eBay is certainly subject to hijack accounts, and I know of plenty of people who have had their accounts hijacked. If the password isn't secure, you might as well have the displayed name and login name different, and forget the password entirely. You've the same level of security.

You must also remember that eBay is not a small operation. While I personally dislike ANY site using insecure logins (and shudder every time I log into K5 or /. for that very reason), most small sites aren't worth the effort for someone to crack, unless it's purely as an ego thing.

eBay, or any of the other major online stores, deal in hundreds of millions of dollars. That's a lot of loose change. Since sniffing doesn't involve a direct attack on the store, intrusion detectors won't spot it or stop it. There's no direct link between the sniffer and the intrusion.

The reason I prefer secure logins on all sites is that people typically have a small pool of passwords which they use for a large number of sites. Because of this, password sniffers on a set of insecure sites is going to be as dangerous to users as a single password sniffer on eBay's ISP.

The sniffer operator simply needs to collect the sniffer results, organize them by IP address, then sort then by username (which will also be typically similar or the same on many systems). They can then build a mini cracker dictionary for specific users, which they can use to brute-force entry into a system like eBay.

Sure, this is cruder, in that a really good NIDS package will detect the repeated login attempts (even though it'll be a plausably small pool), and lock out the attacker. This assumes eBay employs NIDS software, though. If they don't, then this'll just look like a careless user. Enough accounts can be broken this way to reap the attacker enough money to make it worth their while.

Remember, they don't need many successes. If you assume that a typical credit card'll have about a thousand or so left on it, then just 50 cracks would reap the attacker the same amount as a typical Software Engineer II, full-time, would earn in a year. Tax free. And it's doubtful it would take a year to get 50 accounts. Allowing time to set the software up, it'd probably still take less than a week to get that.

With the prospect of earning as much in a week as a low-mid range tech earns in a year, with virtually zero possibility of being tracked, you will get people who are tempted. That is a lot of very easy money. What's more, even if you are caught, the infamy would guarantee enough media interest to keep you in luxury for the rest of your life... once the sentance is complete, that is. But even a sentance isn't going to deter people if there's guaranteed fame and fortune at the end.

(Yeah, I know, there are laws about profiting from the results of crimes. Ask a certain Moose about that one. People will profit from whatever other people will buy, and sod the ethics or legality.)

People generally assume sniffers aren't common, largely because it's the brute-force attacks and mass thefts that get the most media attention. Bad assumption. It's like assuming that nobody has ever lifted a fingerprint for the purpose of fooling someone, because it's the car chases that get prime-time TV.

It's apples and oranges. Two very different styles, operating on two very different principles. The first work on the basis that identity theft is generally hard to detect and can be impossible to trace. But it does require a degree of lateral thinking and patience. The latter - brute forcing of any kind - depends on running faster than the other guy. There's no finesse, the risks are a lot higher, but in the short-term, so is the haul.

As someone who has worked in computer security for a long time, I consider the patient, thinking intruder to be the greater threat. Most NIDS will detect a brute-force smash-and-grab type attack, and block all packets from the attacker's subnet. I don't need to concern myself with these attacks, as the software these days is usually good enough to stop them.

Those with patience and intelligence are much more terrifying, as there's no automatic system that can protect against them, if they're good enough. No matter how good your security, they can always bypass it by being that much better.