Recognizing your computer via cookies? IP? Flash Objects? - New proposed EBAY policy

[zymo]

This is going to be a nightmare, not only for people in this group, but for numerous other ebay users. This is ebays new policy as posted on their announcement board.

April 14, 2008 | 11:45AM PST/PT

Hello…I’m John Canfield, Senior Director for Trust & Safety policy management. My team specializes in working to keep the site safe and protected against fraud. Much of the company’s work around safety happens behind the scenes, but some of our efforts are also public-facing. Masking and protecting our Community’s identities on all bidder IDs on auction-style listings, the PayPal Security Key, our work with Yahoo and other domains to block email from unauthenticated addresses, and encouraging safer payments – each of these address a particular aspect of security and is making a dramatic difference in the overall security and safety of the marketplace and consumers’ confidence in shopping online. Our technologies – those that exist today, as well as those that we are designing for tomorrow – are helping to make the internet safer every day.

I’d like to tell you about a new safety initiative that launches on April 14th.

Trusted Selling with Identity Confirmation
One of the ways criminals attempt to defraud people on eBay is by gaining access to member accounts with well-established reputations which they then use to set up listings in that person’s name. They gain this access often through a phishing email that convinces an unsuspecting member to click a link and enter their User ID and password.

To protect the Community against this type of fraud, beginning today, eBay will start noting which computers members typically use to conduct their buying and selling activity. After our data collection phase, sometime in June eBay will begin verifying our sellers when they list an item to ensure they are logging in from the same machines they have successfully used previously – usually a home or business computer.

If you are a seller, and you attempt to list an item from a different computer – for example, from a PC you are borrowing in a hotel or library – eBay will make an automated call to the phone number you have registered with us to confirm it is really you. We may also prompt you to verify your identity in other ways.

Initially, this identity confirmation process will only be applied to selling, although we may be extending this to other high-visibility activity in the future.

Sellers, please update your registered phone numbers
Now more than ever, having a current phone number on file with eBay is vital to the safety of the Community and to your business. A wrong or outdated phone number may delay your ability to list items or respond to your customers, if eBay cannot verify your identity.

Have a cell phone? Registering it could save you time and money
If you carry a mobile phone, we encourage you to add this number as a secondary phone number in your registration details, so that we can reach you when you are away from your business or residence where you normally use your trusted computer. Your secondary number will not be shared with other members and will be treated in accordance with our Privacy Policy.

[ebay-sucks]

Wow.

Quickly read it and for me I see they are forcing you to have a landline phone.

Many people I know travel and sell on ebay and use hotels, I suppose they are going to call them because one person I know buys items from antique malls as he is traveling, list them from the hotel room and ships them upon payment as he is traveling. He is retired and he says it pays his way around the country and even is money ahead when they get back home from a long road trip in their RV. So this guy who is taking trips and having 0 money in it and is ahead money will have to deal with a stupid phone call every night he list his buys for the day.

Will read it again and see what else these sneaks are up to.

Some of us who list from 4-5 different computers will have to have landlines all over the house next.

Notice they said if you have a cell you can add it to your numbers?
Do they know that landlines are almost a thing of the past? Guess not.

[ebayhateluv]

HI Folks_ Just recd this in my in box-- Am I reading this correct--they have a New SOftware/Ant-Fraud Program to Track us by our Home pc??

You Techy guys--Please help me understand this?? Thanks!

BY the way- this is from Ebay Trust And Safety Director...

Trusted Selling with Identity Confirmation
One of the ways criminals attempt to defraud people on eBay is by gaining access to member accounts with well-established reputations which they then use to set up listings in that person’s name. They gain this access often through a phishing email that convinces an unsuspecting member to click a link and enter their User ID and password.
To protect the Community against this type of fraud, beginning today, eBay will start noting which computers members typically use to conduct their buying and selling activity. After our data collection phase, sometime in June eBay will begin verifying our sellers when they list an item to ensure they are logging in from the same machines they have successfully used previously – usually a home or business computer.
If you are a seller, and you attempt to list an item from a different computer – for example, from a PC you are borrowing in a hotel or library – eBay will make an automated call to the phone number you have registered with us to confirm it is really you. We may also prompt you to verify your identity in other ways.
Initially, this identity confirmation process will only be applied to selling, although we may be extending this to other high-visibility activity in the future.

[doughboykilla]

how gay is that so is it going to track pc or ip cause i use the same pc's for all my ebaying

[scouse12345]

They already track Ip, as well we know.. this would have to be more sophisticated to actually tie you to a particular Pc.. i personally wouldn't worry about it, Ebay can never lock themselves down 100%, and as soon as the word is out regarding how they're tracking it, a fix will be implemented..

Don't lose sleep over it..

[ebayaintstupid]

to prevent you from deleting cookies.

Cookies is how they do this. My bank does the same thing. If you don't delete your cookies, it does not prevent you from continuing to log in without special ID information.

I noticed this when I deleted my cookies and later tried to log into a bank account I use. It asked me for more information, like my address.

But this is another sign. EBAY doesn't want you guys. They only want the big guy. They are making it more and more painful to do business and less and less likely they are worth the aggravation for the profit you make.

[ebayaintstupid]

I already posted one. Just relax and think it through. It is a constant set of puzzles.

[jollybee]

That does bring up a good point though. When I am at home at use my desktop for a few days rather than my laptop, and I log in to my banking or credit cards, it comes up "we do not recognize the computer you are using". I then have to answer to security questions to get into my accounts.

I will switch to my laptop and go thru the same process again. I never thought about that before. Also, I have the same "computer name" on both computers and I always--but always clear cookies before and after each log in and out on each computer. They both run on the same cable connection and through the same router. I would think it should know who I am.

But I am not a "techie" by FAR. I'm sure there will be an easy way around this--we've got some of the BEST Brains here in the forum to help us all.

[suspended2008]

I think ebay tracks by cookie in the PC, if no cookie is found, then they assume the PC is different , then they will check IP for location area, if the location is far away from the original, then they take serious concern, this is what I think they are doing.

[aspkin]

If that's the case, and ebay doesn't want you to delete cookies often. Then use different users for your PC. Create a different user on your computer per eBay account you have. Erase if you become suspended and create a new one per eBay account. I'm not sure what it's called for XP, but this makes it where you won't have to delete your cookies everything to switch computer users. Just switch users, and you're good to go. Remeber to change your Ip address before logging in.

I can see a lot of upset people who won't be able to sale or list on eBay, not us really because we're smart, but the common eBay people. EBay will lose business over this.

They're slowly killing their self.

My bank does the same thing, well they don't go as far as calling you to confirm but they go through extra steps and it's annoying at times.

[sdot10]

I REALLY dont think its going to be a big deal. I think its going to be more like the bank account thing. My bank account is the same way if i delete cookies. If anything I think it becomes the thing where you may have to provide info everytime you log in. If thats the case just keep a piece of paper by your computer with any info they may ask. I do the same for all my paypal accounts. I highly doubt that ebay is going to call everytime a person logs into a different computer. Youll just have to answer some questions to prove youre you. I actually kinda like it because ive had countless auctions ruined by people hijacking other peoples accounts.

[becca073]

For those of us who operate on multiple accounts & with dial-up this is going to create a problem isn't it? Especially if we only have 1 computer. Or like Aspkin said create a USER for each ebay account, then login to that USER on your computer and then access eBay through whatever method you normally use. Am I understanding that right? Then with each USER you wouldn't have to always delete cookies cause those cookies only pertain to that USER?

[terryp]

Maybee MAC address

[jscan]

haven't seen this posted but heres some more news for eBay users in Australia. It appears eBay is further stepping up there "security" efforts.

read below
_______________________________


Today we’re starting a new initiative to help prevent account takeovers.

From now on the system will be noting the computers members regularly use when buying and selling on eBay. Then in June, we'll begin checking the computer you use to list an item to see if it's one you regularly use.

If you list an item using a different computer (e.g. at a friend's house, in a hotel, at the library) we may make a call to the phone number on your account to confirm that it's really you. We might also prompt you to verify your identity in other ways.

Please update your registered phone number
Please take a minute now to update your contact information. To add a phone number follow these steps:

1. In My eBay, click Personal Information (under My Account)
2. Click Edit in the Registration name and address column
3. Click Change in the Registration address column
4. Add in you current phone number

Having your current phone number on file helps eBay protect you. A wrong or outdated phone number will mean we can’t verify your identity. This could delay your ability to list items or respond to your customers.

If you have a mobile phone, we strongly encourage you to add the number in your contact details. That way we can reach you if you’re away from one of your usual computers.

eBay treats your phone numbers in accordance with our Privacy Policy.

Why are we doing this?
Some criminals attempt to defraud people on eBay by illegally gaining access to member accounts and setting up fraudulent listings in that person’s name. Most often they obtain the member's user ID and password using a phishing email.

By checking that the seller is using one of their usual computers, eBay can better identify and stop this kind of fraudulent activity.

These changes are part of our ongoing efforts to make eBay a safe and secure marketplace. We thank you for your support as eBay continues to improve security.

Regards
The eBay team

[Fiev]

It's better to use many FireFox PROFILES. Each for one eBay account. It's more simple than multiusers or multibrowsers..

[aspkin]

Originally Posted by Modee

Here's the definitive answer: this "new EBAY policy," if implemented, has nothing to do with what PC or MAC (computer you are on). Nothing to do with MAC (Media Access Control) address. It has to do with cookies.

Do your own research.

Go to a banking website like www.bankofamerica.com , that you use for online banking. Log in using firefox, set to delete cookies on each restart. Due to the lack of cookies, the system will tell you that it does not recognize your computer, and ask you to answer one or more of your secret questions. Prior to that it will ask you what state you are in. All this is not because it does not recognize your computer - the website has no way of knowing what computer you are using, but simply because your cookies are cleared.

The interesting thing is....

Then quit firefox, which will delete the cookies, and log in again. Although cookies are gone, this second time using firefox the website will claim to recognize your computer.

Now, this is not the first time I have logged into my bank accounts using that banking website. I've done it many times on this same computer using my Safari browser, which is not set to delete cookies. And yet, when I tried it with firefox, set to delete cookies, at least on the first try the system claimed not to recognize my computer.

So it seems that cookies have something to do with it. But then...when cookies are deleted and firefox restarted, why would the website recognize my computer the second time? After all, the cookies are still gone.

You see what I mean - if the system could truly determine what computer I am using, it would not matter what browser I am using or what cookies are present. But then, if cookies are the sole answer, then why would the website figure out what computer I am using even with cookies deleted?

One thing is clear - with cookies deleted the banking website asks every time what state I am in. So that much, it is unable to discern without cookies. So cookies are definitely part of the answer here, maybe the whole answer.

This needs more research. More data.

---

Here is what typical banking websites say about "recognizing your computer," and it does seem to imply that it is all about cookies:

http://www.vigproduction.cz/en/privacy-statement.php
Cookies

If you visit our website, we may save cookies in your computer, to identify you at the time of your next visit. With cookies, we may e.g. customize the website to meet your requirements or save your password, so that you don’t have to type it every time. If you wish to prevent us from recognizing your computer, please, configure your Internet browser to delete cookies from your hard drive, to block all cookies, or to warn you before saving any cookies.

http://www.secuwa.org/home/news.whats_new
# Re-register your computer if, to fix a problem, you must delete "cookies." Enhanced Online Security uses secure cookie technology to identify your computer. If your cookies are deleted, your computer will appear to the system as unregistered. When you try to access your online account, you'll be asked the challenge question. After successfully answering it, you can re-register your computer by going to User Options, "Enhanced Online Security," and selecting "Add extra security to this computer (Recommended)," clicking the Submit button, and selecting "OK" on the confirmation screen.

http://www.tcbk.com/personal/multifactor-authentication.aspx
7.) When will I be asked to answer Security Questions?
You may be required to answer a security question at various times based upon your typical online banking activity. For example, you may be asked to answer a security question when accessing the system from a different computer or if you access the system at a time that is inconsistent with your previously established usage. You may also be asked a security question after deleting the cookies in your web browser.


In the end, even if deleting cookies leads to issues with EBAY, just set aside ONE of your browsers for EBAY, and never log into your EBAY account with anything other than that one browser. Use that browser for EBAY only. If you have just one EBAY account, you will have no problems.

If you have multiple EBAY accounts, then you may need more than one browser (Safari, firefox, Netscape, Mozilla, Opera, etc.) One browser for each EBAY, dedicated to that EBAY account only and for nothing else.

There are always alternatives.

Samething with my Bank of American account, I think the IP address plays here, but I'm not 100%. EBay could be different.

[aspkin]

Originally Posted by Fiev

It's better to use many FireFox PROFILES. Each for one eBay account. It's more simple than multiusers or multibrowsers..

And this doesn't share cookies between profiles?

[oscar_98]

sorry for the repeat post Modee has shown me the light.


concerning firefox profiles:
I was wondering the same thing. I don't know enough about how firefox works, but aren't the cookies for different profiles stored in the same folder together?

[oscar_98]

"After our data collection phase, sometime in June eBay will begin verifying our sellers when they list an item to ensure they are logging in from the same machines they have successfully used previously – usually a home or business computer."

They are saying they will be checking your identity at the time of the listing. If they will be using cookies to track this, how would it effect people who use auctiva for all their listings? I NEVER list an item directly through eBay. I assume they will be using IP to track this and if you always use auctiva then you will always have their IP associated with your listings, correct?
If that is correct then it would not matter what computer or IP you list from, so long as you always use auctiva, or something like it, to list.

[Fiev]

Originally Posted by aspkin

And this doesn't share cookies between profiles?

This does not. Profiles are absolutely isolated (cookies, bookmarks, cache, stored passwords, authenticated sessions, history). Each profile stores all info in separate folder. You can make a "template" profile and after that just clone it by copying template profile folder to new folder and adding info about new profile in Profiles.ini of your FireFox:
===
...
[Profile09]
Name=09
IsRelative=0
Path=C:\ffprofiles\09

[Profile10]
Name=10
IsRelative=0
Path=C:\ffprofiles\10
===

For example here we have 10 profiles 01..10 and they content is located in folders C:\ffprofiles \01 \02 \03 ... \10

[becca073]

I don't normally use Firefox cause I seem to have problems when using dial up. But I just looked around the browser and cannot seem to locate where you would create a new user. Can someone point me in the right direction?

[craigoaus]

I use Equinux iSale to list this is Apple/Mac software. When you register the software it grabs your computer serial number which can be read on the iSale web site.
Is it possible that ebay has adopted similar technology?
If they have it could make things difficult a separate computer for each ebay account.