sonofsanta Posted May 21, 2014 Posted May 21, 2014 (edited) If users have rubbish password on their email, which they've used to register for LastPass, can they reset the password, go to the email address, click through to LastPass and get in to everything? Genuine question having not used LP. You can't reset your password - hence the warnings about not forgetting it. The procedure is here: https://lastpass.com/support.php?cmd=showfaq&id=375 Basically: password hint; one time reset that can only be done on a computer you've previously logged in on; roll back to your old password; delete your account and start over, chump, shouldn't have forgotten your master password. EDIT: looks like the revert option does use your email, so there's potential there. But the corollary is that if you use LastPass, you use randomly generated passwords and your email is that less likely to be compromised. Edited May 21, 2014 by sonofsanta
Arthur Posted May 22, 2014 Author Posted May 22, 2014 eBay buries its own advisory to change passwords following database hack « Ars Technica eBay officials are taking flak for burying news of the password reset issued in response to a hack on the company's corporate network that exposed sensitive data for millions of users. More than seven hours after eBay published an advisory that was five clicks removed from end users, the company still made no mention of the breach, said to affect 145 million customers, in e-mails, on its front page, or when users log in to their accounts. The bare-bones post disclosed a breach in February or March that allowed attackers to make off with cryptographically protected passwords. It advised users to change their login credentials. The breach also exposed customers' names, e-mail addresses, home addresses, phone numbers, and dates of birth in a human readable format. Given the magnitude of the breach, it's surprising to see an Internet-based company like eBay take so long to directly notify customers and inform them of what steps they should take to protect themselves. The burying of such an important advisory didn't escape the scrutiny of security bloggers such as Graham Cluley or Paul Roberts. Asked to comment on the lack of disclosure, an eBay spokeswoman wrote: "An updated password reset process is currently being rolled out to all our users. It will be available shortly."
Arthur Posted May 22, 2014 Author Posted May 22, 2014 If users have rubbish password on their email, which they've used to register for LastPass If someone uses LastPass, there's absolutely no reason they would need to use a rubbish password - especially with e-mail accounts being a prime target for hackers. http://imgs.xkcd.com/comics/authorization.png I don't even know what any of the passwords are for any of my online accounts (inc. e-mail). Each site has its own unique password consisting of random characters and are as long as possible.
laserblazer Posted May 22, 2014 Posted May 22, 2014 You'll need to capitalise the P to conform to the usual password requirements of upper case, lower case and number or symbol. You could always capitalise the "a" and have a really strong one... Damn back to my Ebay control panel.
IrritableTech Posted May 22, 2014 Posted May 22, 2014 EDIT: looks like the revert option does use your email, so there's potential there. But the corollary is that if you use LastPass, you use randomly generated passwords and your email is that less likely to be compromised. You can probably add 2FA into the mix as well on your email account - and if you can't, perhaps you should be thinking about hosting it elsewhere.
victory2012 Posted May 22, 2014 Posted May 22, 2014 funny this as i had my ebay accounts hacked back in march and wondered how they got in ... now i know.. changed all my passwords since then.
Garacesh Posted May 22, 2014 Posted May 22, 2014 Just a thought.. Don't eBay e-mails include your real name in order to 'prove' it's them sending you e-mails? Phishing just got a whole lot easier..
jinnantonnixx Posted May 22, 2014 Posted May 22, 2014 I'm a amazed I haven't had a flurry of 'change your ebay password' scam emails, pointing to superscamsite.com/hc3/flakysite/icantbelivetheyclickthis.php
elsiegee40 Posted May 22, 2014 Posted May 22, 2014 I don't seem to have had anything forcing me to change my password. There's a big message when I login recommending that I do so, but no forced action.
rush_tech Posted May 22, 2014 Posted May 22, 2014 it looks as though they may be struggling a little eBay buckling under password pressure - Telegraph
Arthur Posted May 22, 2014 Author Posted May 22, 2014 http://signin.ebay.com/ws/eBayISAPI.dll?ChangePasswordAndCreateHint ^ Reset password link. 1
plexer Posted May 22, 2014 Posted May 22, 2014 hmmm just tried to sign in with my work id and can't "remember" my password so I've done the change my password bit and it looks they are sending it to the correct email address but no change password mail this was about half an hour ago now. Ben
Arthur Posted June 1, 2014 Author Posted June 1, 2014 Hackers are selling eBay logins online « Neowin ... one hacker was offering 1,000 UK eBay accounts with entirely positive feedback for £24.93 each whilst another would sell 'unlimited' usernames and accompanying passwords for £2,100. The report does not indicate where these offers were advertised but it is likely to be on secure websites frequented by hackers and accessible through systems such as the Tor Network.
unixman_again Posted June 2, 2014 Posted June 2, 2014 I've been having no end of problems with ebay. Thursday of last week, I tried to login from home and I was presented with a message to phone customer support and quote a security code. Did this no problems. Next day, I came into work and was presented with the same screen. After 1/2 hour on the phone, they reckoned they couldn't grant me access to my account, as they couldn't prove who I was. I would have to phone in again later from home and they would sort it. I phoned in and they granted me access. In all three cases, they said I could get in using my secret question. Well you could if the system gave you the chance to do this. On Friday, their customer services bod said they were tracking machine id's from where you access your account. Can you see the problem here? If you access your account from many machines, which I do, I'll have to phone them for each and every machine, that I use. Friday, they said they had "cleared the flag" and I could access my account again. Yes, I could over the weekend, but this morning at work, I'm getting the screen to phone them and again quote the security code. It looks like another 30 mins on the phone. I am really annoyed and I will probably miss out on something that I am bidding on.
plexer Posted June 2, 2014 Posted June 2, 2014 I'm sure you'd be even more annoyed if someone else got in to your account though? Ben
Hefferzzzz Posted June 2, 2014 Posted June 2, 2014 I've been having no end of problems with ebay. Thursday of last week, I tried to login from home and I was presented with a message to phone customer support and quote a security code. Did this no problems. Next day, I came into work and was presented with the same screen. After 1/2 hour on the phone, they reckoned they couldn't grant me access to my account, as they couldn't prove who I was. I would have to phone in again later from home and they would sort it. I phoned in and they granted me access. In all three cases, they said I could get in using my secret question. Well you could if the system gave you the chance to do this. On Friday, their customer services bod said they were tracking machine id's from where you access your account. Can you see the problem here? If you access your account from many machines, which I do, I'll have to phone them for each and every machine, that I use. Friday, they said they had "cleared the flag" and I could access my account again. Yes, I could over the weekend, but this morning at work, I'm getting the screen to phone them and again quote the security code. It looks like another 30 mins on the phone. I am really annoyed and I will probably miss out on something that I am bidding on. mobile app?
jinnantonnixx Posted June 2, 2014 Posted June 2, 2014 The database, which eBay said was compromised in late February and early March, held eBay customer's names, encrypted passwords, email addresses, physical addresses, phone numbers, and dates of birth. At least my favourite colour and my first pet's name isn't on the list. Not much they can do without that.
plexer Posted June 2, 2014 Posted June 2, 2014 With the current setup ebay should only allow you to change one thing at a time and lock you out of changes for a period of time, at the moment if I had someones password I could log in to their account, change the password, change the email address, change the address, phone number etc........ all in one go. Once a password has been changed they should send an email and then lock out other changes for 24 hours to give people a chance to get back in to their account. Ben
Garacesh Posted June 2, 2014 Posted June 2, 2014 Once a password has been changed they should send an email and then lock out other changes for 24 hours to give people a chance to get back in to their account. Good idea, unless it's your email broken into and not your eBay account
unixman_again Posted June 2, 2014 Posted June 2, 2014 Just phoned them - "Please stay on the line. Your estimated wait time is 83 minutes." I guess I'll have to try later tonight.
jonnykewell1 Posted June 2, 2014 Posted June 2, 2014 probably just a coincidence but since the ebay hack came to light i've had a few attempts on my steam account from Russia and now Turkey. Wonder if it's linked. Sadly I can't change the password on my steam account without having the client installed! annoying
Garacesh Posted June 2, 2014 Posted June 2, 2014 probably just a coincidence but since the ebay hack came to light i've had a few attempts on my steam account from Russia and now Turkey. How do you know? SteamGuard?
jonnykewell1 Posted June 2, 2014 Posted June 2, 2014 I got a couple of emails saying that they detected a log in from a new browser. Just updating my password now.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now