returns users to the nonsecure sign in page.  eBay users who need to sign in to their accounts are being forced to put their personal info at risk by signing in over an unsecure connection.

[bargainbloodhound]

Instead of clearing cookies, I want them to put down the crack.

eBay must have stiffed its programming staff on holiday bonuses the last 2 years and this is their revenge.  Last year's holiday season started off with "other people's porn" in sellers accounts. 

update from the idiots who have yet to acknowledge or address the security problems that have existed on their site  since the middle of last week (the first reports of this problem started a few days before Friday evening).  Despite continuing user reports of problems, eBay is saying (for the second time today) that the issues are resolved.

***Sign-In Issues Recap*** 

December 19, 2005 | 05:03PM PST/PT


During the past few days some members have experienced problems signing into eBay. These issues are now resolved – but I want to give you an overview of what happened and our response.

On Friday evening, we needed to roll back some code that was inadvertently causing sign-in issues for a very small number of members. To fix the problem for these members, we automatically required all users to sign in upon returning to eBay. This morning, the volume of sign-ins created traffic issues resulting in slowness and intermittent unavailability of the sign-in feature.

We recognize the inconvenience this caused, particularly at this busy time of the year. The eBay technical teams have worked around the clock since Friday evening to restore full site functionality. We’re confident this issue is now resolved, and we thank you for your patience.

Sincerely,

Gary Slater
Director, Site Operations

[Anita]

I don't think anything more can be said about eBay.  It is simple... eBay SUCKS!

[catholicemporium]

inadvertently

???!!!???

[catholicemporium]

eBay SUCKS

Yes, they have joined TV.

[Anita]

The announcement board states the sign in issues have been resolved.  I can't sign in today.  I looked and I'm not NARU yet. 

[bargainbloodhound]

small businesses that rely on the auction provider as a primary sales channel are still complaining of lost customers and lost sales as a result of the site's technical glitches.

http://www.networkworld.com/newsletters/...11268.html

3 1/2 years later nothing has changed 

[amy]

eBay Australia experienced the same sign in issues and posted an announcement today.  There were no announcements on the Canada, UK, or Indian sites.

The Australia announcement:

***Sign In Issues *** 

20 December 2005 | 01:14PM EST


During the past couple of days some members have experienced problems signing into eBay. These issues are now resolved and we would like to give you an overview of what happened.

On Saturday, we needed to roll back some code that was inadvertently causing sign-in issues for a very small number of members. To fix the problem for these members, we automatically required all users to sign in upon returning to eBay. This morning, the volume of sign-ins created traffic issues resulting in slowness and intermittent unavailability of the sign-in feature.

We recognise the inconvenience this caused, particularly at this busy time of the year. The eBay technical teams have worked around the clock to restore full site functionality and are confident this issue is now resolved. We thank you for your patience.

Regards,