I'm running up against a problem with AW and can't seem to solve it.

Here's the situation. I had username (call it "One") on ebay. I decided to ditch the username and start a new one (call it "Two") .
More than thirty days ago, I changed my user name "One" to "One_Old", so the original username of "One" is not even active on ebay; I can't log in under it, and a search says the ID is not active.

I start up AW, go to "auction profiles" under the File menu and edit the profile details of "One" to reflect the new ID of "Two". For ease of use, I used the same password on both usernames, so I did not edit this field.

I take an auction that has been previously used as "One" and make sure the "auction profile" now says it belongs to "Two". I post an auction. It shows up on eBay under the username "One_Old". I have never provided the renamed user ID to AW. I can't even log on under the name "One", but somehow AW is able to do this.

I log into ebay under the username "One_Old" and change the account password, hoping this will cause AW to fail at the log-in stage. I queue another auction under profile "Two" and it again posts to "One_Old". To be clear: AW is able to log in under a username that doesn't exist using a password that has been changed.

I finally have enough of this nonsense, delete the profile completely and exit the program. I restart and create a new profile using all the details of "Two". As soon as I choose 'eBay" as the "Auction Site User ID", the password field greys out. I continue anyway, again thinking I'll at least get a failure and go from there. I create a new auction, assign it to profile "Two" and post it. I'll give you three guesses where the uploaded auction shows up. (Hint: it's "One_Old").

I go back and create ANOTHER profile without deleting "Two". I give the profile a different name but use all the same details. The password field greys out upon choosing 'eBay" again. I create another auction and assign it this newest test profile. I post it and check my auctions. Stop me if you've heard this one before.

I'm using Win XP & AW version 2.3 (Build 254), Update level 1340. I've been using AW for years, but this is a fresh install on a new machine with a restored database from a previous machine.

What do I have to do to get this program to stop posting auctions to an account it shouldn't have access to and let me create a new profile that works?

Thanks in advance.

Hi,

Glad to have you on the discussion board. I am sorry you are having problems.

Let me see if I can help you a bit.

First, AW2000 no longer requires a password in order to list auctions. It simply has to be "Authorized" on eBay. And that happened the very first time you listed an Auction lot on eBay using the API version. YOu can check that by logging into "My eBay" Click on "Preferences and then go to the bottom of the page and expand "Third Party Authorizations"
"Standing Wave Software" should be included in the list of authorizations.

So the password is not an issue.

Now for the Auction profile issue.
You changed your User id "One" at eBay to "Old_One" at eBay. And then you created a new User id called "Two" at eBay? Then in AW2000 you used the same details for both user id's: "Old_One" as well as "Two"??

Meaning you simply edited the name of "One" to "Two" but kept the same settings. Email, FTP account, Listing template etc.



Judy/blue

Visit my eBay store!
http://stores.ebay.com/bluepennylady?refid=store
Visit our website too!
http://www:pennyworthsales.com

Hi,

After re-reading your scenario, it sounds like you have the "Auction site User id" field set to the "One_Old". The profile name can be anything you want. It is the Auction Site User Id field which determines where the auction lot is listed.

So since you have simply changed the User id name to "One_Old" and retained the exact same settings, Aw2000 can post the auctions to the "One_Old" User id. It is the "One" User id which you disabled at eBay. And no Auctions are being listed to that User id/Profile.

Check the "Auction site User id" Field for the profile "Two" and see what is in that field. If you have a new User id "Two". Then the "Auction site User Id" field needs to be Two. Not just the Profile Name. The profile name can be completely different than the Auction site user id field. It is the Auction Site user id field which determines where the auction lot is listed. The Profile name is just the name you select to make it easy to spot in the list.

Does that make sense??




Judy/blue

Visit my eBay store!
http://stores.ebay.com/bluepennylady?refid=store
Visit our website too!
http://www:pennyworthsales.com

Hi Judy, thanks for the quick reply. Here are some clarifications.

Although my post was unclear, I have been changing the User ID field in addition to the profile name. This is why I was so confused.

I expected the API to submit the new username to eBay for authorization and expected it to fail because I hadn't given it an authorization.

I expected that since I changed both my username AND password, AW wouldn't be able to log into my account. After all, I gave permission for it to access "One", which no longer exists. Somehow, AW is able to get around this.

So I did a bit of testing, and I am horrified to report that AW has a MASSIVE security hole.

To give a little more background detail, I made the name change on my original account ("One" to "One_Old") on September 5. and opened the new account ("Two") on the same day. I had not logged in or used "One_Old" since Sept 5. I started using "Two" on October 5, after 30 days had passed (so I didn't have a new icon next to my name). I posted a few auctions manually, but only yesterday, Oct 22, did I attempt to use AW to post an auction.

This is important, because at no time did I ever enter the username "One_Old" into AW. I did not accidentally type it in somewhere. On Oct 22, in the course of trying to fix this problem, I changed the password on the "One_Old" account through eBay. As it stands right now, if I gave you the username and password that I supplied to AW and asked you to log into my account, your login would fail. It does not fail for AW, and that's the security hole.

AW bypasses the eBay login ENTIRELY. If you change your eBay password for security reasons, your account can still be accessed by anyone who can restore one of your database backup files.

I just performed another test. I am typing this on a laptop with an installation of AW that I haven't used since August. I just started it up and posted an auction" The profile and auction ID say "One", but the auction posted to One_Old". AW is blissfully unaware that the username and password on the account have been changed. It appears the Auction User ID field has no effect, and that the profile itself has authorization. What you type is irrelevant.

Dave

There is no security hole in Auction Wizard 2000's authorization system for eBay. It works exactly as eBay describes it in their API documentation. Once you authorize an eBay compatible application to interact with eBay on your behalf that authorization will remain valid until you cancel it, eBay revokes it, or it expires. Changing your User ID and/or Password on eBay will not affect any software you have authorized to interact with eBay for that account.

-- The Auction Wizard Team

I apologize for hitting the panic button about the security hole. Thanks for the explanation.

It turns out the "Auction Site User ID" field in the Auction Profiles screen has no effect on what eBay account is actually used.

I ended up solving my problem by restoring from an older backup and instead of editing the profile, I just created a new one. Once the new one was up and running, I just deleted the old one. Everything seems to work fine now.

Thanks for all the info!

Dave

Dave,

That is excellent news. I was going to suggest you create a new one.

Keep us posted,



Judy/blue

Visit my eBay store!
http://stores.ebay.com/bluepennylady?refid=store
Visit our website too!
http://www:pennyworthsales.com