eBay Asks Users to Downgrade Security
Summary: eBay emailed KrebsOnSecurity asking him to switch from a hardware key fob to one-time codes sent by text message, a form of two-factor authentication experts describe as less secure. The move came months after NIST released draft authentication guidelines that appear to phase out SMS-based 2FA because texted codes can be intercepted, with thieves diverting a target's messages and calls to another device through social engineering at the phone company or attacks like SS7 hacks. eBay spokesman Ryan Moore said the change was about bringing authentication in-house, since the security key is made by Verisign, and that eBay hopes to offer additional multi-factor options in the future.
Why it matters: eBay is trading a decade-old hardware token for SMS codes that NIST's draft guidance is moving away from precisely because they can be diverted to another device - a downgrade a security leader may face from vendors who frame convenience as progress.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026