How Safe is eBay? Or the Internet?

I just use paypal....there's any number of ways somebody can hack into your account, but they will have a tough time getting into paypal...as long as you are watching your email, you can cancel any purchases in your name....I think you have at least 3 days....and even if the purchase somehow goes through, either paypal or a credit card purchase are guaranteed to be legit, or there's no charge...

My Paypal is safe. I made the mistake of leaving one credit card on my Ebay account and that's the one they used.

I'll take your advice and use Paypal. I've never had a problem with them.

Nothing is perfectly safe. E-bait, Amazing zone, Bernie Madofff, Shearson Lehman Brothers or even the stairs outside your house are not perfectly safe. I tripped on three steps at work and split my face open one day. Stuff happens.

In your case it seems that the E-bay safety system worked as they hoped it would. Your compromised account was discovered before things got too far. The speed of e- commerce communication these days brings us great perks and great risks.

Congratulations, you only got scared by a hack. Your 401k account is safe, or is it???

_{Just kidding.}

This is the second time my Ebay account has been broken into. My bank accounts have never been compromised. Neither have my stock accounts or for that matter, any other on line accounts I can think of.

A few weeks ago, my neighbor told me about another neighbor going through my trash. Last week, a fellow Councilman also told me she saw someone taking papers out of my trash can earlier that day.

I guess it's time for a restraining order against him. I hate wasting my time on this stuff, but who knows if he's involved with my Ebay account theft.

I use a shredder, but not everything goes in it. Unfortunately, I don't have time to shred my junk mail, so it goes in the trash unshred.

Someone told me to keep all the papers I want to shred and then go to a community shred it day (credit unions and county offices provide the service every so often). I may need to do something like this.

Restraining orders don't work, but 2x4's do.

In other words, "You toucha my stuff, I breaka you hands "

Or, you have two choices:

1. Paper shredder.

2. You put paperwork in the furnace.

I put paperwork in the furnace, there's always that punk out there that likes to do jig saw puzzles.

I do both also.... unfortunately, its not on a regular basis that the burn lasts a while.

Shredded paper makes an excellent "dry add" to your compost heap. Helps mine catch nicely.

I always were going to try something like this. Making logs out of shredded paper

I'd love to knock that guy around, but I can't due to my position in the community.

The Captain of the Sheriff's Dept told me to get the restraining order. He told me that it's considered harassment and a violation of the RO if he steps foot on our property, takes stuff out of our trash can or even stares at my house while he's passing by.

He told me to make sure I have my video cameras set up, so I can send him a picture, or he said to just take a picture on my phone. Since this guy does stuff at 5:00 in the morning, I think the video cameras are a better idea. I just need to set them back up!

It may sound really unfriendly from me, but why in hell did you ever take the cameras down, especially when I think of all the "weirdos" coming out of the woodwork around the world today? Leave them up!!

You posted:- "I just need to set them back up!"

Having such cameras and NOT using them is dumb enough in my book! (sorry!) A simple wast of money too as electronics are generally not improved by not being used (capacitors, especially electrolytic ones lose their chemicals/dry out and inbuilt batteries simply "die" for example!).

But, plus having a right nutcase for a neighbor, who sorts through your rubbish, seems more than reason enough for you to think of that all on your "own-eo", without police help!!

Rant over!!

Have a great day in spite of my ranting!!

I have a camera pointing at people coming in my front door. It's one of those internet cameras and I can check on it when I'm away. Even has two way audio too!

I took down the camera set up, because I use it when my rental properties are vacant. It's a hassle to keep putting it up and taking it down (at my house), so I made the decision to try the internet camera.

I might buy a second system (one that I can install at any of the rentals when they are vacant). The price is so low, I could get a pretty nice system for a few hundred dollars. Maybe I'll set up the new system at my house and use the old system for the rentals.

Found this:

http://www.makeuseof.com/tag/x-security-reasons-avoid-ebay/

https://www.google.com/#q=ebay+security

I have one other thing to add. A couple months ago, the grandkids were over (6 year olds) and they took my laptop out of my workbag and started downloading all kinds of junk. They left it on the bed, turned off, with the battery dead.

About two weeks ago, I needed the laptop, so I charged it up and then turned it on. There were over a dozen web pages open. Junk like games and other kids stuff. I cleared out the programs they downloaded, but I noticed the computer wasn't running right - slow at times and the hard drive always running. I did a couple things on the laptop and turned it off.

Since my laptop is connected to my home network, I'm wondering if "they" were able to get into my desktop (also on the network) through the laptop. The only odd thing is that they didn't hit my Ebay account for over a week and that my Ebay account was hit right after my fog light purchase.

That was probably the vector. Good answer. Very common problem when people go out to 'free' sites. Only takes one click on a bad site to have a keylogger installed on your machine. Anti-virus programs should catch those however.

I would think that the antivirus program would catch it, but it didn't. I thought I'd have something when I ran the scan of my hard drive, but it came up clean.

I'm wondering if it's something like an ap. It runs on the cloud and accesses my computer via a small program is hidden in my network?

There seems to be all sorts of new vectors coming out all the time. I haven't been keeping up with it as much as I used to. It seems once the software folks patch up one vulnerability, the hacks find another to attack. Zero-day protection is what is really needed. That's the sort of software that is behavioral based instead of signature based detection. Like a lot of things, good protection is several layers of complementary protection methods. Takes a lot of careful planning to get it all dialed in. For most home users who don't have the benefits of full-time IT experts, the best approach consists of using a well-respected anti-virus and firewall protection to protect against and then doing what they can to minimize their exposure, e.g. only using one credit card on-line that is carefully watched. In essence, building procedural firewalls around your private data and financial data. You may want to spend a little time reading about the firewall that is installed in your home network. Your router usually has firewall setttings. There may be something in there that can improve your security posture. By all means, be sure to change the default password. If you've been using it for a while and didn't change the default password, do a hardware reset back to factory default settings, then change the password. Then see what other steps you can take to make it harder for outsiders to access your network. The manual that comes with your router will give you the options that you can change. It's terribly frustrating I know once you've been violated/hacked and can be very difficult to pin-point how it happened.

This is quite a crowded thread so may I underline Brave Sir Robin's sentence, "the best approach consists of using a well-respected anti-virus and firewall protection". This is excellent advice and worth the repetition.

Do that. A good AV, firewall, & a password strategy (see #15) and you're unlikely to face any issues. The automated attacks are much to busy going for the people who have left the door wide open to bother about the ones that have locked it.

Just what is a "well-respected anti-virus?" For our education, it would be good if you would list several.

I use AVG which I think is OK. Kaspersky has also been mentioned, but I know there are others.

Ones to avoid should be listed too. The ones I avoid are Norton and McAfee, because I have been told they are resource hogs.

Thanks.

I have used SOPHOS, with good success, so far (Knock on wood)...As far as I know, it is still free...

Thanks for the tip! Great advice!

That's what I was thinking. I'm just wondering how the spyware works. How does it gather the information? Does it do it through cookies and if so, how does it know how to link the cookies to my Ebay account?

Maybe should have handled it differently, by asking the address and the like.

one has to be diligent with online business as well as ones passwords

Ask for the address ?

Screw them !

They take your information, sell it to a third party, hit you with a bunch of trash and on top of that they again resell your information to other parties that have poor security that gets hacked, then they trace it back to the original source and try to install an auto bot into your drive.

Unfortunately there is no war crimes trials for hackers,,yet.

First things first after making a purchase online log out of the site and close the browser before playing.

Beware, it's not only Ebay.

I had a similar thing happen to my Amazon account last week. My account was broken into and items purchased. The hacker then ran a program that attempted to subscribe me to several thousand blogs and other email subscription lists. The email confirmations flooded my mailbox as an attempt to cover up notification from Amazon that there was a problem with my account.

I realized what was going on fairly quickly because I had gotten a scam phone call (that I didn't answer) shortly before from a number that I could trace to find that they had hacked other accounts and were impersonating Amazon to get "approval" for a large credit card approval.

I was able to get to my Amazon account via an email notice from Amazon notifying me that my password had been changed.

Meanwhile I have to give kudos for Amazon for being aware of the scam and putting everything regarding my account on hold.

Years ago I did a lot of business on Ebay, mostly as a seller. I quit when I decided I didn't like their policies and procedures and had no confidence in their security.

I was lucky because I've been working the internet, email systems and IT in general since before the i'net went public. I strongly advise those with little or no experience to tread very carefully when it comes to any kind of online sales and banking. This need kind of attack came hard and fast and quickly almost became overwhelming.

After almost a week, I'm still cleaning up subscriptions that I'm enrolled in that didn't require a confirmation email to confirm. I'm advising many sites of this new hacking issue, asking them to add email confirmation to their subscription processes. It's bad enough having to deal with the actual hack without spending hours and hours trying to unsubscribe from foreign websites.

I was also fortunate in that I was at home in front of my computer while all this was going on. If I had been away from my email it might have been worse.

Hooker

Thanks for the info. Sorry to hear about your Amazon problem - it's so similar to what happened to me.

At first, I deleted the emails, but because they kept coming in, I dumped them in the spam folder, then deleted them. I was tempted to respond with an unsubscribe, but I didn't trust the site - not sure if they'd take my email address and use it for more junk mail.

I'm still getting emails trickling in, but it's only about a dozen a day. I think the spam folder worked well.

You're welcome. I, too, used filters and search to get through about 3 thousand emails to find the Amazon email I needed to get my account under control. I use thunderbird so it wasn't all that difficult. It would have been impossible using something like webmail through a browser.

I'm now down to one or two emails a day that I still need to unsubscribe from. I suspect this is going to have long lasting ramifications along those lines. Not harmful but a real pain in the a$$.

Fortunately it didn't hurt me monetarily.

Hooker

The junk email was coming into my email box so fast, I couldn't get rid of them fast enough. I'd grab a page of them and then hit the delete button. By the time I finished, I'd have another dozen or so new ones in my box!

I was actually worried that I'd have to abandon my email - I use it for business and it's a way my clients and vendors reach me! I'm glad I found that I could throw them into the spam folder and new email from the source would wind up in there also.

Better to send those mails to the fbi cyber crime enforcement

What virus scanner do you use? I use AVG, but there are several other good ones. I have heard that Norton, and one other well-known one that I can't remember, are "resource hogs" and are not recommended. Do you have a working firewall? Do you have strong passwords? There are PW managers to generate strong PWs, and also remember them for you.

In tests around the world by leading magazines, Kaspersky is often the best or second best.....

I will not use anything else....and never had a problem, for probably more than 10 years.

I have McAfee and it's okay. Uses a lot of resources and it does slow things down at times.

I have a firewall on my router. Password is strong.

Kaspersky, especially if bought on ebay, is really cheap and does not slow my laptop much or should I say not obviously.....

Look around for good tests of antivirus software on the web.

Also, as I already mentioned, what is missed by all/any antivirus, is caught big time by Malwarebytes......as I said before, you ca try it for free for a month, you are in for a pleasant shock when it runs....

Do you by any chance have any account(s) with that "Do you want _____ to remember your password?"

With so much business being conducted electronically these days, just about everybody and their brother-in-law have your e-mail address.

BTW, I think the "other well-known" anti-virus program might be Mac Afee.

Correct. But spelled McAfee I think.

I was tempted to use a password remembering program, but I chose not to, because of the security risk.

I use McAfee - it comes with my AT&T Uverse service.

As I said in another email. My password remembering program is a text file that resides on a thumbdrive. And I actually have multiple textfiiles depending on genre; banking, stores, games, etc.

It would be extremely unlikely that those files could be hacked during the brief times I have it online. Inconvenient? Yes. But literally foolproof.

Hooker

PS - Call me paranoid but I believe the password remembering programs are huge targets.

Clever! I like what you did.

I could create long, random passwords - or I could even create long random account names too! If it's on the thumbdrive, I wouldn't need to remember any of them! Brilliant idea!

I used this approach, too. However there is a drawback to keeping cryptic passwords and accounts on a thumb drive, don't lose the thumb drive. You will never remember the cryptic passwords and accounts. I had this happen and lost all of my former accounts. Now I keep an encrypted text file with my passwords on a backed up harddrive on my network.

My thumbdrive gets backed up with my weekly system backup over an external usb drive. Then that hard drive is carefully secured in anti-static packaging.

And, yes, I am paranoid.

Hooker

I have a computer that never gets connected to the internet. It's my computer for secure things like income taxes, client data, etc. I'm thinking I can use it for my thumbdrive password file.

Good thinking! I had a desktop at my home office, another at my outside office and my laptop. I guess I can have three copies of the thumbdrive. Though I don't know how I'd use it to access log ins on my pad? Any ideas?

That's good enough that I'm going to send it off to my computer support group. Thanks for posting it.

It's not unique.

This approach is the same methdology that telemarketers use.

Have you received phone calls and your caller ID says the first number comes from say, Washington, then the second call comes from Georgia, then the next call comes from New Jersey, for example.

The phone will ring 3 times, then hang up. You, thinking it might be a business contact calls the number back, only to find it is an unsolicited sales call, so you hang up, the computer records the reconnect, stores the data and then resells your phone number to a third party affiliate.

I have that happen at least a couple times a week. Since I use my phone for business, I pick up the line as often as I can, even if it's a number I don't recognize. 2-3 times a week, I get nothing on the other end.

Sometimes, I get a call soon after the call, while other times I get nothing. My assumption is that they were testing to see if it's an active line and now they can sell my number to someone.

Its worse than that, and a good reason to NOT use a smart phone.

They ring you up and immediately put their phone down. They are outside of your country usually, but that call comes from within usually.

When you call back, they can place an illegal invisible app on your smart phone, that will dial expensive numbers for hours, in the middle of the night, when the phone is on the charger (the app checks for that first!), and you get a huge bill at the end of the month.

Up to 8 hours per night of illegal calls......

This is making the rounds in the UK right now.

Never use a smart phone for returning such calls when you do not 100% know who is calling, have a normal landline or an old mobile phone, one that is definitely NOT smart!!

Wow, this is very upsetting to hear!

Lucky for me, I don't call those people back. They also have some sort of device that sends a caller ID number they can program (not the number they're calling from). I've had 911 show up on my caller id, but it wasn't emergency.

Thanks for the tip!

Great advice! Thank you.

Quite a bit of good information posted but as yet there is not mentioned any small footprint effective Internet security software.

One mistake is not changing the admin password to routers; it's the key to scavenging all of your personal and business activities, make it a priority; do it Now.

An effective hack to thwart a host of unsolicited activity is resetting your computers time in effect set it inaccurately just a few minutes faster than Internet time and not all but many types of nefarious malware will be unable to execute.

Another help is cogent awareness provided by business center security overview entities and I'll recommend the service providing 'we live security' newsletters; google that.

I concur on the password strength and uniqueness issue, make them no less than 14 characters employing upper case, lower case, numerals, punctuation and special characters.

Check the advanced settings of your email where you may stipulate how many mails can be received and or sent within a specified timeframe; do this in the settings of your prescribed sites too including ebay.

Good day

Great tips. I'm curious how setting the time will thwart hackers?

The execution file uses a time setting or sequencing to execute and you're turning the functionality off

Got it! Great tip!

Good idea!

You gave me another idea. I have two credit cards with small limits ($500). I could use them for purchases and if they try to make a big purchase, it gets declined.

Thanks for the tip!

It could be keylogger adware on your computer, that could have been secretly installed when you visited a site. Yes, Ebay and Amazon would be prime targets. Both of those sites probably have precautions in preventing hackers from getting into people's accounts, however they are having to deal with attacks all the time, so some might manage to get through. One known countermeasure is to change your passwords often and to make them strong passwords, if you can use symbols, rather than numbers and letters. I've ordered several things from both EBay and Amazon and have not had any issues. The last time I ordered something was around the end of August, I ordered a bed frame and mattress and had them delivered to someone's house.

There is no keylogger or other adware on my machines and I always use strong passwords. My account info and passwords are stored on a thumbdrive that is only accessed when I need a reminder to log into a website.

However, I am in two US federal databases that have been hacked. God knows what kind of info the hackers got out of there. One of them I know contained most of my life history for security clearance purposes.

And the feds provided me with security and ID protection software that didn't tell me anything about my Amazon problem. But it does a hell of a job telling me when sex offenders move into or out of town.

Hooker

I received a notice from the federal gov't regarding the database hack. Same thing as yours - security clearance information! I didn't sign up for their free software.

I like your idea about storing account info and passwords on a thumbdrive. Does it automatically load the account name and password, or do you cut an paste it in?

I just use dumb ascii text files so it's cut and paste. But I just usually manually type the info in. I used to use a spread sheet but gave it up when formats change. Text file formats don't change over time.

Hooker

If there was a keylogger on my computer, would it make a difference if I had a long or short password?

I've heard that long passwords are better, but will it make a difference if the keylogger program has been installed?

No, keyloggers, as the name implies, record your keystrokes and then send them off to some obscure private email server. The software usually has an SMTP (simple mail transport protocol) program embedded in it.

Hooker

So it sends it out via an email program. i thought there had to be a way to get the info to "them".

Thanks for the info.

Give Silent Circle a whirl

I was watching a TV show , where they were interviewing a former Government Security expert who has gone into private practice. His advice on passwords for the common man, was to use a phrase or event in one's life ; "I am going to go fishing with Peter tomorrow", or something like that. Now , take anyone of the letters in each word, first, second etc, and string them together to form another "word". Using the first letter, your password would be : IagtgfwPt. Now, add a random number or punctuation mark, and he feels that you have a secure and simple password, which is easy to remember. Change your password by using the 2nd letter in each word, etc..Apparently, they were never able to auto -"unscramble" passwords of this nature. Anyone have other ideas? Thanks.

If one is challenged by remembering sequences of numbers and symbols then yes you've revealed a way some may have success with passwords. Thinking there was a movie about a foreign service officer that taught his children a song that was actually the combination to his cache.

"Thinking there was a movie about a foreign service officer that taught his children a song that was actually the combination to his cache."

The Pacifier starring Vin Diesel

Our company has just switched to a 16 digit password for user accounts. Must have at least one capital letter, lower case letter, special character and number.

Suggestion from the IT administrators was to use a phrase that one could remember.

I prefer to use a limerick. There are just so many things one can do in Nantucket.

I hope they are also requiring a new password at least every 90 days and not be able to reuse any older password.

The company I used to work for required a password change every 90 days but you could immediately change it back to your old one.

I tried to tell IT management that was a bad practice but they got offended and complained to my engineering management that I was interfering in their business.

Hooker

Yes, not only changing every 90 days, but it can't be one you used in the past year.

Yup and ours you cannot have more than three consecutive characters from the same category and when you have to change the password, the new password has to change a minimum of 8 of the characters. So now I just write them down.

"So now I just write them down."

Essentially defeating the purpose of complicated passwords. (But I don't blame you)

Essentially defeating the purpose of complicated passwords.

Well, not exactly. Passwords are to restrict unauthorized access to your computer or online accounts. If your physical location is secure, then writing them down is not really going to compromise the security of the online access. At least not very much. Yes, technically, it's less secure than storing them in your head (for now), but it's all about managing risk.

Now if you have them written down and taped to the side of your monitor, that's probably not very wise.

I think most people are at a greater risk of using a less complicated password that they can remember than using a complex one that they have to write down (and keep out of sight). Most damage is done online over the net, not by someone physically in your home or business.

I actually don't write them down anywhere, but it sure is tempting given how hard it can be to remember the new ones. Limiting the access attempts is far more effective protection than insanely hard to remember passwords. Sure, no dictionary words, or names, or dates, I get that. It could be as easy as the first letter of "My wife's name is Anne and she is the 3rd child" = MwniAasit3c No one or no machine is going to guess that in 5 tries before locking out the account. Ever. But that is not a complicated enough password. Go figure.

Our company was just purchases last December by an even larger company.

They have a number of extra employee programs accounts that you sign into. Educational Training, as well as your insurance, retirement, time keeping, Employee news letters to name a few.

Each with a different sign in for security. And most you change passwords every 60 days. When I was on vacation, I missed changing it, and had to call the head office to get it corrected.

About 4 years ago, I purchase an password app where I started to enter my login information. As well as any pertinent information such as password changes as well as a reason. I don't know how I did it before. But I have well over 100 passwords, most are from vendor sites, such as McMaster or Grainger, but still it seems if your not organized you can get lost very quickly.

I keep it in a program, because there are times I need to access and I don't want to risk carrying a hard copy around. I selected this software because the software encryption is one of the most difficult to break.

But I'm not going to say its impossible using the FBI breaking an individuals iPhone last spring.

Exactly. Which is why the UK Cyber Security agency now advises against forced regular password changes. Interesting reading for anyone concerned with the user end of security.

https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry

We do issue that kind of advice. Sorry about that. However, passphrases to the rescue: "It's the 3rd down & 25 to go....", would seem to fit the bill. "Woods is 2 under par.". "You want $250 for /THAT/?!". I could go on.

I hope you mean /at least/ 16 characters.

I like it!

Buy and install "Malwarebytes"! Try the free version, it will probably find dozens of bits bad stuff.

Look here:-

malwarebytes

Buy it and install it permanently!!

Someone told me about this program years ago. I never bought it.

Why do you like it over something like McAfee?

Malwarebytes doesn't replace McAfee, it complements it. Essentially Malwarebytes monitors your web browsing and heads off malicious code from being loaded on your system through your browser.

I use it and Ad-aware antivirus and a web tracker wall called Ghostery. Ghostery runs in browsers like Firefox and Chrome I also have Windows Defender running on this Windows 7 system. With these, and the knowledge not to open email attachments from unknown sources, I find I don't need a resource eating commercial AV program.

Hooker

Malwarebytes is an "addition" to ANY antivirus program, not instead of. I did not make that fully clear.

Try it for free, after a day or so, you will buy it, its totally brilliant!!

The only antivirus program that really does what it is supposed to do is Kaspersky to my mind, and by far NOT the most expensive!! But even it needs Malwarebytes....(link is in post #29!)

I use a network tracker that alerts when unauthorized use of the network occurs and records the unauthorized users credentials.