Live data from Hacker News

PayPal.Me

paypal.me

61–70 of 83 posts

Re: PayPal.Me

#61
post #58
post #46

Earlier quoted context omitted.

Normally I'd cry foul but 20 alphanumeric characters (roughly 64^20, or 1e36 combinations) is more than sufficient.

The issue is not the 20 characters, but the underlying reason for it. There's no technical reason they would need it unless they were storing it insecurely. Granted it's possible they're limiting it to 20 for a nontechnical reason, but I have some 40-character passwords in a password manager. Long passwords are not only reasonable, but this is a giant alarm bell if they even imply they might be storing them insecurel…

What are you talking about? Taken to its logical conclusion you would have sites support passwords up to a million characters or else it is a sign that they are insecure. Having some limit is perfectly sane.

I also find it a bit "armchair quarterbacky" to be calling out PayPal on security practices. They've been around the block a few times, and though I certainly don't love them, they aren't making rookie mistakes like not-hashing passwords or the like.

You are just spreading FUD for no discernable reason. 20 characters while not the epitome of greatness, isn't a sign of the end times.

Re: PayPal.Me

#62
post #42

Earlier quoted context omitted.

Good on you for listing your gripes with them. Too often I see people complaining about PayPal in general but I've managed to miss actual reasons before now.

Normally it's because their account is suddenly closed, without any reason given, and no correspondence is entered into. Also they're happy to support hate groups, but blacklisted wikileaks.

Yup, this.

Things like getting your funds frozen by Paypal when you're a legitimate business and handed over a fuckton of documentation and proof of legitimate orders to prove it. Which then destroys your cashflow, which means the typical 'pay in 30 days' that is extremely common in business 2 business transactions gets messed up because Paypal froze your money. You can't pay your supplier, your order doesn't come in, meanwhile you've been shipping your product to your customers despite the fact all the revenue from these orders is getting insta-frozen, and now you're starting to actually get legitimate issues of customers not getting their product because you can't pay your supplier for new product and can't ship to your customers, which makes Paypal clamp down ever harder to 'resolve these issues before we unfreeze the account', which of course is an issue they created and an issue that can't be solved because they're kidnapping your money.

So now you need to find external financing (we're not talking about Amazon here, but commonly 1 or 2 people selling products from their home, the internet's mom & pop stores) to fund the supplier's order, then ship, cancel customer's orders so you can prove to Paypal you can ship to every placed order (who leave negative feedback, understandably), and see customers cancel orders themselves (more negative feedback), and then unfreeze the money, pay back your financier, place another order with a supplier and hope to regain lost customers.

And that's the simple story, the true story is extremely frustrating and much more complex with cashflow being frozen for 6 months while you're trying to keep your business alive. Not everyone wants to recount it every time they want to criticise Paypal.

Now if there were legitimate concerns, cool. But as nailer said, you can find tons of stories of people who ran into these issues for no reason and without a reason given, without due dilligence and without the type of 'reasonably swift' (i.e. days or at most weeks, not 6 months) recourse & resolution of frozen cashflow you need to run a business without going bankrupt.

A tip, if anyone ever does a product launch with Paypal, call them beforehand. Launching a product and selling in a spike the first days/weeks (i.e. extremely typical for virtually every launch ever) is a red flag for Paypal.

Which means for anyone doing a pre-order, well you're fucked if you get unlucky. Plenty of stories of people doing a legitimate pre-order campaign with customers willing to wait say 2 months on the product. Halfway through your pre-order campaign you think 'alright I'm at $60k right now, I'll probably make it to $100k. I'll start to order from my supplier about $80k's worth for now to be on the safe side. You pay $25k of your own money upfront'. Campaign is over, you reached $100k, your supplier is busy, you call him up to adjust to $100k, and tell him you'll pay the remaining $75k right away. Turns out all your money is frozen. Supplier won't ship, Paypal won't unfreeze the money for months. You inform your customers, they're sad. 3% of them files a complaint with Paypal for a refund, which now means that 100% of Paypal's feedback from customers about you is negative, seeing as you haven't been able to ship to anyone yet.

You might think well good, Paypal protects its users from fraud (despite a total ignorance as to how normal pre-orders work, thereby screwing over their users), but this stuff happens to people who've done business with Paypal for 5-10 years. It happens to companies with solid internet reputations that takes 5 seconds to review on the internet or with a phonecall whether they're legitimate.

And that's the 'normal' stuff, i.e. selling a videogame, a bracelet, a usb charger etc... But if we get to the really controversial stuff, like omg sex on video, I know I should use the p-word but I'll just say it, porn... did that get censored? Well then you're out of luck with Paypal entirely, which is insane.

Re: PayPal.Me

#63
post #42

Earlier quoted context omitted.

Normally it's because their account is suddenly closed, without any reason given, and no correspondence is entered into. Also they're happy to support hate groups, but blacklisted wikileaks.

Yup, this. Things like getting your funds frozen by Paypal when you're a legitimate business and handed over a fuckton of documentation and proof of legitimate orders to prove it. Which then destroys your cashflow, which means the typical 'pay in 30 days' that is extremely common in business 2 business transactions gets messed up because Paypal froze your money. You can't pay your supplier, your order doesn't come in…

Also worth noting that their terms are pretty seller- and user-hostile. You described some of the seller-hostile instances above (here's another [0] from a few years back).

But they've also rolled out some pretty user-hostile stuff in the past year. At one point, they were set to roll out a new privacy agreement that included permission for them to robo-call you at phone numbers that you hadn't provided to them (with no mention of how those numbers were obtained).[1]

[0] http://techcrunch.com/2012/01/04/paypal-shreds-ostensibly-ra... [1] http://techcrunch.com/2015/06/05/paypal-claims-it-will-allow...

Re: PayPal.Me

#64
post #58
post #46

Earlier quoted context omitted.

Normally I'd cry foul but 20 alphanumeric characters (roughly 64^20, or 1e36 combinations) is more than sufficient.

The issue is not the 20 characters, but the underlying reason for it. There's no technical reason they would need it unless they were storing it insecurely. Granted it's possible they're limiting it to 20 for a nontechnical reason, but I have some 40-character passwords in a password manager. Long passwords are not only reasonable, but this is a giant alarm bell if they even imply they might be storing them insecurel…

Theoretically speaking, shouldn't a solid salt + hash algorithm always result in a fixed-length string no matter the input password?

Re: PayPal.Me

#65
post #35

Earlier quoted context omitted.

From the FAQ: > Is PayPal.Me available in my country? > We’re adding new regions as fast as we can. Check back often to see if it’s available in your country. That's just seriously bad. "Check back often" -- they won't even provide a list of currently-available countries, let alone a simple "leave your email for updates" box.

That's stupid, how can this kind of thing not be "available" in a country? It's totally isolated from the service

It's a financial service, they're covering their ass from unforeseen tax issues. If some people in Russia decide to use it, and paypal hasn't checked to be sure that this is all completely legit under Russian tax law, there will be huge problems for them.

Re: PayPal.Me

#66
post #41

Just to test, send me money: https://paypal.me/martino Edit: Thank you for your €0,10 kind stranger!

Looks like they forgot to test for negative values. I put in -200.00 and it seems to have withdrawn the money from your account without problems ;)

Looks like they solved that, it now disallowed inputting a dash. I wonder if that's just client-side though.

Re: PayPal.Me

#67
post #66

Earlier quoted context omitted.

Looks like they forgot to test for negative values. I put in -200.00 and it seems to have withdrawn the money from your account without problems ;)

Looks like they solved that, it now disallowed inputting a dash. I wonder if that's just client-side though.

kedean... it was a joke...

Re: PayPal.Me

#68
post #58

Earlier quoted context omitted.

The issue is not the 20 characters, but the underlying reason for it. There's no technical reason they would need it unless they were storing it insecurely. Granted it's possible they're limiting it to 20 for a nontechnical reason, but I have some 40-character passwords in a password manager. Long passwords are not only reasonable, but this is a giant alarm bell if they even imply they might be storing them insecurel…

Theoretically speaking, shouldn't a solid salt + hash algorithm always result in a fixed-length string no matter the input password?

It should, but I think parent is talking about the input string having a limitation, which limits the amount of combinations you could have in your password. My original comment still stands, though, as 20 characters is a large amount of combinations (although I just did some quick calculations to find it's still less than 128 bits... 114 or so).

Re: PayPal.Me

#69
post #24
post #13

Earlier quoted context omitted.

Why?

Terrible site, slow load times, history of poor security. Disenfranchised workers and a bureaucratic nightmare. Along with a history of freezing assets of popular projects for no reason. (wikileaks donations for instance). http://www.paypalsucks.com/ https://www.aboutpaypal.org/

I agree that the site isn't great, but I'd still call that above average, especially nowadays. Load times are fine for me (using O12). Poor security? (other than not having two-step authentication)

The rest of the things just comes with it being a huge corporation that pretends it's not a bank I guess. Funny thing if you search for PP here

https://hn.algolia.com/?query=paypal&sort=byPopularity&prefi...

Didn't they have some "controversial" privacy policy change recently?

Anyway, I still see it as the lesser evil of the widespread totally-not-a-bank payment processors.

Re: PayPal.Me

#70
post #27

Earlier quoted context omitted.

> If I browse too many pages, the query string gets so long my requests fail Jesus. Is that really true?

It happens with cookies as well. It's especially bad on the developer sandbox. If you ever have trouble using the sandbox it's either because your cookie is too big or it's broken for the 11th time this week.

Paypal sandbox was always really problematic when I used to have to use it. Full of odd cases where you'd suddenly find yourself outside of the sandbox, or undocumented issues such as needing to run your IPN listener on port 80.
Post reply on HN