PayPal 2FA Bypass • Hacker News Board

Re: PayPal 2FA Bypass

#61

Post by TeMPOraL » Sun, Oct 23, 2016, 10:25 AM UTC

SoreGums wrote: post #60

TeMPOraL wrote: post #58

Earlier quoted context omitted.

> If you can't - just generate a random password as the answer. "I_ty/:QWuCllV?'6ILs`O12kl;d0-`1" is an excellent name for your first dog / high school. Just don't forget to use a password manager to store these. Be wary of social engineering attacks though. - I'd also need you to provide me an answer to your security question. What was your first dog's name? - Oh, you know, it's a long string of random characters I…

at least with one of my banks customer support centres this wouldn't happen, if you stumble for a split second they shut down the call and tell you to go into a branch to verify your identity, this is pretty annoying...

Good, they should be commended for the practice! I wish I could trust that all companies would do that, though.

(Anyway, I like the idea of using answers to security questions as hard passwords.)

Re: PayPal 2FA Bypass

#62

Post by dkopi » Sun, Oct 23, 2016, 10:27 AM UTC

TeMPOraL wrote: post #58

dkopi wrote: post #56

Mistakes were made, and there are definitely lessons to be learned, but if we want to improve the state of security, we really need to change the way we react to these types of bugs. If a service has an outage and a company posts a postmortem, we all think: "wow! that was an interesting bug, lets learn from this". We shouldn't be treating security issues differently. People who make security mistakes aren't idiots. T…

> If you can't - just generate a random password as the answer. "I_ty/:QWuCllV?'6ILs`O12kl;d0-`1" is an excellent name for your first dog / high school. Just don't forget to use a password manager to store these. Be wary of social engineering attacks though. - I'd also need you to provide me an answer to your security question. What was your first dog's name? - Oh, you know, it's a long string of random characters I…

Great point. "correct horse battery staple" wouldn't be vulnerable to such an attack.

Re: PayPal 2FA Bypass

#63

Post by continuational » Sun, Oct 23, 2016, 10:32 AM UTC

yashafromrussia wrote: post #49

What kind of API design is this? Post data should be sent within the request's body over HTTPS. Not as a url query.

The URL is encrypted too, so what's the difference in terms of security?

Re: PayPal 2FA Bypass

#64

Post by xioxox » Sun, Oct 23, 2016, 10:33 AM UTC

Itsdijital wrote: post #20

xorgar831 wrote: post #3

I've seen equally as ridiculous web bugs, computing prices browser side in javascript, credit card numbers encoded in REST API endpoints, financial websites not supporting 2FA at all or mixing http requests into the sites. We're solidly in the dark ages of web security still.

When I went to setup my online account for my old bank, I entered a randomly generated 16 digit key and got an error; "Maximum password length limited to 6 characters...only alpha-numeric" I called to inform them that their account creation was broken, because obviously that was a bug. They told me that sometimes people have a hard time remembering their password, so they "need to balance between ease of use and secu…

It seems standard practice for German banks to limit online passwords to five alpha-numeric characters. Fortunately, you need a TAN number (generated by a device or from an SMS message) to actually make a transaction. I have no idea why they limit the password length like this.

Re: PayPal 2FA Bypass

#65

Post by raverbashing » Sun, Oct 23, 2016, 10:33 AM UTC

TeMPOraL wrote: post #58

dkopi wrote: post #56

Mistakes were made, and there are definitely lessons to be learned, but if we want to improve the state of security, we really need to change the way we react to these types of bugs. If a service has an outage and a company posts a postmortem, we all think: "wow! that was an interesting bug, lets learn from this". We shouldn't be treating security issues differently. People who make security mistakes aren't idiots. T…

> If you can't - just generate a random password as the answer. "I_ty/:QWuCllV?'6ILs`O12kl;d0-`1" is an excellent name for your first dog / high school. Just don't forget to use a password manager to store these. Be wary of social engineering attacks though. - I'd also need you to provide me an answer to your security question. What was your first dog's name? - Oh, you know, it's a long string of random characters I…

Yes, having something readable (and "believable") is more useful and secure than having to rely on saying a random string

Just put "Plymouth Creek High"

(Not to mention the possibility that some "security genius" will ban special characters on those answers)

Re: PayPal 2FA Bypass

#66

Post by nobodyshere » Sun, Oct 23, 2016, 10:44 AM UTC

Bypass? Haha, it has been quite a while and they still haven't even enabled it for my country. Same goes for Apple.

Re: PayPal 2FA Bypass

#67

Post by nobodyshere » Sun, Oct 23, 2016, 10:44 AM UTC

Bypass? Haha, it has been quite a while and they still haven't even enabled it for my country. Same goes for Apple.

Re: PayPal 2FA Bypass

#68

Post by nobodyshere » Sun, Oct 23, 2016, 10:45 AM UTC

bad_user wrote: post #24

Does anybody know how to activate 2FA for PayPal? In the security section I don't even have that option.

Might be unavailable for your country.

Re: PayPal 2FA Bypass

#69

Post by DavidWanjiru » Sun, Oct 23, 2016, 10:48 AM UTC

Am I the only one who found it odd that the author had internet access, but there was no phone signal? Maybe it's because I'm Kenyan, where phone penetration is much higher than internet penetration, and where internet access over GSM has the biggest share of the internet access pie chart.

Re: PayPal 2FA Bypass

#70

Post by dkopi » Sun, Oct 23, 2016, 10:51 AM UTC

DavidWanjiru wrote: post #69

Am I the only one who found it odd that the author had internet access, but there was no phone signal? Maybe it's because I'm Kenyan, where phone penetration is much higher than internet penetration, and where internet access over GSM has the biggest share of the internet access pie chart.

This often happens when I'm travelling internationally. If I plan on buying a local sim card instead of purchasing a roaming plan - I might not have access to my SMS until I get back home.