Ebay And Paypal Hacked

JBuck, I agree. But some people do it, because they can't remember all their passwords. That's why I said something.

For all you fellow Canucks interested in case law concerning privacy Google: intrusion upon seclusion.

And wash your hands.

I had a friend in California who had decent passwords. But someone, with minimal information (readily available on the internet, socially engineered a tech supporter from Apple to help "her" change her password. From there it was on to the Amazon passwords (with another phone supporter's assistance) and THEN the lovely individual started wiping out her family's computer and phones. By the time the computer was wiped, she realized something was wrong and shut down the phones.

The bottom line is that even with her precautions, all it takes is a weak (usually human) link to start a chain reaction. Users and corporations need to become more cognizant of their digital surroundings and act when something seems "off", not when things start blowing up.

My understanding of the ebay case is that employees credentials were stolen and they worked their way through the servers for several weeks until they found what they took. It was a couple of weeks before an employee realized the credentials were stolen. Were there warning signs before he/she figured that out? Probably but they may have been ignored because nothing was blowing up.

The hackers took what they took for a reason. They may not break the encryption fast enough to cause significant harm; but if they do break it, they have learned something valuable enough to make the exercise worth it.

I think ebay reported it as soon as they realized it but time was lost since the credentials were in use.

Condor, I learned from my past jobs involving a crazy number of passwords to incorporate a system. The key to the system, is some sort of relation between the site and password that only you know. I have a few different letter combos and numerical combos. I combine them in multiple different ways depending on the site. Maybe if the site contains an even amount of letters in the address, I will put the letters first and in original order, followed by the numbers. Maybe if the site is a hobby site, I'll add 1 to the first number, or the last number, or subtract one. It is a key that you make up and always have the answer to. You only have to remember a couple words and a couple number combos. Even though its my system, I still end up forgetting all the dang time!

I have Keepass and really like it. I used to have my logins and passwords listed in a spreadsheet, but Keepass is tons better.

FYI http://keepass.info/

The data slurped includes

Name
Address
Date of Birth
ebay UserID
email address

So you can no longer trust emails FROM ANYONE that use your name or zip code to "prove" they have non-public information about yourself...

ALWAYS, ALWAYS, hand-key the URL into a browser session. Never ever ever click on ANY link in ANY email. It's that simple.