Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

forbes.com

Post reply on HN
Print view View original

31–40 of 84 posts

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#31

Post by judge2020 »

beamatronic wrote: post #29
rocqua wrote: post #25

Earlier quoted context omitted.

As for paypal's security policy, note that they have a maximum password length of 24 characters, and routinely send people e-mails with a big 'log-in' link. These are both bad practice. The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords. The sending of log-in links makes people much easier to phish, since people are used to clicking on a link in e-mail and then en…

I’ve been telling friends and family, for at least 10 years, maybe more, the only safe way to go to PayPal, is to type the address into the browser yourself, starting with HTTPS.

Paypal is preloaded, so you're not required to start with HTTPS. https://hstspreload.org/?domain=paypal.com

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#32

Post by inetknght »

carapace wrote: post #24
inetknght wrote: post #21

Earlier quoted context omitted.

I agree that reaching out to whomever's being criticised is a courtesy and, sometimes, even legally required. But I don't think it's right to not critique. When a company blatantly uses doublespeak, that should absolutely be critiqued.

You're talking about blurring the difference between journalism and opinion.

Journalism is opinion.

It's the opinion of the journalist: is this information worth writing about?

It's the opinion of the editor: is this part worth changing?

It's the opinion of the publisher: is this piece worth publishing?

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#33

Post by Retric »

judge2020 wrote: post #31
beamatronic wrote: post #29

Earlier quoted context omitted.

I’ve been telling friends and family, for at least 10 years, maybe more, the only safe way to go to PayPal, is to type the address into the browser yourself, starting with HTTPS.

Paypal is preloaded, so you're not required to start with HTTPS. https://hstspreload.org/?domain=paypal.com

While that includes Chrome, Safari, Firefox, IE, and Edge that’s not every browser and it’s a really bad habit to get into. Especially as the preload lists are yet another attack surface.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#34

Post by humaniania »

rocqua wrote: post #25
brobdingnagians wrote: post #8

> “We reported this in February 2019 to PayPal via HackerOne,” they say. “After an initial rejection and several discussions, PayPal paid a bug bounty of $4,400.” The pair have not heard from PayPal, they say, since April 2019. But this week “tried and could still use the virtual credit card for online payments.” That means, they told me, “the bug has not been fixed.” > But in terms of the Fenske and Mayer disclosure…

As for paypal's security policy, note that they have a maximum password length of 24 characters, and routinely send people e-mails with a big 'log-in' link. These are both bad practice. The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords. The sending of log-in links makes people much easier to phish, since people are used to clicking on a link in e-mail and then en…

In what way does a password length limit suggest plain-text storage?

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#35

Post by inetknght »

humaniania wrote: post #34
rocqua wrote: post #25

Earlier quoted context omitted.

As for paypal's security policy, note that they have a maximum password length of 24 characters, and routinely send people e-mails with a big 'log-in' link. These are both bad practice. The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords. The sending of log-in links makes people much easier to phish, since people are used to clicking on a link in e-mail and then en…

In what way does a password length limit suggest plain-text storage?

In the same way that the best one-way hash algorithms can accept arbitrarily large inputs and produce a constant-sized digest.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#36

Post by aaomidi »

humaniania wrote: post #34
rocqua wrote: post #25

Earlier quoted context omitted.

As for paypal's security policy, note that they have a maximum password length of 24 characters, and routinely send people e-mails with a big 'log-in' link. These are both bad practice. The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords. The sending of log-in links makes people much easier to phish, since people are used to clicking on a link in e-mail and then en…

In what way does a password length limit suggest plain-text storage?

Because there's usually not a reason to limit it to something that low.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#37

Post by forgotmyhnacc »

PayPal is really bad with security. A friend of mine reported a CSRF attack that an attacker could withdraw all the money out of a vemmo account (was acquired by PayPal) if the victim visited the attackers website. It took them several weeks to fix, and friend didn't receive any bug bounty.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#38

Post by SilasX »

inetknght wrote: post #35
humaniania wrote: post #34

Earlier quoted context omitted.

In what way does a password length limit suggest plain-text storage?

In the same way that the best one-way hash algorithms can accept arbitrarily large inputs and produce a constant-sized digest.

True but I thought you’d want to have some size limit regardless, if for no other reason than choking up the connection with a huge one.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#39

Post by inetknght »

SilasX wrote: post #38
inetknght wrote: post #35

Earlier quoted context omitted.

In the same way that the best one-way hash algorithms can accept arbitrarily large inputs and produce a constant-sized digest.

True but I thought you’d want to have some size limit regardless, if for no other reason than choking up the connection with a huge one.

Sure, but "some size limit" can be as big as 500 or 1000 bytes. "Choking up the connection" won't be for very long at all. Even on a 2400 baud modem, you're talking only a few seconds to transmit a kilobyte of password. On modern cell networks or especially broadband connections, you pretty much won't choke the connection at all with a 1000-character password.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#40

Post by dessant »

Regarding security at PayPal, I've got a PayPal donation not long ago to my email address in the form of {@example.com. This email was not attached to my PayPal account, so I tried to add it to claim the payment, but client-side validation would reject it because of the funky { alias.

I've disabled the client-side check using the browser's developer tools and my email was accepted by the server upon submission, so I could finally claim my 5 euros :P.

All of this was preceded by me contacting support about adding my email address. They couldn't help me and told me to contact the sender, which would have been impossible, since it was a donation, and the only thing I had was a PayPal notification about a pending payment to that email address.

Of course the server should have accepted the email anyway, because it was valid, the issue just highlights a faulty development process at PayPal that allows server-side validation to be more permissive than client-side validation.

Post reply on HN