ebay privacy concerns.

[resopalrabotnick]

want to know something about the guy you're buying from on ebay? make your own letterhead.

from http://www.securityfocus.com/columnists/357

Think I'm being a little harsh on eBay? At the CyberCrime 2003 conference, Joseph E. Sullivan, Director of Compliance and Law Enforcement Relations for eBay, had this to say to a group of law enforcement officials:

"I know from investigating eBay fraud cases that eBay has probably the most generous policy of any internet company when it comes to sharing information. We do not require a subpoena except for very limited circumstances. We require a subpoena when we need the financial information from the site, credit card info or sometimes IP information. ... So, that really opens the door for us. That means that what our policy is that if you are law enforcement agency you can fax us on your letterhead to request information: who is that beyond the seller ID, who is beyond this user ID. We give you their name, their address, their e-mail address and we can give you their sales history without a subpoena. ... We will probably tell you too that you might want to get a subpoena because we are looking for credit card info and you ask that. ... We also do other things to facilitate your investigation by looking and doing some searches around on our own, typically to see if there are some other user ID's associated with that thing. ... We are doing a lot of work with law enforcement agencies."

I'm nearly speechless after reading Sullivan's comments. Think about what he's saying: if eBay receives a fax on offical letterhead (not that that would ever be faked, oh no) - just a simple fax, mind you, just a fax, unaccompanied by a court order - it will gladly fork over the following info about you, or any other eBay user:

Full name

User ID

Email address

Street address

State

City

ZIP code

Phone number

Country

Company

Password

Secondary phone number

Gender

Shipping information (including name, street address, city, state, ZIP)

Bidding history on an item

Items for sale

Feedback left about the user

Bidding history

Prices paid for items

Feedback rating

Chat room and bulletin board posts

Understatement of the week: that is one hell of a list! It's long, it's scary, and it's troubling. So what do we have? Software that says it's completely secure, but without a good way to verify that claim, now owned by a company that will basically give up an astonishing amount of personal information about you at the slightest peep from the authorities. This looks and smells bad. It's a questionable act to trust your personal and business phone calls, instant messages, and file transfers to Skype already, but it seems almost the height of foolhardiness to do the same now with a Skype owned by eBay.