7

For the uninitiated, eBay sniping services are third-party organisations that people can use to bid on an eBay auction at the last second, obviously this requires the user to provide their eBay account details so the service can login to their account to make the bid.

My question is, would the passwords on these services be stored in plain text? After all, a hashed password stored on the sniper's servers wouldn't be very useful for logging in to a user's eBay account, would it? If not, how would these services store users' eBay credentials securely?

  • No, they don't have to. They can encrypt them. Also: if you plan to use such services I suggest you change your password with a new randomly generated one and then change it again after you have done your bids. – Bakuriu Aug 7 '16 at 12:18
3

would the passwords on these services be stored in plain text

Since they need your plain text password to log into ebay they would need to store it either as plain text or encrypted in a reversible way (i.e. not hashed). In the latter case there must be some way to decrypt the password, i.e. either a readable key or a library which does the decryption (and which could interface with some hardware based secure storage).

While the exact details are specific to each service you can summarize that if the service gets hacked your password will probably get exposed, either directly because it was stored plain text or indirectly because it was decrypted.

  • Is it true that they need your plain text password to log into ebay? Isn't it enough to obtain a copy of your authentication cookie? – Federico Poloni Aug 7 '16 at 12:49
  • @FedericoPoloni It may be (depending on what ebay stores in there; it may eg also compare IP addresses, user agents, etc). But it wouldn't be very practical (most average users likely wouldn't even be able to send them their cookies without reading a tutorial first). – tim Aug 7 '16 at 12:56
  • @FedericoPoloni: apart from that your session cookie (what you call authentication cookie) will probably change after some time, after timeouts etc and it might even have protection against session hijacking (like binding to source IP or browser fingerprint). And if the cookie does not have all these protection and can be used by the sniping service than it is nearly as bad if the cookie gets stolen than if the password got stolen. – Steffen Ullrich Aug 7 '16 at 13:12
  • @SteffenUllrich No, a session cookie is not the same thing as an authentication cookie. One persists after you close your browser, and the other doesn't. – Federico Poloni Aug 7 '16 at 13:18
  • @FedericoPoloni: I think the terminology what a session cookie is is confusing and depends on what you call a session, i.e. f you refer to the current browser session which closes with browser close or to the authenticated session which starts with login and ends with logout/timeout. In any case: for my statement it actually does not matter how you call it. – Steffen Ullrich Aug 7 '16 at 13:27
9

We can't really tell you how specific services implement this functionality.

But we can tell you what is possible:

  1. They store the credentials. This cannot be happening in hashed form, as the plaintext password is required. At most, it is stored in encrypted form, meaning that all passwords will be leaked if an attacker gains access to the key. If you have to enter your ebay password when signing up with the service, you can assume that this case applies. I would strongly suggest not to expose your password to third services.
  2. They use the ebay API [*]. It uses tokens to authenticate a user, so the user doesn't actually enter their password on any third-party sites, but instead, those sites get an access token.

[*] This is speculation. Theoretically, it should be possible to implement sniping functionality via this API - it provides bidding and authentication functionality -, but I did not try to implement it in practice.

  • 6
    Addressing your second point, it is prohibited by the ebay API policy: "The automatic and/or scheduled use of PlaceOffer is prohibited. An example is sniping, which is prohibited." and you must get approval before use the API to place bids. developer.ebay.com/devzone/xml/docs/reference/ebay/… – hectorct Aug 7 '16 at 12:25
  • @hectorct thanks, I already suspected that sniping may be against their terms, but I couldn't find anything. Do you happen to know if sniping without using their API is also against their terms (I would suspect so, but couldn't find anything about that either)? – tim Aug 7 '16 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.