P.S. I wonder if they were expecting a lot of resets, hence the redesign rollout?
Who comes up with these damn ideas when you are dealing people's money and information?
Is the security surrounding password resets so bad that it's more secure to force easier to remember passwords?
On March 15th I received at that email address a "New York Lotto" phishing email. That is the only spam I got so far on that email account.
So I would assume that they have at least some Paypal subscribers data, including email and home city (and maybe address).
Likewise, Newegg claims that you have to have special characters, but my password has none.
I'd suggest trying the password you want and seeing if it gets rejected. In a lot of cases, some programmer may have fixed the crazy password scheme and forgotten to update the page text.
Unfortunately there's nothing inevitable about this! b^)
if passwords are being hashed, which i guess i would have to believe they are, at least in the BOA case, what's the point of restricting character counts (especially to 20), or choosing random characters to exclude?
1. Legacy systems. The system that was built 15 years ago might have limited the field for performance or storage reasons and it was never updated. Or maybe the Palm Pilot app only supports 20 characters in a text field and nobody has the source code but there's still a dedicated bunch of 200 users who do $50,000 in sales every year and nobody wants to piss them off. Or maybe they're just afraid the monster has gotten too big and they don't know what'll break if they change anything. Better to play it conservative so you're not the person who shut a group of users out of the system.
2. Just because. True story: I was working on an internal app for a company years back and I asked my manager if there were any particular password restrictions we needed to honor, any kind of company policies or weird accessibility concerns or something [1]. So what does he do? He emails the marketing stakeholder and asks her what the password rules should be. She doesn't know anything about security, so she concocts something completely arbitrary based on stuff she's seen on other sites. 6-10 characters, at least one number & one symbol, etc. And those were the requirements I had to implement, because that's what the stakeholder wants, even though that was the answer to completely the wrong question.
> if passwords are being hashed, which i guess i would have to believe they are
I wouldn't assume that. Think about a bank where you have call center staff who know a certain customer by name because he calls every Thursday saying he can't remember which of his grandkids' names he used as a password and could you please tell him because the rent is due Monday and he needs to transfer money from savings to checking because his Social Security check is late this month. And so on. You know how old guys are with their stories. You're reading one now. The CSR doesn't want to walk him through the steps of resetting his password over the phone…again. The faster he can get him logged in, the sooner he'll go away.
"We need a way to display that guy's password to a CSR," the head of the department tells the CEO over golf, knowing if he gets the department's average call time under two minutes he gets an extra $100,000 this year. So, the edict comes down from the highest levels of the company that the passwords have to be encrypted & reversible instead of hashed.
Now, this story is completely fictitious, but I've been in similar situations where the all-important call-center & support metrics trumped security. It happens. It shouldn't, but it happens.
[1] Maybe even a legacy Palm Pilot app…
Note that this validation may take the form of validating to someone, shall we say, less than fully competent, or it could be an actual means to protect yourself.
The additional search space from 62^N to 200^N isn't especially worth worrying about, IMO.
http://msdn.microsoft.com/en-us/library/bb355989.aspx (to cite just one way that these things come into being; someone finds that you can do input validation easily, and they do it, maybe because they're overly cautious, maybe because someone they need to convince is overly cautious, maybe some other reason) IMO, this is not an especially terrible "flaw" in a site.
http://leginfo.legislature.ca.gov/faces/codes_displaySection...
If the breach affects more than 500 California residents, an online report must be filed with the Attorney General.
You can search breach reports, and I could not find any from ebay.
http://oag.ca.gov/ecrime/databreach/list?field_sb24_org_name...
You can also file a complaint against businesses that fail to disclose breaches here:
http://oag.ca.gov/contact/consumer-complaint-against-busines...
Which is exactly why we took 3 months to inform you, you've been hacked. It's because we care. Don't you see?
Do I need to update my PayPal account too? (my email is the same, but both passwords are long and randomised so not too bothered). So now they know my email address and my home address - and my date of birth, always convenient. Oh and as someone pointed out, I have PayPal automatically linked to my eBay account. Great.
Which physical address? My default delivery? My invoice address?
So a quick update from the BBC: "something it only became aware of a fortnight ago"
They only just realised, essentially. Although it's worrying that it took an eCommerce site so long to catch it. And that's still two weeks when eBay knew and nobody else did.