Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Paypal gateway UI susceptible to spoofing

homakov.blogspot.com

Post reply on HN
Print view View original

1–10 of 53 posts

Re: New Paypal gateway UI susceptible to spoofing

#2

Post by JoachimSchipper »

PayPal probably has good enough fraud detection that easier-but-riskier integration is still a net win for PayPal. (Not so much for the rest of the internet, though...)

Similarly, Google's "No CAPTCHA" (https://news.ycombinator.com/item?id=8693767) lets Google offer a better experience than a traditional CAPTHCA. I'm somewhat surprised that better fraud detection leads to better UX, but it's pretty neat.

Re: New Paypal gateway UI susceptible to spoofing

#3

Post by manifesto »

JoachimSchipper wrote: post #2

PayPal probably has good enough fraud detection that easier-but-riskier integration is still a net win for PayPal. (Not so much for the rest of the internet, though...) Similarly, Google's "No CAPTCHA" ( https://news.ycombinator.com/item?id=8693767 ) lets Google offer a better experience than a traditional CAPTHCA. I'm somewhat surprised that better fraud detection leads to better UX, but it's pretty neat.

It's not just PayPal fraud per se. Leaking user's PayPal email address and password has a lot of other consequences. (Yeah yeah in theory you should use distinct passwords for different sites etc etc)

Re: New Paypal gateway UI susceptible to spoofing

#4

Post by JoachimSchipper »

manifesto wrote: post #3
JoachimSchipper wrote: post #2

PayPal probably has good enough fraud detection that easier-but-riskier integration is still a net win for PayPal. (Not so much for the rest of the internet, though...) Similarly, Google's "No CAPTCHA" ( https://news.ycombinator.com/item?id=8693767 ) lets Google offer a better experience than a traditional CAPTHCA. I'm somewhat surprised that better fraud detection leads to better UX, but it's pretty neat.

It's not just PayPal fraud per se. Leaking user's PayPal email address and password has a lot of other consequences. (Yeah yeah in theory you should use distinct passwords for different sites etc etc)

Yes, but if PayPal's security is good enough, that's everyone else's problem.

(Yes, that's pretty nasty - but is putting a poorly-secured "startup" online really any better?)

Re: New Paypal gateway UI susceptible to spoofing

#5

Post by Silhouette »

Doesn't this weakness potentially exist with any integrated payment page on any site using any payment platform, though?

There is always a level of trust involved with entering these kinds of credentials on-line. This is why some of the 3-D Secure systems make you (the customer) give them a greeting of your own choice to incorporate in the prompt for your confirmation code.

However, it seems that for many vendors the losses due to a higher rate of aborted checkouts make such systems undesirable. Apparently most customers don't share the author's concern here, presumably either unaware of the potential security issues or just trusting that if anything does go wrong then some protection or guarantee from their payment service/card issuer will get it fixed.

I suspect the author here would argue that it would be better for on-line payments to be push transactions rather than pull, so users always actively send money via a trusted party such as their bank without ever handing over their bank-issued credentials to anyone else. No doubt many of us would agree with that; pull-based payment models are fundamentally insecure and absurdly vulnerable to fraud. But again, that goes for a lot more than just PayPal.

Re: New Paypal gateway UI susceptible to spoofing

#6

Post by rtpg »

Huh, this seems very obvious in hindsight. I guess with Stripe things are a bit easier since you have none of this username/password stuff to be dealing with (you could get your cc number swiped, but if you're an American you're dealing with that issue everyday anyways).
Post reply on HN