“But even a 50-random-characters password cannot guarantee 100 percent security, as hackers can just intercept passwords in plain-text when users are logging-in for example. “Encryption does not really help, as our penetration testing practice shows – over 80% of encrypted hashes can be bruteforced within 48 hours,” said Ilia Kolochenko, CEO of High-Tech Bridge in an email to Threatpost. America, that was a big red flag to anyone who has added a little salt to their hash.Įncrypting a password is of limited value unless it’s hashed using an algorithm that isn’t broken or collision proneĮncrypting a password is of limited value unless it’s hashed using an algorithm that isn’t broken or collision prone (hello, MD5), and they’re salted, adding a little randomness that slows down any brute-force cracking.ĮBay quickly clarified its original statement in a Reuters article with a claim that passwords were protected with “proprietary hashing and salting technology.”Įxperts, however, caution that eBay customers shouldn’t ignore the site’s request to change passwords, especially those that users may be re-using elsewhere. Worse, eBay’s initial communication about the breach said that along with plaintext customers’ names, email addresses, physical addresses, phone numbers and dates of birth, encrypted passwords were stolen. PDT, eBay said it was still in the process of notifying users via email. No homepage splash with a similar notification no emails to users no forced password reset mechanism. A post went up on the eBay blog informing its 145 million customers that a breach had occurred between February and March and the recommendation was made that users should change their passwords. Inquiring minds still want to know more about how the stolen passwords are secured and why the online auction house’s response has been so wonky? And until a short time ago, there was still a question as to whether a Pastebin post claiming to be a full dump of the password database for sale was legitimate until eBay confirmed otherwise.ĮBay incident response did not enjoy its finest hour yesterday, in particular with regard to its messaging. The eBay password database hack is a prime example.

As is the case with most high-profile data breaches, despite an initial disclosure of information, more questions are inevitable.

Hacker blocking my ebay listings