@fab_finds4u wrote:
Note code. Like a MailTo link. Have you ever sent a message to someone on Craigslist using their message reply system? You get a string of letters and numbers @ blah blah blah craigslist for their email address. You send the email to that address and person in the ad receives the email without you knowing what their email address was. CL was the middle man to pass on the email. Something like that. I think that's what they mean about the note code
Yes, I am familiar with Craigslist's system and I suspected the same. However, I do not believe eBay has any type of system like this: all messages are routed directly through their messaging service. The buyer also said he was given "several different note codes" and noted they "did not look like regular email addresses".
I also inspected the email headers and confirmed the message was sent to my address directly from his, with no eBay proxy in between. I can plainly see his email address @aol.com.
@fab_finds4u wrote:I seriously don't know what the big deal is about them having your email address.
It's a problem because it represents a security flaw that makes all eBay users more vulnerable to phishing attacks.
Consider, for a moment, what I could do if I knew your email address right now. I have your eBay username and I can see everything that you're selling.
With this information, it would be trivial for me (again, I'm a programmer and web developer) to create a picture-perfect spoof of an eBay notification email, just for you. It would be delivered straight to your address, it would have your username, and it would even have your item's picture and information in it. It might say your item sold, or had a new bid, or whatever. It would look exactly like the email you would receive from eBay, but when you clicked on the link, it would take you to my cloned site that looked exactly like eBay. You'd enter your username and password into my form, and just like that, I have full access to your eBay account (and probably your PayPal account, too).
This is what makes knowing your specific email address associated with your eBay account so powerful. It allows a potential attacker to create perfectly-tailored phishing emails that could trick even the most savvy among us.
Of course, this is all besides the fact that it allows buyers/sellers to bypass the eBay messaging system, nullifying all the protection that provides. Exposing an email address could also raise privacy concerns, potentially revealing a user's real name, location, or place of work. There is a reason most online platforms do not show users' email addresses.
