eBay customers’ personal data was compromised in March

Re:eBay customers’ personal data was compromised in March by mnw21cam on Wednesday May 21, 2014 @10:35AM (#7778437)

Okay, so let's imagine for a moment that the "secure, encrypted" database of card numbers has also been compromised. The attacker would have the plaintext name and address, and an encrypted 16 digit number, with an entropy of at most 53 bits - maybe 66 bits if the expiry date is included. That's before you take card number check digits and geographically-likely prefix codes into account, which will reduce the entropy. (Edit: yes, they wouldn't store the CVV). And don't get me started on showing the user the last four digits of the card number. It wouldn't take much effort in this day and age for the attacker to try all possible card numbers, and then they have name, address, and card number. Game over, man.

Wouldn't it be possible for them instead to store a token generated from the card number and Ebay/Paypal's incoming bank account number, which can only be used for paying into that particular account?

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by mikeash on Wednesday May 21, 2014 @10:38AM (#7778450)

But what does it matter if they figure out your card number? You're not liable for fraudulent transactions. It's pretty easy to get a new card number. Your issuer takes a hit, but whatever, not my problem.

Checking account info is much, much worse. It's much harder to reverse fraudulent transactions there, and much harder to get a new number.

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by mnw21cam on Wednesday May 21, 2014 @10:46AM (#7778500)

It can still be very inconvenient.

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by mikeash on Wednesday May 21, 2014 @10:52AM (#7778543)

It really shouldn't be. I had a card compromised in the Target breach and they sent me a new one without my intervention. I've had fraudulent charges made before, and it's been trivial to get it fixed.

I've never had a checking account compromise, but I'm pretty sure it would be a massive pain in the ass by comparison.

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by rblatz on Wednesday May 21, 2014 @01:01PM (#7779333)

The Target compromise wasn't a minor pain for everyone. A friend's bank reissued her credit card. Which caused a payment she had made to Time Warner fail. She was also in the middle of moving, which caused even more headache and a potential hit on her credit for late payment, because apparently Time Warner doesn't even attempt to notify you if your payment fails.

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by mikeash on Wednesday May 21, 2014 @02:43PM (#7779972)

I'd put the blame entirely on Time Warner for that one. The Target breach is entirely incidental to the store. The same thing would have happened if the card had expired naturally, or been closed for other reasons.

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by schrodinger on Wednesday May 21, 2014 @12:00PM (#7778929)

Mentioned above, but relevant here too. I've had my debit card compromised several times, and it was still trivial - one phone call and was refunded in a few days.

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by mikeash on Wednesday May 21, 2014 @12:12PM (#7779009)

Debit cards mostly give you the same protections as credit cards. They're worse in that the money comes out of your account immediately (but is supposed to be returned when you report fraud), and the rules are different and less favorable if your PIN is also compromised, but overall it's not too bad.

A compromise of your routing and account number for your checking account is potentially much worse. It's harder to take advantage of, but it's also much harder to fix.

(I'm not sure if you were treating the debit card as analogous to credit cards or account numbers, so treat this as confirmation/correction/elaboration/whatever as appropriate.)

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by oneeyedpigeon on Wednesday May 21, 2014 @12:35PM (#7779151)

Did the bank charge you for the replacement cards? Is there any real reason not to just regularly - say every 3 months - request a new card for peace of mind?

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by zevyoura on Wednesday May 21, 2014 @12:52PM (#7779262)

The biggest obstacle is that it's an annoyance to update the number for any recurring charges you have set up.

[ Parent | on HN ]

Re:eBay customers’ personal data was compromised in March by mikeash on Wednesday May 21, 2014 @12:50PM (#7779246)

They did not. That stuff is basically a loss leader for them.

From what I recall with the Target incident, their cost is something like $2-5 for each replacement card, so it's not entirely trivial. If you requested a new one on a regular basis for no good reason, they might put a stop to it one way or another.

As far as peace of mind goes, since the consequences are so mild, I wouldn't worry about it.

[ Parent | on HN ]