“We found PayPal vulnerabilities and PayPal punished us for it”

Post by smsm42 » Mon, Feb 24, 2020, 7:35 PM UTC

nebulous1 wrote: post #226

smsm42 wrote: post #213

Earlier quoted context omitted.

There's a huge difference between an informational email "somebody just logged into your account, was it you?" and 2FA workflow which does not let you log in without entering proper code. The latter is a security feature, the former is at most auxiliary informational feature. > I'd definitely call this 2-factor authentication - You'd be misunderstanding what "authentication" means then. Notification and authenticatio…

To be clear, the extra check that is bypassed is not merely an informational message, the system sends you a message and you are supposed to have to enter something contained in that message in order to continue from that IP address/computer.

Post by tptacek » Mon, Feb 24, 2020, 7:36 PM UTC

SkyBelow wrote: post #254

csnover wrote: post #182

Earlier quoted context omitted.

HackerOne’s community team also seems trained to gaslight ethical reporters who try to follow responsible disclosure practices. I submitted a vulnerability to a vendor on H1 along with a typical “I plan on publicly disclosing this vulnerability on X date” note, and started getting emails directly from H1 telling me that this undermined vendors’ confidence in the platform and that doing what I was doing might make it…

>HackerOne’s community team also seems trained to gaslight ethical reporters who try to follow responsible disclosure practices. I would say to step back and even question the concept of 'responsible' disclosure. For starters, even the very name seems to be manipulative by setting the tone of the conversation in a way that, in most other settings, doesn't pass the smell test. It seems like a short term optimization w…

Post by SpicyLemonZest » Mon, Feb 24, 2020, 7:44 PM UTC

Dylan16807 wrote: post #264

SpicyLemonZest wrote: post #232

Earlier quoted context omitted.

As far as I can tell, "it's impossible to use stolen credentials" is not part of Paypal's security model or a promise that Paypal has actually made. It's important to distinguish flaws in a company's security model from additional security controls we think they ought to add.

But why does that system exist at all, if it's not supposed to do something ? It's not "impossible to use stolen credentials", it's "you have to clear this barrier to use stolen credentials". If that barrier is broken, that sounds like a flaw in the security model.

Post by efreak » Mon, Feb 24, 2020, 7:54 PM UTC

autarch wrote: post #160

nebulous1 wrote: post #32

Earlier quoted context omitted.

From reading a different article, the terminology seems to be a bone of contention here. This ’2FA' is an email message PayPal send when they detect a new login location. They do not call it 2FA and they do offer actual 2FA that cybernews have not bypassed.

Actually, PayPal recently added proper TOTP 2FA.

Post by MiroF » Mon, Feb 24, 2020, 7:59 PM UTC

tptacek wrote: post #250

mtnGoat wrote: post #219

Earlier quoted context omitted.

out of curiosity, do you work at PayPal or is the first paragraph all assumptions? One would have thought Wells Fargo had a talented team of people to catch their millions of fake accounts they made, but alas it went on for a decade. I will always assume companies have their backs turned to security, until proven otherwise, regardless of size or perceived risk.

First, I do not work at Paypal, and have never worked at Paypal. Second, if I did, it would be none of your business. Third, comments like these are forbidden by the site guidelines, which demand that you not make accusations of astroturfing simply because you disagree with a comment.