Why is eBay lying to us?

[zamo-zuan]

This is a response to eBay’s claims that the new “Application Access” authorization is to repair the avatars and feedback that have been missing from the eBay community, originally posted here: https://community.ebay.com/t5/Share-Community-Platform/Intermittent-issues-on-Community-platform-mis...

The information mentioned is freely available to anyone. You do not need any form of application authorization to retrieve this information. 

As evidence to back up this claim, I will have to give an explanation of exactly what these “Grant Application Access” messages are, how the eBay API works, and what information is freely available.

What is the eBay API?

The eBay API is basically a system that will allow software to communicate with eBay and exchange information/data. Much of eBay’s website uses the API to retrieve the information that it displays on the “My eBay” and “Sellers Hub” pages.

What information is available through the API?

In basic terms, there’s basically two classes of information that are available on eBay. For this explanation I’ll be calling them Public and Private.

For example, when you’re browsing eBay and looking at other users' listings, the information you’re seeing is “public”. This means anyone can see the information. You could see the item they posted, the photos, the pricing, etc.

In another example, if you go to revise your own listings, you’ll see all the “public” information that was shown, but since you’re logged in to your own account, you also have access to seeing additional information such as rate tables, handling time, promotion values, etc. This is the “private” information. Typically, you could only see “Private” information on your own account. 

Some functions of eBay are private as well. If you try to create a new listing, that is considered a “private” function. Nobody else could create new listings for your store. Only you could.

What are these “Grant Application Access” pages?

Let’s say for example that I’ve created a piece of software to assist with creating listings, and checking recent orders to see if any of the listings that were created sold. We’ll say in this example that the name of this software was “ExListing Manager”

By default, “ExListing Manager” could use the eBay API to check information that is public.

Now you’ve learned about “ExListing Manager” and you’d like to try it. Once you’re registering for the software, it’ll direct you to a webpage that states:

“Grant Application Access: ExListing Manager”

If you agree to this request, it basically generates a token (let’s say like a password) that will allow “ExListing Manager” to access your private eBay data. 

Prior to agreeing, if “ExListing Manager” attempted to create a listing on your store, it wouldn’t be allowed. But after you had agreed, it can send the request to create a listing to the eBay API, and it can now use the token, and eBay would allow the software to create the listing on your behalf.

“ExListing Manager” also is supposed to track if the listings it creates are sold. So it will also be using API to check your sold listings. It could check for notifications from the API with your token to confirm if an order is processing, and then typically once an order is paid, that would trigger the software to basically say “The item sold! Let’s increase the sold number by 1”.

How are we being lied to?

EBay had claimed that this new authorization for the eBay community was to restore the avatar images and feedback modules that had not been working for a couple months now. For those of us who have experience with the eBay API and know what the Application Access grants, we know this is a lie.

The store avatar images and feedback? Those are both pieces of PUBLIC information. You do not need any private access to retrieve these images. Just like how you could go to another sellers store page and see their images and feedback on the eBay website directly, software could do this with the eBay API without any special access.

To prove this, I’ve tested it myself. I browsed to the eBay homepage and one of the daily deals it’s giving me is for this listing: https://www.ebay.com/itm/202694169021

If I use the eBay API call “GetStore”, with this sellers name: “harmanaudio”, I do not have any “Application Access” for them. I will only be retrieving public information. The full information is quite long, but this is an excerpt from the results that I receive from the eBay API:

{

  "$": {

    "xmlns": "urn:ebay:apis:eBLBaseComponents"

  },

  "Timestamp": "2021-11-19T18:23:12.611Z",

  "Ack": "Success",

  "Version": "1177",

  "Build": "E1177_CORE_API5_19110890_R1",

  "Store": {

    "Name": "Harman Audio",

    "URLPath": "harmanaudio",

    "URL": "http://www.ebay.com/str/harmanaudio",

    "SubscriptionLevel": "CustomCode",

    "Description": "Welcome to the official eBay store for the Harman family of brands: JBL, Harman Kardon, AKG, and Infinity. Shop premium wireless speakers, headphones, home speakers, car speakers, and more!",

    "Logo": {

      "URL": "http://i.ebayimg.com/00/s/MTE0WDIwMA==/z/FqcAAOSwdBRZg6by/$_1.JPG?set_11.JPG?set_id=807"

    },

Sure enough, you could see in the “Logo” > “URL” section, there’s the avatar image. Again, I want to stress this is all public information freely available to the eBay API without any Application Access.

Then I could use the GetFeedback API call on the same store and here is another excerpt:

{

  "$": {

    "xmlns": "urn:ebay:apis:eBLBaseComponents"

  },

  "Timestamp": "2021-11-19T18:26:23.179Z",

  "Ack": "Success",

  "Version": "1201",

  "Build": "E1201_CORE_APIFEEDBACK_19196963_R1",

  "FeedbackScore": "197512",

As you could see, this information is all public, freely accessible information that does not require any form of Application Access.

And then for the URL links to others listings? You could literally do that with a URL and a simple store name:

https://www.ebay.com/sch/zamo-zuan/m.html?_nkw=&_armrs=1&_ipg=&_from= 

Just change zamo-zuan to the username. You do NOT need the eBay API at all for this one!

The data already exists in the Community Forum servers

One more alarming thing is that we're being told this access is what's restoring the images. But if you take a look at existing posts in the dev console, you can see that the avatar images already exist on the Khoros/Lithium servers!

For the record, I retrieve that on another PC that was NOT logged in and NOT authorized! As you could see in the screenshot, the image already exists on the lithium server. No access to eBay is needed, and certainly not API access.

If the images already exist on the Lithium server, if we're not seeing them, then Khoros/Lithium itself is blocking us from seeing information on their own servers.

Yet we're being told that we need to approve access in order to see this information...?

So this brings me back to my original question…

Why is eBay lying to us about Application Access? What information is really being retrieved from our stores?

The only reason for Application Access would be to access any private information. What private information could the eBay Community possibly need? 

Furthermore, they’re not even following their own terms, as they are supposed to be transparent about the reasons they’re requesting access in the Application Access request itself. It even states if you click for more information that “Additional capabilities as described to you in the application or by the application’s provider” - and the eBay community does NOT describe what additional capabilities are being accessed. And as mentioned, the reason we’re being given does not require this type of access.

To make things even worse, it says “Just go to my eBay if you change your mind”. I tried to go there to monitor our 3rd party authorizations, and the preferences page isn’t even loading to allow us to see what applications are accessing our accounts, or remove their access! 

So what’s really going on here, eBay?

What private information is being accessed by the Community software?

Why is the request not even informing us of what is being accessed?

Why is the wool being pulled over community members' eyes?

Why are members being told reasons that could easily be debunked?

[zamo-zuan]

---

@my-cottage-books-and-antiques wrote:

We were told that ebay/Khoros could either 1. bring back the avatars etc later (I suspect when some sort of regularly scheduled API sort of thing occurs between the two companies) or we could get them back NOW but have to go through the authorization (which I gather eventually will be unnecessary. 

Doesn't bother me. I see nothing sinister here, I see no lies. 

---

As somebody who has worked on eBay software for 8 years, I am directly stating that there's no reason for them to need authorization to receive any of the three pieces of information they stated they needed authorization to restore.

It is certainly a lie to say they need API access to restore the Avatars, listings, or feedback.  I even gave examples of doing it myself without that information in the OP, and I showed how the listings could be done with a simple link. None of them need authorization.

If you'd like, I could even make a video right now of myself retrieving your avatar, listings, and feedback through the eBay API - and obviously you have not granted me authorization to see any private data. That is because this is all public data.

Of course, it's up to you if this is something that bothers you. You could take eBay's word for it if you'd like. But I've seen with my own eyes that this information does not require authorization. And more importantly, I know exactly what is granted with the authorization we're giving them. The authorization could grant the community software the ability to access literally everything in your own account.

To be clear, even eBay Customer Service is not allowed this much access to an account. CS can't be trusted with that amount of access, but they want to require us to give this access to use a Community forum??? 

[luckythewinner]

Perhaps those of us who use posting IDs on the boards are smarter than some have given us credit for.

[my-cottage-books-and-antiques]

@zamo-zuan  Thanks, but I don't need to see a video. 

[monster-deals]

I hope they just leave it as is.

The last thing any of us want is lowest bid contract  computer coders mucking about.

This place is broken enough without more "updates"

[gurlcat]

---

To be clear, even eBay Customer Service is not allowed this much access to an account. CS can't be trusted with that amount of access, but they want to require us to give this access to use a Community forum??? 

---

--For those at the back who maybe didn't hear you.  
By the way, I've had Ebay For Business reps get into my account a couple times to help with something, but I had to give permission each time, and I had their name, ostensible 'proof' of who did it, if they did something destructive on accident, never mind on purpose.  Everyone reading this (besides valueaddedresource) now grants WHOLESALE access to ......who .....exactly, and to do what, exactly?  

[gurlcat]

Jeez, and I don't even care to have an avatar.  But look at my feedback: 1111.  Should I make a wish or something?  

[zamo-zuan]

---

@gurlcat wrote:

---

---

--For those at the back who maybe didn't hear you.  
By the way, I've had Ebay For Business reps get into my account a couple times to help with something, but I had to give permission each time, and I had their name, ostensible 'proof' of who did it, if they did something destructive on accident, never mind on purpose.  Everyone reading this (besides valueaddedresource) now grants WHOLESALE access to ......who .....exactly, and to do what, exactly?  

---

That's the main issue here. We don't know what the authorization is actually for, or why they'd need it.

Honestly, even if we don't look at any of the technical side or the eBay API, there's enough to wonder why we're being forced to allow access.

Because if we look at the experiences as they happened, it was only AFTER the avatar/fb/listing issues were fixed on the forums that I was forced to allow access. The issues were already fixed. And THEN I was forced to allow access to even log in. So if the problem was already fixed, what are we all being forced to approve then...?

[valueaddedresource]

Just FYI, I reloaded the community just now and it required me to sign in again....still no request for permissions.

[shipscript]

@valueaddedresource 

I cleared my cookies and cache on another browser I use and signed in again to the community. No grant-page on that sign-in and no grant page using my main browser. I guess we are special.

[mam98031]

---

@alcoforever wrote:

Frankly, I don't care.   I get to see FB and listings links now that were MIA for a few months.  The machinations ebay or khoros had to go thru to make it work is not my concern.

---

That is an exaggeration.  They were gone for about a month, maybe less.

[valueaddedresource]

I've now had to log in 4 times since this requirement supposedly went into effect, still no request to grant permissions and my avatar is still there.

sheila@ebay  please address the very valid questions and concerns that have been raised in this thread.

[coffeebean832]

---

@mam98031 wrote:

---

@alcoforever wrote:

I get to see FB and listings links now that were MIA for a few months. 

---

That is an exaggeration.  They were gone for about a month, maybe less.

---

I reported it on Sept 15th with both Sheila and Tyler confirming they saw the same issue that day. The info was restored Nov 18th. That's 9 full weeks.

[katzrul15]

I had to grant permission to access the forums, etc. 

I just asked DD to log in with her Selling account.  It did not ask her to do anything except click in to the community forums??  (She does not normally post or log in to the boards)

Glad to just be back to a more normal board.  No clue what all the behind the scenes means...

[argy_eyes]

@zamo-zuan 

Thanks for your well-written explanation of the legitimate uses of "Grant Access" and for asking important questions that eBay apparently chooses to ignore.

I hesitated to complete the access opt-in, particularly because of the ambiguity that you noted:

---

@zamo-zuan wrote:

It even states if you click for more information that “Additional capabilities as described to you in the application or by the application’s provider” - and the eBay community does NOT describe what additional capabilities are being accessed.

The "Grant Access" thing is either another example of numerous things on eBay that are never honestly explained, or it's a clever tactic by Khoros to grab user data, ignored or enabled by eBay. It's hard to say which.

Mike

[mam98031]

Speaking for myself only, This problem was not fixed for me and many others before this pop up that we had to agree to in order to access the community.