eBay

raphael@ebay.com · ‎05-28-2014

Hello Canadian eBayers,

Welcome to the last Weekly Board Hour of the month of May 2014! Please start posting your questions and comments, we'll be with you at the top of the hour.

pierrelebel · ‎05-28-2014

My question today concerns the recently announced problem with password.

Referring to all staffers in Toronto, I am curious about your personal reaction to the announcement.

Did any of you ever expected such breach to happen?

In addition to working for eBay, you are also members of eBay and, as such, had your personal information (name, address, date of birth, etc...) compromised. How do you feel about it? Is it important to you or see it as nothing to worry about? Are you even at liberty to talk about it?

rose-dee · ‎05-28-2014

If you'll pardon the quote from "Marathon Man", I think we all want to know: "Is it safe?"

Can eBay give us any firm assurances that the hole in the dam has been stopped, and that there won't be farther-reaching repercussions from the breach?

karl*katz · ‎05-28-2014

My question is about the changes to the Discussion Boards in the USA where all of the social boards are being eliminated and only boards directly related to eBay will remain.

Any word on if this will be extended to the Canadian site ?

rose-dee · ‎05-28-2014

I have another question on a different subject entirely. This is a follow-up, as I did pose this question previously, but it was never directly answered.

Would it be possible for eBay to offer sellers (and specifically perhaps, store owners) an easily visible "Contact Seller" button that could be placed prominently on all listings as an option?

As you probably know, there has been a lot of concern lately about the increasing difficulty buyers are having sending a message directly to a seller, with a simple, innocent question, either after a sale (i.e. not with the intention of opening a case), or prior. Many sellers are reporting "accidental cases" being opened by buyers post-sale, who are simply asking a follow-up question such as "what size of box is the item in?", "are you planning to list similar items", etc. They find themselves routed into the case system, and get trapped there, not knowing what else to do.

I realize eBay has tried to automate buyer-seller communications to accommodate the "big guys", but having the option of "de-automating" the process would be a huge boon to smaller sellers, and would, in my view, not have any detrimental effect on sellers who still prefer not to answer their buyers' questions directly. As a buyer, I have to say I hate the "FAQ" system, and find it always irritatingly difficult to contact a seller directly -- and I know what to look for!

If such a "Contact Seller" option/link/button can't be offered, could you please explain why that is? We store owners have many other optional features available.

Thanks!

ryanne@ebay.com · ‎05-28-2014

Hi karl*katz,

At this time it won't be extended to the Canadian site. The US Discussion boards have many more boards which is why the boards are being consolidated.

If there are specific topics that you would like to discuss, we also encourage our members to create a topic in Groups.

Thanks,

Ryanne

karl*katz · ‎05-28-2014

Thank you for clarifying that.

It does seem bizarre that there will be no General Social Boards left on the .com site at all.

Maybe our American friends will come up here to post

Anonymous · ‎05-28-2014

@pierrelebel wrote:

My question today concerns the recently announced problem with password.

Referring to all staffers in Toronto, I am curious about your personal reaction to the announcement.

Did any of you ever expected such breach to happen?

In addition to working for eBay, you are also members of eBay and, as such, had your personal information (name, address, date of birth, etc...) compromised. How do you feel about it? Is it important to you or see it as nothing to worry about? Are you even at liberty to talk about it?

Hi pierrelebel.

One would certainly hope to never see this kind of thing happen at eBay.

It was profoundly disheartening to hear about the cyber attack. Like most people, I was relieved to learn that my financial information (bank and credit card details) and the info of our customers was not exposed, and that passwords were encrypted with a very strong, salted hash that is unlikely to be easily cracked.

I have been employed in eCommerce Product Management since 1994. I have had plenty of experience in my career to set up the expectation that no company or Government body can ever be 100% secure from social engineering or fraudulent access. So from that perspective, the news was not shocking, just disappointing.

I was glad to see that eBay took the extra step of forcing all users globally to update their password - a process that is still very much underway. Doing this makes the stolen information much less valuable to whomever has it. While it is unsettling to have name / address / phone / dob info out there, this info is not exactly difficult to get, and pales beside the risk of someone holding your actual eBay login credentials.

I have been astonished by the technical / operations / networking processes and incredible round the clock effort behind preparing the password reset flow for 100's of millions of our friends to pass through successfully, without melting the site from huge, huge flows of traffic. I know many people were hoping for even more action even faster, but the technical complexity of doing things like this for a business of our scale is enormous.

Best part of the story so far has been the resiliance of our marketplace. Sellers continue to list, buyers continue to buy, and millions and millions of people have gone ahead and updated their password already.

raphael@ebay.com · ‎05-28-2014

@rose-dee wrote:

I have another question on a different subject entirely. This is a follow-up, as I did pose this question previously, but it was never directly answered.

Would it be possible for eBay to offer sellers (and specifically perhaps, store owners) an easily visible "Contact Seller" button that could be placed prominently on all listings as an option?

As you probably know, there has been a lot of concern lately about the increasing difficulty buyers are having sending a message directly to a buyer with a simple, innocent question, either after a sale (i.e. not with the intention of opening a case), or prior. Many sellers are reporting "accidental cases" being opened by buyers post-sale, who are simply asking a follow-up question such as "what size of box is the item in?", "are you planning to list similar items", etc. They find themselves routed into the case system, and get trapped there, not knowing what else to do.

I realize eBay has tried to automate buyer-seller communications to accommodate the "big guys", but having the option of "de-automating" the process would be a huge boon to smaller sellers, and would, in my view, not have any detrimental effect on sellers who still prefer not to answer their buyers' questions directly. As a buyer, I have to say I hate the "FAQ" system, and find it always irritatingly difficult to contact a seller directly -- and I know what to look for!

If such a "Contact Seller" option/link/button can't be offered, could you please explain why that is? We store owners have many other optional features available.

Thanks!

Hi rose-dee,

Years ago, if you remember, the Ask Seller a Question link was located in the seller information box at the top of the page. Following numerous complaints from sellers that they were getting too many questions from buyers regarding stuff that was already outlined in their item description, and to mitigate problems arising from buyers not taking the time to read that description, we moved the Ask a Question link below that part of the listing. It was the same motivation that drove the creation an automated set of responses that are basically drawn from the attributes put on the listing by the seller and that are shown to the buyer before they get to actually compose an email for the seller. According to our data, this system works well.

If you would like a more prominent "Ask me a question" link on your listings, there's a way you can create one for yourself with some clever HTML coding, by basically copying eBay's "Ask a Question" link into some text at the top of your description. If you'd like some guidance on how to do that, send me an email and I'll be happy to help.

rose-dee · ‎05-28-2014

Although I'm somewhat reassured by what you say, the main concern I had with this attack (and I'm sure many others had as well) was the potential of access to combined name+DOB information.

You are right that name and address information is out there easily and openly accessible on the internet for all of us (and criminals) to see, but I doubt many people have that data combined with their DOB. My name and address isn't of much use to a cyber criminal, but with the birth date added, all sorts of nefarious activities come to mind (including passport, driver's licence and other ID fraud).

In addition, many institutions like banks use DOB as a security feature beyond passwords, or in allowing access to other personal or banking information via telephone or internet.

It's this potential for combination of personal information that most concerns me. Can you comment on this aspect at all? How likely is it that whoever hacked into eBay could still put 2 and 2 together?

rose-dee · ‎05-28-2014

raphael@ebay.com wrote:
Hi rose-dee,

Years ago, if you remember, the Ask Seller a Question link was located in the seller information box at the top of the page. Following numerous complaints from sellers that they were getting too many questions from buyers regarding stuff that was already outlined in their item description, and to mitigate problems arising from buyers not taking the time to read that description, we moved the Ask a Question link below that part of the listing. It was the same motivation that drove the creation an automated set of responses that are basically drawn from the attributes put on the listing by the seller and that are shown to the buyer before they get to actually compose an email for the seller. According to our data, this system works well.

If you would like a more prominent "Ask me a question" link on your listings, there's a way you can create one for yourself with some clever HTML coding, by basically copying eBay's "Ask a Question" link into some text at the top of your description. If you'd like some guidance on how to do that, send me an email and I'll be happy to help.

While I understand the impetus behind removing the easily visible "Ask Seller a Question" may have been seller complaints about too much communication, I'm not sure that most smaller sellers would agree. As a seller, I was dismayed when the contact button disappeared to the bottom of the listing screen. Also, if my own experience as a buyer is any indication, I'd guess that a majority of buyers don't prefer the lack of easy access.

This is why I wondered if such a thing could be offered to sellers as an easy option -- is it possible? EBay has so many other alternative features. Why not permit the individual seller to choose?

I personally would love to have an "Ask Me a Question" button on my listings, but I'm not at all HTML-capable, and I imagine a lot of other sellers would be in the same boat. I'll send you a note though for the information and see if I can manage to work it out, thank you for offering.

Anonymous · ‎05-28-2014

@rose-dee wrote:

If you'll pardon the quote from "Marathon Man", I think we all want to know: "Is it safe?"

Can eBay give us any firm assurances that the hole in the dam has been stopped, and that there won't be farther-reaching repercussions from the breach?

Hi rose-dee.

No one can realistically promise that a cyber attack cannot happen again to eBay, or any other business. Just as no bank can promise that a vault will never be broken into one day. Following this analogy, if eBay was a vault, it is getting even thicker walls and tougher locks right now. And hopefully we are demonstrating to all that we are committed to doing the right thing for our customers when something unexpected happens.

You can and should feel safe using eBay. 🙂

At the same time, this incident is a good reminder for everyone to take steps to protect yourself online, whether it is eBay, online banking, online investments, financial planning, life insurance, prop casualty insurance... in all cases the best practices are:

1. Deal with reputable sites (like eBay and PayPal).

2. Never re-use passwords across multiple sites.

3. Choose a strong password that is difficult for others to guess.

pierrelebel · ‎05-28-2014

Thank you Rodney for your comments. Your unique (and always positive) perspective is always appreciated.

"buyers continue to buy,..."

I wish that was right. I realize you are not at liberty to provide information about the current lower level of traffic on eBay - that information will most likely become public in late July when eBay releases its financial second quarter and management answer questions from shareholders and financial institutions.

However, based on my personal observation and eBay experience, traffic has come to a standstill, at least in my category (Stamps).

It has been nearly thirteen years since I have seen the traffic (buyer's interest) on eBay so slow. Hopefully things will improve soon.

Anonymous · ‎05-28-2014

@rose-dee wrote:

Although I'm somewhat reassured by what you say, the main concern I had with this attack (and I'm sure many others had as well) was the potential of access to combined name+DOB information.

You are right that name and address information is out there easily and openly accessible on the internet for all of us (and criminals) to see, but I doubt many people have that data combined with their DOB. My name and address isn't of much use to a cyber criminal, but with the birth date added, all sorts of nefarious activities come to mind (including passport, driver's licence and other ID fraud).

In addition, many institutions like banks use DOB as a security feature beyond passwords, or in allowing access to other personal or banking information via telephone or internet.

It's this potential for combination of personal information that most concerns me. Can you comment on this aspect at all? How likely is it that whoever hacked into eBay could still put 2 and 2 together?

Hi rose-dee.

It is indeed concerning that name, address phone and dob information was accessed. To our knowledge, that info has not surfaced anywhere to this point.

rose-dee · ‎05-28-2014

@Anonymous wrote:

"3. Choose a strong password that is difficult for others to guess."

Rodney, I know we all have some vague idea about what a strong password is, but could you elaborate (without actually giving any sample passwords) on what in eBay's view would constitute a strong password on its site.

I think my password is unguessable and unassailable, but am never quite sure. Thanks!

forester_studios · ‎05-28-2014

I have also noticed that sales seem to have slowed down since the password problems last week. Is Ebay considering a way to help sellers sales increase? How about a month of free listings? Maybe that would help sales recover.

raphael@ebay.com · ‎05-28-2014

@rose-dee wrote:

@Anonymous wrote:

"3. Choose a strong password that is difficult for others to guess."

Rodney, I know we all have some vague idea about what a strong password is, but could you elaborate (without actually giving any sample passwords) on what in eBay's view would constitute a strong password on its site.

I think my password is unguessable and unassailable, but am never quite sure. Thanks!

We've actually published such guidelines as part of our recent communications on this topic. You can find it here:

https://info.ebayinc.com/pages/tips-for-creating-a-strong-password

rose-dee · ‎05-28-2014

raphael@ebay.com wrote:
@Anonymous wrote:
"3. Choose a strong password that is difficult for others to guess."
Rodney, I know we all have some vague idea about what a strong password is, but could you elaborate (without actually giving any sample passwords) on what in eBay's view would constitute a strong password on its site.

I think my password is unguessable and unassailable, but am never quite sure. Thanks!
We've actually published such guidelines as part of our recent communications on this topic. You can find it here:

https://info.ebayinc.com/pages/tips-for-creating-a-strong-password

Thanks -- this is the common stuff, but I was thinking of such things as:

-- Is longer always better than shorter?

-- Does including other characters than alpha-numeric help?

-- If so, does it help to "mix up" alpha-numeric + misc. characters and/or upper/lower case?

and so on, i.e. the more nuanced aspects of password creation.

Anonymous · ‎05-28-2014

@forester_studios wrote:

I have also noticed that sales seem to have slowed down since the password problems last week. Is Ebay considering a way to help sellers sales increase? How about a month of free listings? Maybe that would help sales recover.

Hi forester_studios.

Now THAT is a good idea. Unlikely to happen in exactly that form, but a good idea nonetheless. 🙂

Right now the focus is on ensuring we get everyone through the password change process globally, and then recovering paused marketing and communications programs, etc.

raphael@ebay.com · ‎05-28-2014

@rose-dee wrote:

Thanks -- this is the common stuff, but I was thinking of such things as:

-- Is longer always better than shorter?

-- Does including other characters than alpha-numeric help?

-- If so, does it help to "mix up" alpha-numeric + misc. characters and/or upper/lower case?

and so on, i.e. the more nuanced aspects of password creation.

Yes to all of the above 🙂