Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

Post by meowface » Wed, Feb 26, 2020, 1:00 AM UTC

rocqua wrote: post #66

meowface wrote: post #64

Earlier quoted context omitted.

Or because you don't want to risk users forgetting very long passwords. (Everyone should be using a password manager, but sadly that isn't the case.) That's generally the reason that limit is set.

That certainly flies in the face of most recent recommendation. Recent NIST guidelines say not to do this, and NIST isn't really known for being adventureous. The current best practice is for people to use passphrases rather than complicated passwords. For this, a password length limit of 24 is simply not enough.

Post by luckylion » Wed, Feb 26, 2020, 8:41 AM UTC

carapace wrote: post #69

luckylion wrote: post #63

Earlier quoted context omitted.

You don't think they should challenge a company's claim, or should they, but not in the same article?

It's not the journalist's duty to ridicule anyone. Jon Stewart's "The Daily Show" was very entertaining, and even somewhat informative, but I think he would be one of the first to say that it wasn't journalism. I don't like corporate bullshit lingo either but when that's what they say as their formal statement to the press then relaying it is the journalistic duty. It's one thing if the company is outright lying, but…

Post by ThePowerOfFuet » Wed, Feb 26, 2020, 10:01 AM UTC

Crosseye_Jack wrote: post #54

ljoshua wrote: post #13

So NFC reading of embedded card details is always on, regardless of whether you are in "payments" mode or have the app open? Is that a PayPal flaw, or is it an Android/NFC/Google Payments flaw?

> So NFC reading of embedded card details is always on Apple have a similar option BUT they restrict its use to certain payment terminals (for example it is only supposed by TfL in the UK) and can be disabled if you want. Dunno if the data it exposes (in a physical read attack) could be used for other payments. > With Express Transit mode enabled, you don't have to validate with Face ID, Touch ID or your passcode whe…

Post by carapace » Wed, Feb 26, 2020, 4:29 PM UTC

luckylion wrote: post #73

carapace wrote: post #69

Earlier quoted context omitted.

It's not the journalist's duty to ridicule anyone. Jon Stewart's "The Daily Show" was very entertaining, and even somewhat informative, but I think he would be one of the first to say that it wasn't journalism. I don't like corporate bullshit lingo either but when that's what they say as their formal statement to the press then relaying it is the journalistic duty. It's one thing if the company is outright lying, but…

You wouldn't need to take Jon Stewart's approach though. I'd be fine if the ridiculing comes from another party that the journalist gives room to. Ask a consumer advocate what they think of PayPal's statement, or ask an infosec professional. Letting the PR speech stand by itself without large red arrows pointing at the absurdity gives it way too much power imho.

Post by meowface » Wed, Feb 26, 2020, 7:59 PM UTC

aaomidi wrote: post #78

meowface wrote: post #71

Earlier quoted context omitted.

I'm no advocate of it; just explaining what's very likely their rationale, as opposed to them storing passwords in plaintext. Plaintext password storage still happens, but you wouldn't see that at a company like Paypal. (Plaintext credentials may be unintentionally present elsewhere, like debug logs, but a company like that isn't going to be so incompetent as to store them in plaintext in the database.)

We've literally seen larger companies be more incompetent. There's no reason PayPal is excluded from this.