31–40 of 148 posts
Earlier quoted context omitted.
17 days is fast, relatively speaking. Security questions are hardly really that great of 2FA protection anyways.
Good to know. And ya, a security question to bypass a phone 2SV is a joke. Almost entirely defeats the purpose.
I've come across a few authentication bypass vulns that seem similar.
The simplicity of this exploit demonstrates something profound. The most dangerous things in life are not hidden deep in the weeds. Rather, they stare us in the face in the most obvious spots. It isn't the unknown that presents the biggest threat. It is the known that we never gave a second look.
heart disease vs. terrorism. it seems to be an unfortunate emergent behavior of groups of humans.
I'm happy to see that the article doesn't have any BS that I have to ignore. It's a simple page that only tells the 'required' story. As a reader, I want more people to cut the crap about 'blah blah blah' and get to the subject.
That being said, I've often thought Hacker News should have a nice crowd sourced tldr summary at the top of all the comments.
Does anybody know how to activate 2FA for PayPal? In the security section I don't even have that option.
I've seen equally as ridiculous web bugs, computing prices browser side in javascript, credit card numbers encoded in REST API endpoints, financial websites not supporting 2FA at all or mixing http requests into the sites. We're solidly in the dark ages of web security still.
When I went to setup my online account for my old bank, I entered a randomly generated 16 digit key and got an error; "Maximum password length limited to 6 characters...only alpha-numeric" I called to inform them that their account creation was broken, because obviously that was a bug. They told me that sometimes people have a hard time remembering their password, so they "need to balance between ease of use and secu…
Ouch! Also, PayPal really needs to stop using SMS for 2fa. I expect more from a payment processor that is linked to my bank account.
I'm happy to see that the article doesn't have any BS that I have to ignore. It's a simple page that only tells the 'required' story. As a reader, I want more people to cut the crap about 'blah blah blah' and get to the subject.
For what it's worth, I thought the "I was in a hotel..." story was superfluous and probably not true.
Does PayPal outsource their web development to an anonymous script kiddie on 4chan?