| Wed July 23 2014 20:53:42 |
Researchers Say eBay Feedback Leads to Privacy Breach
By: Ina Steiner
|
Sponsored Link
|
Academic researchers say they've uncovered a "security breach" and a "privacy flaw" on eBay due to the way the feedback system works.
"The eBay Feedback System as currently implemented has serious privacy flaws. When sellers leave feedback, buyers' purchase histories are exposed through no action of their own. In this paper, we describe and execute a series of attacks, leveraging the feedback system to reveal users' potentially sensitive purchases."

EcommerceBytes explains what the researchers found and why they think it's important in Thursday's newsletter - click here. For example, buyers may not want it known that they are purchasing gun holsters or pregnancy tests. Here are the recommendations the researchers made in their report - let us know what you think!
Recommendations to eBay: We recommend that the Private Listing option should become the default listing method. This removes any visible link between the buyers and sellers. Alternatively, we propose that eBay use a non-persistent pseudonym for buyers on the sellers' feedback pages; this would make it harder to link feedback. Additionally, the timestamp of the feedback left could be generalized (for example, by displaying only the date) in order to make linkage attacks more difficult.
Recommendations to buyers: Buyers on eBay can make their feedback profile private by changing a setting in their Feedback Forums page. However, accounts with private feedback profiles cannot be used for selling. We therefore recommend that eBay users maintain two separate accounts, a private profile for buying and a public account for selling. (However, this does not obviate the need for an eBay policy change, since it prevents a user's selling account from reaping the benefits of the positive feedback he has earned as a buyer on eBay.) We also recommend that users avoid reusing usernames across different websites in order to retain stronger pseudonymity.
Recommendations to sellers: eBay offers a selling option called a Private Listing which operates exactly like a regular listing while keeping all buyer information anonymous. This is a way for sellers to offer their buyers all buying benefits while retaining privacy. Other users cannot see the list of bids on the item, and all feedback on the item is anonymous for feedback profile views. The listing is included in searches as usual, and it has no extra fees associated with it. |
|
|