Ebay Asks Users To Downgrade Security (krebsonsecurity.com) 72
Ebay has started to inform customers who use a hardware key fob when logging into the site to switch to receiving a one-time code sent via text message. The move from the company, which at one time was well ahead of most e-commerce companies in providing more robust online authentication options, is "a downgrade to a less-secure option," say security reporter Brian Kerbs. He writes: In early 2007, PayPal (then part of the same company as Ebay) began offering its hardware token for a one-time $5 fee, and at the time the company was among very few that were pushing this second-factor (something you have) in addition to passwords for user authentication. I've still got the same hardware token I ordered when writing about that offering, and it's been working well for the past decade. Now, Ebay is asking me to switch from the key fob to text messages, the latter being a form of authentication that security experts say is less secure than other forms of two-factor authentication (2FA). The move by Ebay comes just months after the National Institute for Standards and Technology (NIST) released a draft of new authentication guidelines that appear to be phasing out the use of SMS-based two-factor authentication.
Re: (Score:2)
Where do you suggest I shop for my gray market crap?
Re:People still use Fleabay? (Score:5, Insightful)
Re: (Score:2)
Hey, the "Music And Film Industry Association of America" is a valid acronym!
Re: People still use Fleabay? (Score:3)
Yes they do you fucking elitist bellend
Re: (Score:2)
Yep, Amazon has a book I want - typically ships in 1 or 2 weeks.
Ebay has it for the same exact price and I ordered it last night and it's on the way. Ebay also had a better selection of Jeep Roofs, and my new one is at home waiting for a warm day for me to replace my old one.
As to the key fob versus text? they can't spam your keyfob.
Re: (Score:2)
What with all the "it's broken" scammers, and the gray market crap being peddled. Who still uses the former auction site?
Perhaps you're right.
After all, there's nothing but honest reviews at Amazon, with ethics ensuring no chance of grey-market product being sold there...
Re: (Score:1)
Prove it.
I almost never use Auction... (Score:1)
Ironic that... my eBay/PayPal keyfobs just died (Score:3)
I have had a few rebranded VASCO keyfob with eBay/PayPal's label on it. They tend to die after 2-3 years due to battery life, and recently, I was unable to find a link to buy a new one and activate it.
Yes, now we have Google Authenticator, Duo, and other items, but the simplicity of a keyfob which did nothing but display a six digit number made it decently secure, without having to reply on a phone, tablet, or other device.
Re: (Score:2)
Correction. My keyfobs didn't "just" die. It took them a few years to run out of battery life. However, it would be nice if they were still offered.
Re: (Score:3)
Re: (Score:1)
Re: (Score:3)
I believe the Google Authenticator was available on a keyfob that displayed 6 digits, but it seems that even that was replaced by the following. https://www.technologyreview.c... [technologyreview.com]
Re: Ironic that... my eBay/PayPal keyfobs just die (Score:2)
Anybody with a low level access to a phone network can steal anybody's phone number with ease. Russians used the fake roaming requests to force British Telecom into routing MPs phone numbers to a Russia. All you need to know is victims IMEI.
Re:Brian Kerbs? (Score:5, Funny)
In had to double check the article, I couldn't believe an editor would fuck up something as basic as Krebs's name.
No it's really Brian Kerbs. He's an expert on the interface between road and pavement/sidewalk.
Re:Brian Kerbs? (Score:5, Funny)
In had to double check the article, I couldn't believe an editor would fuck up something as basic as Krebs's name.
No it's really Brian Kerbs. He's an expert on the interface between road and pavement/sidewalk.
Get your mind OUT of the gutter!
Re:Brian Kerbs? (Score:5, Funny)
No, that's Brian Curbs. I'm looking for "A Sale Of Two Titties" by Brian Kerbs, the well-known Dutch author.
Re: (Score:1)
Dey took our kerbs!
Re: Trump team intercepted, without foreigners in (Score:3)
Re: (Score:1)
Information is coming from a NSA whistle blower, not from FBI,CIA,NSA policiatial mouthpieces. Good job Democrats you turned the your Russian Unicorn into your own Watergate. https://www.c-span.org/video/?... [c-span.org]
Re: (Score:1, Offtopic)
And the AP doesn't like their headline anymore. http://archive.is/zBZRx#select... [archive.is]
Re: (Score:2)
It's not that it's being blocked, it's more that nobody really gives a shit.
Flaws.. (Score:5, Insightful)
Perhaps ebay have become aware of a security flaw in the keyfob, and are thus trying to migrate users away from them?
Any keyfob that just displays a different code over time depends on the security of the initial seed value... If these values were compromised then so are all the tokens, and it wouldn't be the first time something like this has happened.
The trouble with saying "less secure" is that it's highly subjective, even if you're in full possession of the facts (which we may not be)...
A lack of transparency is a problem as always... These companies are a black box, and we the users/customers are expected to just accept what they tell us without having any idea of their internal processes or code etc.
More Control (Score:5, Informative)
Since nobody ever actually reads the linked articles, here is what "Brian Kerbs" has to say:
I asked eBay to explain their rationale for suggesting this switch. I received a response suggesting the change was more about bringing authentication in-house (the security key is made by Verisign) and that eBay hopes to offer additional multi-factor authentication options in the future.
“As a company, eBay is committed to providing a safe and secure marketplace for our millions of customers around the world,” eBay spokesman Ryan Moore wrote. “Our product team is constantly working on establishing new short-term and long-term, eBay-owned factors to address our customer’s security needs.
Re:Flaws.. (Score:5, Interesting)
Text messages almost always get sent to a cell phone, and in the US there really only are three or four mobile providers. If you have a phone number, you can often look up the provider in public databases, and if that doesn't work, you simply take a guess and call each of the major providers.
Time and time again, it has been shown that all mobile cell phone providers are easily attackable by social engineering. It takes very little effort to have them either redirect SMS or issue a new SIM card and mail it to a random address. And this isn't even to talk about attacks on SS7, which more well-funded adversaries can pull off.
So, now, the only real protection is whether the phone number can be found easily, if you already know the rest of the credentials. In most cases, that's unfortunately a really low hurdle.
In other words, a half way determined and experienced attacker can subvert SMS authentication, if only they have enough of an incentive to spend the effort. There are countless reports of this attack succeeding. So, it's no wonder the US government (in this case NIST) discourages the use of SMS authentication.
Fortunately, there is a modern alternative to the old token that EBay used to support. FIDO U2F tokens are cheap, you only need a single token for an arbitrary number of sites, they are provably secure against MitM and phishing attacks (something that EBay's old token didn't do), they are easy to use, they support having multiple backup tokens, and there are plenty of opensource implementations and very good documentation. There really isn't a good excuse not to implement FIDO U2F except for laziness.
Re:Flaws.. (Score:4, Informative)
To extend what you started with.
Text messages almost always get sent to a cell phone,
Most cell phones are also logged into the same mail service that the ebay account will be using for the lost password recovery tool.
Now without the dongle, one lost or stolen phone will offer the keys to the kingdom.
Re: Flaws.. (Score:2)
True. Anybody with a low level access to a phone network can steal anybody's phone number with ease. Russians used the fake roaming requests to force British Telecom into routing MPs phone numbers to Russia. All you need to know is victims IMEI.
Re: Flaws.. (Score:2)
And you can legally buy IMEI databases from most of phone operators, pretending you are a marketer.
Re: (Score:2)
Perhaps ebay have become aware of a security flaw in the keyfob, and are thus trying to migrate users away from them?
Let's stop bullshitting here. eBay knows few users give a shit enough to even want to deal with MFA, so they're doing this as a cost-saving measure, and nothing more.
Any keyfob that just displays a different code over time depends on the security of the initial seed value... If these values were compromised then so are all the tokens, and it wouldn't be the first time something like this has happened.
If this in fact is the case, we could probably find evidence of an attack elsewhere. An void of evidence would tend to point at my initial statement above.
The trouble with saying "less secure" is that it's highly subjective, even if you're in full possession of the facts (which we may not be)...
Fact: 99.999% of the devices that will provide the SMS authentication to support MFA are smartphones, and smartphones have a fucking horrible security record. They are constantly getting ha
Re: (Score:2)
Perhaps ebay have become aware of a security flaw in the keyfob, and are thus trying to migrate users away from them?
Their flaw is that they are literally unbreakable, so they are moving to something entirely trivial for most big interested parties to intercept and decrypt. I wonder why?
Re: (Score:2)
On the contrary, there is no flaw. This is frustrating the NSA, which has asked eBay to be more Patriotic. Would be a shame if something were to happen to their nice website.
Does eBay/PayPay have a warrant canary?
Re: (Score:2)
On the contrary, there is no flaw. This is frustrating the NSA, which has asked eBay to be more Patriotic. Would be a shame if something were to happen to their nice website.
Does eBay/PayPay have a warrant canary?
The NSA doesn't need your login credentials for eBay to see what you are buying. I cross the border from the US to Canada for summer vacation and on occasion I bring eBay items back for family members. Canada charges tax on goods crossing the border into Canada that are going to be left there. The tax amount is based on the value. I always declare anything I bring with me but they sometimes double-check to make sure. I've seen them access account details based on eBay member ID. If the Canadian border
Re: (Score:2)
Re: (Score:2)
It's the obvious primary key that can directly link to most of your interesting accounts online (all of those online services who in the name of "security" force you to reveal your phone number) and offline (credit cards, public services accounts); remember the real name policy that Google+ had? so pointless now thanks to "security".
So, why? (Score:4)
Although that doesn't fully explain why they felt the need to take things in-house. Possibilities that occur to me: 1. The backend they need to use for the old fobs is hellish to maintain. 2. Verisign charges them a lot of money and so some manager decided they should ditch the external methods for the sake of profit. Or some other sort of falling out between eBay and Verisign, but isn't it always about hope for higher profits? Speaking of... 3. It doesn't actually cost them much, but they want to develop their own in-house methods to then re-sell because upper management is still regretting spinning off PayPal and they want to create another such more universal middleman. Consider this the "??? Profit" possibility.
Paypal too (Score:3)
PayPal and eBay shared the same keyfobs for a long time, but sometime about two years ago, PayPal logins stopped working for me and nobody from their side could figure out why. Long story short, the only fix was to turn off the keyfob and use PIN codes sent by SMS.
I am not sure if this really impacts security as PayPal was trivially easy to social engineer and have the keyfob taken off a target account, so having a keyfob on your account really didn't mean that much.
Now eBay is doing the same thing. Oh well.
Re: (Score:2)
PayPal and eBay shared the same keyfobs for a long time, but sometime about two years ago, PayPal logins stopped working for me and nobody from their side could figure out why. Long story short, the only fix was to turn off the keyfob and use PIN codes sent by SMS.
I am not sure if this really impacts security as PayPal was trivially easy to social engineer and have the keyfob taken off a target account, so having a keyfob on your account really didn't mean that much.
Now eBay is doing the same thing. Oh well.
Interesting - my fob never stopped working. I changed over to using the android app instead of the physical fob (because my old fob looked like it had been through the wash too many times), but I've never had a problem with it.
My guess is that Paypal/Ebay don't actually know enough to debug subtle problems with the system, so you got screwed.
Annoying, and now we all get to be annoyed.
Note that so far my sign-in still works with the app - they haven't actually started forcing people off of the fob yet.
Re: (Score:1)
Re: (Score:1)
I had the same problem with paypal tokens stopping working. Paypal and ebay tech support were clueless...
I eventually stumbled on the fix by clearing all paypal / ebay cookies from my browser.
It'd be nice if they took up Fido U2F, since they're part of the bloody standards group for Fs sake... https://www.paypal-engineering.com/tag/fido/
Re: (Score:2)
Major privacy invasion (Score:3)
>"Now, Ebay is asking me to switch from the key fob to text messages, the latter being a form of authentication that security experts say is less secure than other forms of two-factor authentication (2FA)."
It is not just that it is less secure... it is AN INVASION OF PRIVACY. There is absolutely NO WAY I am going to give my cell phone number to Ebay, Microsoft, Amazon, Bank of America, or any other company. It is a marketing wet-dream for them to get that information such that they can spam you with impunity in the most egregious and annoying way I can think of, and sell that information to others.
This is not a move to increase security or improve convenience for the end user. It is to lower THEIR cost and to increase THEIR knowledge about their users. And it is so common now it is shocking... and people just give it up!
True story- a group of us went to TGIFriday's for dinner last week. We approached the hostess and told her 4 people. We expected to get a pager/fob. Nope, she asked us for our phone number! Every one of us in the group said "you have to be kidding" not over our dead bodies! We asked her "seriously? People will give you their private cell number for this?" She said almost nobody bats an eye." Of course we declined and they had to physically come look for us when the table was ready.
Re: (Score:2)
Yuuup. And it's not the first time, either. Try sending a GPG-signed email via ebay. You'll get a response back telling you that your email has been blocked "for security reasons".
Re: (Score:2)
But of course they get a phone number from me. Same way they get an email address. Every single one gets a different one. And when a telemarkedroid calls, you know exactly which company is insecure enough to hand it over, and who not to trust with any actually critical information.
I hope they find a better way. (Score:1)
Re: (Score:2)
That's why you don't implement some random proprietary protocol, but instead go with a standard like Fido U2F. You only need a single token for an arbitrary number of sites
Of course ... (Score:2)
Phone numbers are the new SSN. Particularly since telcos have been given immunity for handing your metadata over to every TLA and creditor that asks for it. Just try doing business with anyone and, when they ask for your phone number, just tell them you don't have one. Watch them shit themselves.