Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

forbes.com

Post reply on HN
Print view View original

51–60 of 84 posts

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#51

Post by johndough »

inetknght wrote: post #39
SilasX wrote: post #38

Earlier quoted context omitted.

True but I thought you’d want to have some size limit regardless, if for no other reason than choking up the connection with a huge one.

Sure, but "some size limit" can be as big as 500 or 1000 bytes. "Choking up the connection" won't be for very long at all. Even on a 2400 baud modem, you're talking only a few seconds to transmit a kilobyte of password. On modern cell networks or especially broadband connections, you pretty much won't choke the connection at all with a 1000-character password.

To add to that, the login page (which contains nothing but two fields for email and password) weighs in at 1.5 MB, so bandwidth clearly is not an issue for PayPal.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#52

Post by Spooky23 »

rocqua wrote: post #25
brobdingnagians wrote: post #8

> “We reported this in February 2019 to PayPal via HackerOne,” they say. “After an initial rejection and several discussions, PayPal paid a bug bounty of $4,400.” The pair have not heard from PayPal, they say, since April 2019. But this week “tried and could still use the virtual credit card for online payments.” That means, they told me, “the bug has not been fixed.” > But in terms of the Fenske and Mayer disclosure…

As for paypal's security policy, note that they have a maximum password length of 24 characters, and routinely send people e-mails with a big 'log-in' link. These are both bad practice. The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords. The sending of log-in links makes people much easier to phish, since people are used to clicking on a link in e-mail and then en…

> The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords

No, it limits the effectiveness of passphrases.

It does not suggest or not suggest plaintext storage.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#53

Post by whatsmyusername »

lxgr wrote: post #28
AdmiralAsshat wrote: post #26

Just as a PSA, it wasn't until I looked at one of these articles in the last few days about PayPal that a screenshot showing how to enable 2FA demonstrated that TOTP-based authenticator apps are now allowed. For the longest time, PayPal was only allowing 2FA SMS after they chucked their old physical security keys. Anyone who's been stuck on SMS may wish to login and switch over to TOTP.

I tried when they introduced that and gave up on it again: There is no way to mark a device as trusted, and I'm certainly not opening my 2FA app for every single login/payment. Also, this is 2020, where is WebAuthN? That would at least make the constant 2FA a bit more bearable.

> I'm certainly not opening my 2FA app for every single login/payment.

I'm fine with this. I'd rather take the 3 seconds it takes to open Authy than the several days it takes to clean up the mess.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#54

Post by Crosseye_Jack »

ljoshua wrote: post #13

So NFC reading of embedded card details is always on, regardless of whether you are in "payments" mode or have the app open? Is that a PayPal flaw, or is it an Android/NFC/Google Payments flaw?

> So NFC reading of embedded card details is always on

Apple have a similar option BUT they restrict its use to certain payment terminals (for example it is only supposed by TfL in the UK) and can be disabled if you want. Dunno if the data it exposes (in a physical read attack) could be used for other payments.

> With Express Transit mode enabled, you don't have to validate with Face ID, Touch ID or your passcode when you pay for rides with Apple Pay on your iPhone and Apple Watch. And you don't need to wake or unlock your device, or open an app.

https://support.apple.com/en-gb/HT209495

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#55

Post by rasengan »

pvg wrote: post #49
rasengan wrote: post #45

Earlier quoted context omitted.

> This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation. So you don’t think that sending a bug bounty reward a year ago to a security researcher who exposed a flaw, that is still being exploited to take money from people, is a critical flaw in the program?

Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Do I think your 'motivated googling' approach to analyzing either story is likely to produce worthwhile insight? Not really. We've already seen it be remarkably inaccurate.

> Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible.

Great! You’re in agreement!

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#56

Post by lxgr »

ljoshua wrote: post #13

So NFC reading of embedded card details is always on, regardless of whether you are in "payments" mode or have the app open? Is that a PayPal flaw, or is it an Android/NFC/Google Payments flaw?

It's a Google Pay feature, but it only works up to the "no CVM" limit, which varies by country (but is usually something like $20-$50 or the local currency equivalent).

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#57

Post by SilasX »

inetknght wrote: post #39
SilasX wrote: post #38

Earlier quoted context omitted.

True but I thought you’d want to have some size limit regardless, if for no other reason than choking up the connection with a huge one.

Sure, but "some size limit" can be as big as 500 or 1000 bytes. "Choking up the connection" won't be for very long at all. Even on a 2400 baud modem, you're talking only a few seconds to transmit a kilobyte of password. On modern cell networks or especially broadband connections, you pretty much won't choke the connection at all with a 1000-character password.

I agree, which was I was only criticizing the point against "there should not be a limit at all" -- I don't know what you're disagreeing with that I said.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#58

Post by SilasX »

johndough wrote: post #51
inetknght wrote: post #39

Earlier quoted context omitted.

Sure, but "some size limit" can be as big as 500 or 1000 bytes. "Choking up the connection" won't be for very long at all. Even on a 2400 baud modem, you're talking only a few seconds to transmit a kilobyte of password. On modern cell networks or especially broadband connections, you pretty much won't choke the connection at all with a 1000-character password.

To add to that, the login page (which contains nothing but two fields for email and password) weighs in at 1.5 MB, so bandwidth clearly is not an issue for PayPal.

Which still doesn't refute the need for a limit, and a large part of why I didn't defend a 24-character limit.

Re: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

#59

Post by humaniania »

aaomidi wrote: post #36
humaniania wrote: post #34

Earlier quoted context omitted.

In what way does a password length limit suggest plain-text storage?

Because there's usually not a reason to limit it to something that low.

A previously defined field length on a production database would be a more simple explanation, no?
Post reply on HN