Forgot your password?
typodupeerror
This discussion has been archived. No new comments can be posted.

eBay Japan Passwords Revealed As Username+123456

Comments Filter:
  • Re:Obligatory (Score:5, Interesting)

    by ArcadeMan (2766669) on Thursday March 27, 2014 @04:00PM (#46595649)

    You just gave me an idea.

    Alright everyone, LISTEN UP!

    If a user tries to use "12345" for his password, return an error message exactly as follows:
    "1,2,3,4,5? ....That's amazing! I've got the same combination on my luggage!"

    Now go and implement this on your systems, whatever they may be. I don't care if your code systems for banks, the NSA or whatever. It shall be known as "Spaceballs: The Error Message".

  • Re:Hey (Score:5, Interesting)

    by marcansoft (727665) <hector@@@marcansoft...com> on Thursday March 27, 2014 @05:15PM (#46596519) Homepage

    Sorry for the threadjack, but this is yet another case of horrible security reporting.

    From watching the video, what it seems happened here was that eBay chose phpBB for their community forum, but did not integrate its authentication system directly with eBay's on the server side. Instead, the site was set-up as a standalone system, and whoever implemented the integration had the bright idea of hardcoding the forum password for everyone as username+123456, and then just having the eBay login page issue a hidden POST request behind the scenes to authenticate users to the community forum section.

    Thus, this allows anyone to trivially impersonate anyone else on the forum. It shouldn't have anything to do with the rest of the site, though. Nor does this have anything to do with initial passwords, salts, or any of the other terms that have been thrown around.

    A case of absolutely retarded login integration for the community site, but not something that would allow people to take over others' main eBay account. What this says about the people running eBay is another matter entirely...

The economy depends about as much on economists as the weather does on weather forecasters. -- Jean-Paul Kauffmann

Working...