eBay Australia rolls out anonymous messaging

eBay.com.aueBay Australia has announced the roll-out of anonymised emails between eBay members. Pre-sale ASQs will no longer show the sender’s email address, but will instead be sent with a temporary eBay-based email address. Recipients will be able to replay directly through their email client to this address, and eBay will forward the messages to the correct, real-world email. The email addresses used by eBay are composed of an apparently-random string of 10-14 letters and numbers: how long these “temporary” addresses remain valid isn’t yet clear. Members where an item has already been purchased will be able to see each other’s email addresses as normal.

Currently, eBay are not verifying that the email used to reply is the “correct” one – i.e. that it matches up with the eBay account to which the message was sent. This is, they say, a “short grace period”, presumably to allow members to ensure their registered email addresses match the ones their email client uses.

So today I’ve been able to reply to trial messages with emails registered with other eBay accounts, and emails that aren’t linked with any eBay account at all, and in all cases, messages sent from the ‘wrong’ email address still arrive with eBay subject lines suggesting they’ve come from the correct eBay member.

If a phisher gets hold of one of these temporary email addresses, or randomly generates the correct sequence of letters and numers, right now eBay’s own system will make their messages look genuine. The only security at present appears to be the obscurity of the email addresses themselves: with the vast amount of processing power at phishers’ disposal, generating some correct matches surely isn’t going to be difficult. eBay would have done better to give members more information about this in advance, so that registered addresses and email clients could have been made to match, rather than leaving the system so insecure, even if temporarily.

There’s currently no published timeline for the implementation of this system on other eBay sites, though it is expected to roll everywhere in the next few months.