consumer-safeguards

Bust out the password managers: eBay has announced that it will ask its 112 million users to change their passwords later today after discovering that a database containing their names, physical addresses, phone numbers, email addresses, and passwords was compromised in an attack thought to take place between February and March. The company says that financial information and “other confidential information” has not been affected by the security breach.

This is just the latest in a series of breaches forcing many people to change their passwords. Target’s 2013 data breach, which affected some 70 million holiday shoppers, is perhaps the most famous. Then there’s the Snapchat breach, which exposed the names and phone numbers of millions of users in the beginning of January. Last April, AOL urged its users to change their passwords after it suffered its own breach.

These attacks don’t just compromise the security of one service. Because many people repeat passwords or use a simple system to create new ones for each site, their entire digital life can be opened to hackers who get their hands on a password from a single website. (Read Adam Penenberg’s excellent story about how hackers were able to access much of his personal data to see how dangerous repeating passwords can be.) These 112 million eBay users are screwed.

Given the frequency with which these breaches are occurring, it seems that having to change passwords for at least one website every few weeks is going to become the new normal. In the meantime, hackers are able to get away with personal information that isn’t quite so easily changed, such as someone’s name and physical address. Having to change some passwords isn’t fun — having to live with the fact that someone has all of this other information is even worse.

Reactions from around the Web

eBay offers more details about the breach:

The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. However, the database did not contain financial information or other confidential personal information. The company said that the compromised employee log-in credentials were first detected about two weeks ago. Extensive forensics subsequently identified the compromised eBay database, resulting in the company’s announcement today.

The company said it has seen no indication of increased fraudulent account activity on eBay. The company also said it has no evidence of unauthorized access or compromises to personal or financial information for PayPal users. PayPal data is stored separately on a secure network, and all PayPal financial information is encrypted.

TechCrunch explains eBay’s plan to reach its users:

The company will alert users later today via email, site communications and elsewhere of the breach, and will ask users to reset their passwords at that time. If you used your eBay password on other websites as well, it’s suggested you change those elsewhere too.

Pando weighs in

On the difficulty of changing many passwords at once:

While there are various tools that can generate strong passwords and keep them in sync across multiple platforms, there isn’t an “Oh shit!” button that can automatically reset all of those passwords when something like this happens. It’s up to you to remember all of the websites you’ve visited, the passwords you used for those sites, and to create new passwords that anyone knowing your old ones won’t be able to guess. That’s not necessarily a bad thing: having to manually change the passwords could help protect against any potential flaws hiding in the generators used by tools like 1Password or LastPass.

On the dangers of biometric security, which introduces its own sets of problems:

However, when the success of the iPhone inevitably leads to a future in which lots of different technologies in your life are locked and unlocked by a finite number of biometrics, then far more than your phone is at risk. The scale of such biometric security systems would mean your whole life could be held hostage because the locks and keys have been fundamentally changed.

Think about it in practical terms. Whereas in today’s password-based system you can protect yourself after a security breach with a simple password change, in tomorrow’s biometric-based system, you have far fewer – if any – ways to protect yourself after a security breach. That’s because you cannot so easily change your fingers, your eyes or your face. They are basically permanent. Yes, it’s true – security-wise, those biological characteristics may (and I stress “may”) be less vulnerable to a hack than a password. But if and when they are hacked in a society reorganized around biometric security systems, those systems allow for far less damage control than does a password-based system. In effect, your physical identity is stolen – and you can’t get it back.

[illustration by Hallie Bateman for Pando]