|
Auctionbytes-NewsFlash, Number 408 - October 09, 2002 - ISSN 1539-5065
| Next Story
eBay Rolls Out New Security Feature to Combat Dictionary Attacks
By Ina Steiner
AuctionBytes.com
October 09, 2002
|
Some eBay members were upset when they came across a security feature that eBay rolled out several weeks ago as part of its new Community Protection Initiative. Unaware that it was a security feature, users feared it was a tactic by eBay to ban members from using certain third-party software.
The feature was put in place several weeks ago to thwart "dictionary attacks," also known as brute-force logon attacks. Hackers were using dictionary attacks to try to hijack eBay member accounts. Hackers use automated robots to try logging into a member's account using a dictionary of possible passwords. eBay's new security feature kicks in after a certain number of failed log-in attempts, whereupon a screen will come up that asks the member to enter their User ID, password, and a Security Code that appears on the screen. The "Security Code" is a picture of a number, requiring a person to be at the computer to enter the code.
eBay spokesperson Kevin Pursglove said the feature is part of eBay's initiative to increase trust and safety on the site, and he said members should avoid short passwords and should use a combination of letters and numbers in their passwords to make them safer. Pursglove said the new feature is one of a number of efforts rolled out as part of the eBay Community Protection Initiative started this year.
eBay members are also vulnerable to other types of attempts to gain access to their passwords. A message on eBay's announcement board posted Monday reminded members:
"If you are concerned about the authenticity of an email solicitation for personal information that suggests that it is from eBay, you should not provide personal information. Instead, forward that email to spam@ebay.com so that we can investigate it. Likewise, if you are concerned about the authenticity of a web page that you have linked to through a spam email, you should not provide personal information, and you should forward the email containing the link to spam@ebay.com."
|
Email this story to a friend.
| Next Story
Discuss this story in our forums.
|