User:Curmudgeopn/eBay feedback correlation

Company	EBay
Start Date	2014-07-16
End Date
Status
Product Line
Product
Article Type	Service
Type	Privacy
Short Description	eBay's public feedback system allowed visitors to reconstruct the complete purchase histories of buyers, including purchases of sensitive items, without an account

eBay's reputation system, known as feedback, exposed the purchase histories of its buyers to any visitor of the site, without the buyer having taken any action to publish them. The exposure was documented in July 2014 by researchers Tehila Minkus and Keith W. Ross of New York University, who demonstrated that the complete purchase history of a known user could be reconstructed from publicly displayed information, and used the technique to identify buyers of firearm-related items and sensitive medical tests.

Background

Feedback is eBay's reputation system. Buyers and sellers can voluntarily rate each other after each transaction, and the accumulated ratings form a public profile attach to each account. The system was designed to substitute for the cues of trust that exist in face-to-face commerce, since buyers and sellers on the marketplace typically have no prior relationship with one another.

Feedback profiles are public by default and can be viewed by anyone, including visitors who do not hold an eBay account. A buyer's profile does not directly list the items the buyer has purchased, nor do the seller pages specify exactly what was sold to whom. Members can set their feedback profile to private, which hides individual feedback records from public view; however, accounts with private profiles are not permitted to sell, making this in practice an option for buyers only. At the time of the research, sellers could also create listings with private feedback, which hid item details on both the buyer's and seller's pages; contemporary feedback omits item details entirely, though inference remains possible when a seller deals exclusively in one category of goods.

Research findings

In a paper presented at the Privacy Enhancing Technologies Symposium in Amsterdam in July 2014, researchers Tehila Minkus and Keith W. Ross of NYU described how a buyer's complete purchase history could be reconstructed by combining information that eBay itself displays publicly on feedback pages. No eBay account was required to perform the reconstruction, and the buyer whose history was exposed had taken no action to publish it; the exposure arose from feedback left by sellers.

As a demonstration, the researchers identified users who had bought gun-related items and sensitive medical tests, including pregnancy and HIV tests. Where the real-world identity behind an eBay username was not already known, the researchers showed that usernames could be linked to people through profiles on social networking sites. Minkus stated that the loophole could provide leads for law enforcement or private investigators, and give private information to background-check providers or data aggregators seeking to include gun ownership in their records.

The researchers surveyed eBay users and found that respondents expected their purchases on the site to remain private, in contrast to the exposure the paper demonstrated. The findings were covered in the financial press at the time of publication.

Remedies and their limits

The privacy remedy offered within eBay's own settings is to make one's feedback profile private. This carries two significant limitations. First, accounts with private feedback profiles are not permitted to sell on the platform, meaning the remedy is unavailable to users who both buy and sell. Second, sellers on eBay's community forums have reported treating private feedback as a warning sign, with some stating that they block buyers whose profiles are private.

In the paper, the researchers recommended that eBay generate randomised identifiers for buyers appearing on seller feedback pages rather than persistent ones, and that the timestamp accompanying feedback be generalised rather than displayed precisely. For users who wished to buy privately, they suggested maintaining separate buying and selling accounts.

Company response

The researchers notified eBay of their findings and offered suggestions to address the flaw before publication. No eBay response acknowledging the findings, nor any announcement of changes made in response to them, has been documented.

Later history

In December 2017, the trade publication EcommerceBytes reported that a flaw in the product feed eBay supplied to Google was exposing customers' real first and last names alongside the items they had purchased, with the information surfacing publicly in Google's search results. Reviews of sensitive items, including home pregnancy, drug, and HIV testing kits, were among those displayed with buyers' names. The publication noted that this was not the first privacy issue involving eBay purchases, referencing the 2014 NYU research.

Current feedback pages display partially masked buyer identifiers and grouped timeframes, such as "past 6 months", rather than the detailed per-transaction records described in the 2014 research.^{[citation needed]}

eBay has not stated whether any of these changes were made in response to the findings, and the extent to which purchase histories can still be reconstructed through the present system has not been documented.

See also

• EBay shares user data with advertising platforms
• De-anonymization
• Opt-out