Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Sylvia Else <sylvia@not.at.this.address>
Newsgroups: comp.misc
Subject: Ebay hacked
Date: Thu, 22 May 2014 17:38:56 +1000
Lines: 16
Message-ID: <bu5nskFnom7U1@mid.individual.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net XI/USiymOIigfoVB+V++CA8u2nW0r9dwPeZA5aqFg+EoagbWVR
Cancel-Lock: sha1:zQomoUFlT1mN6plTGlgWX9RzU5g=
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
Xref: csiph.com comp.misc:2983

http://www.smh.com.au/it-pro/security-it/ebay-hit-by-cyber-attack-urges-users-to-change-passwords-20140521-zrkiu.html

"EBay also was using a more easily cracked method for protecting the 
passwords it kept on file. There are two commonly used ways to secure 
passwords, encryption and hashing. EBay was using encryption, which is 
the more easily broken, said Mr Coates."

What's the point of recommending strong passwords to users when the 
mechanism used for storing them makes the strength moot?

Why were they using encryption? The hashing approach isn't exactly new 
technology.

When does incompetence become negligence?

Sylvia.