ebay security loophole

mikewill34

!!!!!! wrote: »

Isn't that a Catch 22 situation.

Without an ebay account you can not create an ebay account because you haven't got an email address linked to an ebay account, but to get an email address linked to an ebay account you have to have an ebay account. But you can't have an ebay account because you don't have an email address linked to an ebay account.:rotfl:

My head hurts

I see what you mean but if the following rules were implemented it would be possible to create an account.

1. User is prohibited from selling or buying until email account is verified.
2. If the email account of a user is not verified within 7 days (for example) the account is automatically deleted.

This would protect against fraudulent use of somebodys valid email address.

mikewill34

verityboo wrote: »

I have just looked and I still have the e-mail from ebay from when I set up a second account (so that I had one for buying and one for selling) asking me to verify my e-mail address to complete setting up the account (exactly what you insist should happen)

Try creating a new account (like I have just done today) and the welcome message does NOT ask you to verify the email address.

I appreciate that this would not stop someone registering using one of the fake email address generators that there are, but as these are fake email adresses they will not hurt the use of someone's real email address.

TrickyWicky

albionrovers wrote: »

Bet you're one of these Facebook types who give it Like = Respect, Ignore = Disrespect? :rotfl::rotfl::rotfl:

I'm not actually on facebook or twitter FYI.

I was merely pointing out that there was little point pointing out ones career and how well they think they've done for themselves in a thread about them being a victim of fraud.

Seriously, do any of us here really care about him being an IT pro? - I couldn't give a hoots to be honest. I'm not one and even I have multiple email accounts - big deal!

Sure its good to warn others of problems but boasting about your job / career path while your at it is just uncalled for.

mikewill34

TrickyWicky wrote: »

Sure its good to warn others of problems but boasting about your job / career path while your at it is just uncalled for.

My email address has been fraudulently used due to failures in ebay's security measures.
I have NOT been careless or lapse with my security.
I am reasonably confident that the faker used a random email address generator, which just happened to yield my email address.

Point taken about job / career, it was NOT intended as a boast.

ballisticbrian

Mike, why are you denying they had access to your email account? It is clear an email account cannot be created with the same name as yours. (there cannot be two identical email addresses). They hacked your email address first, that is the starting point.

If you were a hacker, why would you use a "random email address generator" - you would just create an email address from scratch or used a hacked account.

mikewill34

ballisticbrian wrote: »

Mike, why are you denying they had access to your email account? It is clear an email account cannot be created with the same name as yours. (there cannot be two identical email addresses). They hacked your email address first, that is the starting point.

If you were a hacker, why would you use a "random email address generator" - you would just create an email address from scratch or used a hacked account.

Have you tried to create an ebay account (today).

You can type in any email address no hacking is required, which is not attached to any current email address.

If anyone is willing to participate in an experiment to see this in action please send me an email address (by PM) you own which is not associated to an ebay account and I will be able to without hacking your email address create an ebay account linked to that email address.

After the experiment is complete I promise I will delete the ebay account.

verityboo

I still can't understand why someone would bother setting up an ebay account using your e-mail address. If nothing else on the account relates to you then I can't see why you are bothered and what the person who set the account up has to gain?

mikewill34

ballisticbrian wrote: »

If you were a hacker, why would you use a "random email address generator" - you would just create an email address from scratch or used a hacked account.

1. ebay requires email address to create account.
2. my guess is that a random address is used in an attempt to make the ebay account less tracable and it was a fluke that the email generator accidentally geneated my email address.

mikewill34

verityboo wrote: »

If nothing else on the account relates to you then I can't see why you are bothered and what the person who set the account up has to gain?

I don't give a hoot about the fake ebay account or the person setting it up.
But I strongly object to my email address being associated with anything fraudulent, thus tarnishing it's reputation.

albionrovers

TrickyWicky wrote: »

I'm not actually on facebook or twitter FYI.

I was merely pointing out that there was little point pointing out ones career and how well they think they've done for themselves in a thread about them being a victim of fraud.

Seriously, do any of us here really care about him being an IT pro? - I couldn't give a hoots to be honest. I'm not one and even I have multiple email accounts - big deal!

Sure its good to warn others of problems but boasting about your job / career path while your at it is just uncalled for.

And there was zero point in your comment. I didn't take the OPs comment like that at all. Why the massive chip on your shoulder?