Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal 2FA Bypass

henryhoggard.co.uk

Post reply on HN
Print view View original

141–148 of 148 posts

Re: PayPal 2FA Bypass

#141

Post by dexterdog »

Sophira wrote: post #109
jstanley wrote: post #90

Earlier quoted context omitted.

How so? The point of a random-four-words password isn't that it won't be hit by existing brute force software, it's that it's easy to remember but impractical to brute force with any software - with a 60,000 word dictionary there are more than 2^63 possible passwords.

That's true, but the whole point of the strip was that you use words that evoke an easily-memorable scene in your head. That will probably mean you can confine your list to words that most people know, which reduces the search space significantly. "correct", "horse", 'battery" and "staple" are all very common words.

Is it really an easily-memorable scene or has the strip just been referenced in every HN and reddit discussion about password security? There is no way I'm remembering some random story for an account I login to once a month. The point is to have a password that is easy to see in a password manager and then type on a different device. Seeing D8hsegfw_#7Ax42 and then trying to type it into a hidden password field is painful esp. on a phone. Seeing Dynamo-Stench3Player and typing it in is very doable.

Re: PayPal 2FA Bypass

#142

Post by geocar »

closeparen wrote: post #126
bostik wrote: post #41

Earlier quoted context omitted.

The cardinal rule of security is: you never, ever, trust anything the client sends . This bypass is a perfect example. Although author doesn't mention which interception proxy he used, I'm 99% sure it was Burp. Replaying modified content is trivial.

>you never, ever, trust anything the client sends. The author likely wrote code that correctly validates "for all security questions a correct answer is given" and just forgot about the part where "for-all propositions are trivially true of the empty set." It's easy to read a for loop for what it's intended as - a loop - and not think about "what if we never enter it at all?"

If we think well, we need to have loops, we might be feeling despair right now, however array languages don't need loops! I can write:

    min test each args
and I can do the same in JavaScript, it's just uglier:

    args.map(test).reduce(function(x,y){return Math.min(x,y)})
Writing in a functional style makes this kind of programming slightly less onerous, but it still feels strange in languages that are a bad fit.

Re: PayPal 2FA Bypass

#143

Post by Karunamon »

Karunamon wrote: post #129
hoorayimhelping wrote: post #121

Earlier quoted context omitted.

> I disagree. Your "lets be super nice to everybody" strategy has come to an absurd conclusion. You and I must have read a different response, cause I saw nothing in there about "being super nice to everyone." What I saw was a reasonable request not to commit the Fundamental Attribution Error. Which is paraphrased as: when I screw up, there were extenuating circumstances. When you screw up it's cause you're a moron.…

A company comprised of otherwise reasonable people can behaving shockingly dumb. The only way to make companies learn is to impact their bottom line, and that means not-nice words need to be said.

-4 but not a single response? Folks, I wasn't aware it was in question that companies can behave in irrational ways.

Re: PayPal 2FA Bypass

#145

Post by Matt3o12_ »

jlgaddis wrote: post #79
xorgar831 wrote: post #3

I've seen equally as ridiculous web bugs, computing prices browser side in javascript, credit card numbers encoded in REST API endpoints, financial websites not supporting 2FA at all or mixing http requests into the sites. We're solidly in the dark ages of web security still.

It's been a looong time ago but I remember when some instant messenger application was found to be performing authentication client side -- i.e. "Hey server, I'm $user. I promise!" and you were in. I want to say it was Yahoo Messenger but my memory could very well be lying to me.

WhatsApp used to use your devices MAC address for authentication. A quick screenshot of the vicitim's settings page would be enough to send and receive messages in their name. Since whatsapp does not store messages after they have been delivered, the victim would never see the messages sent from his whatsapp number (except when looking at the recipients phone). You could, however, realize that your account has been hacked when you notice that some messages were not arriving (they would arrive at the attacker's client only and whatsapp will not transmit already recived message again).

The only fix was to buy a new phone and hope nobody will make a screenshot of your settings page again (or spoofe your MAC address which would not always work).

Re: PayPal 2FA Bypass

#146

Post by [deleted] »

jlgaddis wrote: post #79
xorgar831 wrote: post #3

I've seen equally as ridiculous web bugs, computing prices browser side in javascript, credit card numbers encoded in REST API endpoints, financial websites not supporting 2FA at all or mixing http requests into the sites. We're solidly in the dark ages of web security still.

It's been a looong time ago but I remember when some instant messenger application was found to be performing authentication client side -- i.e. "Hey server, I'm $user. I promise!" and you were in. I want to say it was Yahoo Messenger but my memory could very well be lying to me.

[deleted]

Re: PayPal 2FA Bypass

#147

Post by jlgaddis »

tP5n wrote: post #140
jlgaddis wrote: post #81

Earlier quoted context omitted.

They have both. I have a "Symantec VIP" co-branded Yubikey that I've used with PayPal for years along with an authenticator app on my phone as a fallback.

I have both a yubikey and an auth app but can't seem to find a way to use them with paypal. Do you have some kind of special account or is that a feature bound to a certain market?

I don't think there's anything special about my account. It was a "personal" account when I created it, probably almost 15 years or so ago, then upgraded to a business account maybe 8-10 years ago.

I don't have my password handy right now so I can't login to check, but look for settings related to their "security key". I don't know if they still do or not but at one point they offered a hardware OTP generator (similar to the old RSA SecurID key fob) for a one-time $5 fee. Alternatively, you could use an existing one you already had just by entering its "ID number"; I used the IDs of my Symantec VIP Yubikey and also the app.

Sorry I can't be more specific or give you better guidance. I know that the option does exist, though; perhaps just explore the available options and maybe you'll stumble across it. Good luck!

Re: PayPal 2FA Bypass

#148

Post by Tammy5 »

I don't know about hacking but when my ex was cheating on me, a friend of mine referred me to Mr Robert I thought it wasn't real but he later proved me wrong by helping me to spy on my ex-husband and got me all the necessary evidence I needed. He helped me to hack and spy on his emails, mobile , all his social media and his bank accounts, Robert did all this remotely without touching his devices. You can contact him with mastershield55@gmail.com if you are in the same shoe as I was..
Post reply on HN