“We found PayPal vulnerabilities and PayPal punished us for it”

Post by cptskippy » Mon, Feb 24, 2020, 2:56 PM UTC

endorphone wrote: post #62

cptskippy wrote: post #56

Earlier quoted context omitted.

> They were created for sincere reasons, and with best intentions. No? They were created by the industry to avoid actually being regulated and are a way to shift liability. That doesn't mean they aren't also beneficial, but that's more a side effect than the intention.

Yes? If we want to be cynical, of course there was a self-serving reason they created the standards -- because fraud, especially "internet" fraud, was on a massive upswing and it threatened this enormous new market of credit card spending. There is no question it's in their self-interest to improve the general condition of transactions.

Post by teslademigod1 » Mon, Feb 24, 2020, 2:58 PM UTC

nebulous1 wrote: post #70

teslademigod1 wrote: post #46

Earlier quoted context omitted.

reading both, looks to me like this is pretty much 2fa. isn't 2fa defined as a "second factor" beyond user:pass? isn't that what this bypass is about?

There is genuine disagreement about whether email qualifies as a second factor. As it is often just protected by a username and password the argument is that it's the same "something you know" factor as a password, or just an obfuscation of the same factor. I will say, that if cybernews have done what they say that they've done, and PayPal are claiming that it's not a concern, then PayPal are clearly in the wrong, an…

Post by div » Mon, Feb 24, 2020, 3:00 PM UTC

giancarlostoro wrote: post #61

Crosseye_Jack wrote: post #55

Earlier quoted context omitted.

GDPR max fine is (iirc) 4% of revenue. So if you are a small fish you will be paying less then the big fish. Also the fines are for wilful failure to comply, if you accidentally broke GDPR then your first offence is going to be more a slap on the wrist then an instant 4%.

Except it says "whichever" is higher, so if they decided to fine you 10 million or 2% of revenue, and your 2% is much lower than 10 million, guess which one you're paying... > Up to €10 million, or 2% of the worldwide annual revenue of the prior financial year, whichever is higher See: https://www.gdpreu.org/compliance/fines-and-penalties/

Post by hedora » Mon, Feb 24, 2020, 3:05 PM UTC

ailideex wrote: post #88

rasengan wrote: post #76

Earlier quoted context omitted.

> Not anywhere on the page you linked. Read the page carefully - it specifically states they are an auditor approved org. Quote from page: “Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report.[1].” Secondly, PayPal works with HackerOne officially [2] and within the CVSS standards as they c…

What is their certificate number?

Post by rasengan » Mon, Feb 24, 2020, 3:06 PM UTC

ailideex wrote: post #104

rasengan wrote: post #95

Earlier quoted context omitted.

> All of HackerOne's information that you cite is about them being PCI-DSS-compliant or having undergone a SOC2 Type 2 audit. Nothing you link to identifies them as a PCI-DSS auditing company. They are not. Please read the page again. They specifically say you can achieve compliance certification with HackerOne.

We read the page, and even if your claim holds, it is still irrelevant because whatever you quoted is not the same as being a PCI-DSS approved scanning vendor. And even if it was, HackerOne did not perform any scans. HackerOne offering PCI-DSS approved auditor approved challenges gets you nowhere towards the claims you made in your first comment. To review: 1. HackerOne would have to be a PCI DSS Approved Scanning Ve…