Dear Ebay, Why are you scanning my ports?

[southern*sweet*tea]

https://www.forbes.com/sites/daveywinder/2020/05/25/did-you-know-ebay-is-probing-your-computer-heres...

Why are you letting a third party application probe my computer WITHOUT MY PERMISSION?

[dhbookds]

the article says:

port scanning appears to be a good practice fraud detection mechanism.

so that seems to be the reason.........

[southern*sweet*tea]

With the recent events here, I don't believe that for one nanosecond.  Not that I don't believe it's a good security measure - it certainly can be. I just don't believe Ebay is doing it for that reason. 

If they were really doing it for security reasons, send out an announcement - let me know. Don't just assume I want some random third party application scanning my computer. Not that they would find anything, all my ports are either stealth or totally closed, but still...

Nothing like having your privacy invaded without your knowing it.

[go-bad-chicken]

---

@southern*sweet*tea wrote:

https://www.forbes.com/sites/daveywinder/2020/05/25/did-you-know-ebay-is-probing-your-computer-heres...

Why are you letting a third party application probe my computer WITHOUT MY PERMISSION?

---

That's not good. As the article states eBay's reputation is built on trust. And this sort of practice by eBay essentially erodes that trust that both buyers and sellers have counted on in the past.

"What do security researchers say about this port-scanning activity?

Jake Moore, a cybersecurity specialist at ESET, says that it never sits well with him when companies do things in the background without overt warnings. "Although they are trying to cut down on fraud," Moore told me, "companies like eBay thrive on trust, so when this gets abused, the general consensus could sway the other way and start to look at the competition." Moore agrees with me that any site that's connected to our finances is expected to offer the best protection against fraud as is possible. So port scanning appears to be a good practice fraud detection mechanism. "But when websites start scanning ports without prior warning," Moore concludes, "it can feel intrusive."

Security expert John Opdenakker agrees. "I don't expect a website to start scanning on my local computer," he says, "and sharing my data with third parties without consent." That third-party would, in this case, be LexisNexis Risk Solutions via the ThreatMetrix product. "Implementing this kind of behavior by default," Opdenakker says, "without users being clearly informed and having a choice to opt-out to me seems like a serious infringement of privacy regulations.""

[chapeau-noir]

Privacy policy as of 6/20/2020:

https://www.ebay.com/help/policies/member-behaviour-policies/user-privacy-notice-privacy-policy?id=4...

"We process your personal data for various purposes and based on several different legal bases that allow this processing. For example, we process your personal data to provide and improve our Services, to provide you with a personalized user experience on this website, to contact you about your eBay account and our Services, to provide customer service, to provide you with personalized advertising and marketing communications, and to detect, prevent, mitigate and investigate fraudulent or illegal activity. We also share your information with third parties, including service providers acting on our behalf, for these purposes. In addition, we may share your personal data among eBay group companies in order to fulfil our contract with you under the User Agreement and, if applicable, the Payments Terms of Use."

They don't, however, say how they do this - the fact that this is done is repeated in quite a few tech blogs, etc.  I read about it sometime back but at that point didn't do much about it for reasons I don't remember, probably one of those bookmarked ideas I never got back to.

[prettywoman-2012]

---

@southern*sweet*tea wrote:

https://www.forbes.com/sites/daveywinder/2020/05/25/did-you-know-ebay-is-probing-your-computer-heres...

Why are you letting a third party application probe my computer WITHOUT MY PERMISSION?

---

Wow. Just wow! Must have to do with eBay's efforts to remain "transparent."

PW🐿

[go-bad-chicken]

---

@chapeau-noir wrote:

Privacy policy as of 6/20/2020:

https://www.ebay.com/help/policies/member-behaviour-policies/user-privacy-notice-privacy-policy?id=4...

"We process your personal data for various purposes and based on several different legal bases that allow this processing. For example, we process your personal data to provide and improve our Services, to provide you with a personalized user experience on this website, to contact you about your eBay account and our Services, to provide customer service, to provide you with personalized advertising and marketing communications, and to detect, prevent, mitigate and investigate fraudulent or illegal activity. We also share your information with third parties, including service providers acting on our behalf, for these purposes. In addition, we may share your personal data among eBay group companies in order to fulfil our contract with you under the User Agreement and, if applicable, the Payments Terms of Use."

They don't, however, say how they do this - the fact that this is done is repeated in quite a few tech blogs, etc.  I read about it sometime back but at that point didn't do much about it for reasons I don't remember, probably one of those bookmarked ideas I never got back to.

---

"We process your personal data for various purposes and based on several different legal bases that allow this processing."

Most of us agree to the user terms of service when we create an account here on eBay. But the casual shopper (our prospective buyers) most certainly did not agree to this. Many shoppers are here just browsing for the first time and have never agreed to any terms of service.

What eBay is doing is a kin to a police officer just sticking their head through your bedroom window and stating, "Sorry for the disturbance folks. I am just checking to make sure no one has been murdered in this house lately."

[gracieallen01]

What I wonder is, if it is such a good measure of fraud protection,  since scamming sellers is also fraud, why are there still so many scammers getting through on ebay?  Or is this just to make sure they get their fees and sellers don't skip on them?  If anybody has all that data and info, who is utilizing it?

[chapeau-noir]

---

@go-bad-chicken wrote:

---

@chapeau-noir wrote:

Privacy policy as of 6/20/2020:

https://www.ebay.com/help/policies/member-behaviour-policies/user-privacy-notice-privacy-policy?id=4...

"We process your personal data for various purposes and based on several different legal bases that allow this processing. For example, we process your personal data to provide and improve our Services, to provide you with a personalized user experience on this website, to contact you about your eBay account and our Services, to provide customer service, to provide you with personalized advertising and marketing communications, and to detect, prevent, mitigate and investigate fraudulent or illegal activity. We also share your information with third parties, including service providers acting on our behalf, for these purposes. In addition, we may share your personal data among eBay group companies in order to fulfil our contract with you under the User Agreement and, if applicable, the Payments Terms of Use."

They don't, however, say how they do this - the fact that this is done is repeated in quite a few tech blogs, etc.  I read about it sometime back but at that point didn't do much about it for reasons I don't remember, probably one of those bookmarked ideas I never got back to.

---

"We process your personal data for various purposes and based on several different legal bases that allow this processing."

Most of us agree to the user terms of service when we create an account here on eBay. But the casual shopper (our prospective buyers) most certainly did not agree to this. Many shoppers are here just browsing for the first time and have never agreed to any terms of service.

What eBay is doing is a kin to a police officer just sticking their head through your bedroom window and stating, "Sorry for the disturbance folks. I am just checking to make sure no one has been murdered in this house lately."

---

Exactly - as I mentioned above - they say they do this, and you highlighted their legal verbiage, but I remember thinking that port scanning was pretty invasive not to have SOME kind of notification.

Security Boulevard boils it down - excerpts from several blog/discussions.  I found it interesting: 

https://securityboulevard.com/2020/05/is-ebay-port-scanning-your-pc-probably/

[mam98031]

Boy you can bet I will be discussing this with my Tech guy [my husband] tomorrow.  So nice to have an in house techy.  Thank you for sharing.

[gwzcomps]

I have a friend that "runs the internet" to simplify his job. I will be checking with him out of curiosity. I don't see what eBay has to gain though. I have considered using a cheap junk computer solely for accessing questionable sites like Facebook. I wonder what kind of scraping eBay does with the mobile app?

https://en.wikipedia.org/wiki/Web_scraping

[gwzcomps]

Well his initial response was "They can scan all they want. Everyone scans constantly." I am guessing it is not that big of a deal.

[mam98031]

---

@gwzcomps wrote:
Well his initial response was "They can scan all they want. Everyone scans constantly." I am guessing it is not that big of a deal.

---

That is my thought too, but my husband will be able to tell me more tomorrow.  See I would have thought my firewall wouldn't let them through.  We must have a good one as I don't have issues, but then I'm lucky having my own personal techy.

[richard1rst]

---

@go-bad-chicken wrote:

---

What eBay is doing is a kin to a police officer just sticking their head through your bedroom window and stating, "Sorry for the disturbance folks. I am just checking to make sure no one has been murdered in this house lately."

---

Well I will admit that to a normal user the tech language is not easy to understand. But I came away with a slightly different point of view. It is not so much that the officer is sticking his head through the window so much as it is that he is making sure the window is locked so that no one else is coming through the window.

When I had a brick and mortar store in a downtown area it was not uncommon for the beat cop to check the doors in the evening to make sure they were locked.  But if the door was unlocked then they would investigate further.

Again, I admit I am not techie enough to know for sure. But if all that they are doing is making sure the door is locked and they are not actually coming in and rummaging around then I am not sure I see a problem.

[go-bad-chicken]

---

@richard1rst wrote:

---

@go-bad-chicken wrote:

---

What eBay is doing is a kin to a police officer just sticking their head through your bedroom window and stating, "Sorry for the disturbance folks. I am just checking to make sure no one has been murdered in this house lately."

---

Well I will admit that to a normal user the tech language is not easy to understand. But I came away with a slightly different point of view. It is not so much that the officer is sticking his head through the window so much as it is that he is making sure the window is locked so that no one else is coming through the window.

When I had a brick and mortar store in a downtown area it was not uncommon for the beat cop to check the doors in the evening to make sure they were locked.  But if the door was unlocked then they would investigate further.

Again, I admit I am not techie enough to know for sure. But if all that they are doing is making sure the door is locked and they are not actually coming in and rummaging around then I am not sure I see a problem.

---

Here is a litmus test that every single one of us would more than likely have differing opinions about but like the Forbes article points out; "What would happen if the scenario was reversed and I probed eBay's ports?" Dollars to doughnuts a handful of Virginia Farm Boys would be knocking on my door sometime in the near future.

From the article:

"Something that Moore asked me to point out would not play well in reverse, if a user performed such a port scan on a bank, or eBay, every time they wanted to access it then the chances are good they would find themselves in trouble with law enforcement. In the U.K., at least, Moore says, "a bank can notify the police of a port scan/breach and have someone arrested in a very short period."