Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Paypal gateway UI susceptible to spoofing

homakov.blogspot.com

Post reply on HN
Print view View original

51–53 of 53 posts

Re: New Paypal gateway UI susceptible to spoofing

#51

Post by homakov »

jfoster wrote: post #45
RandallBrown wrote: post #37

If you're going to trust a website with your credit card you probably trust them enough to not try and steal your paypal information. There isn't a way to solve this issue without hurting the user experience. For some websites, that's a fair trade off. Maybe a browser could put in a "Verify iframes" button that would show you the payment form is actually coming from PayPal.

There is a way to do this securely whilst improving the user experience. The merchant site can run PayPal's js, which would check whether the user is signed in to PayPal. If they are signed in, the js could just display a "confirm payment" button rather than requesting credentials from the user. If they're not signed in, it could just ask the user to sign in to PayPal in a new window, where the user can verify via th…

> the js could just display a "confirm payment" button rather than requesting credentials from the user.

clickjacking

Re: New Paypal gateway UI susceptible to spoofing

#52

Post by scott_karana »

DiThi wrote: post #35
userbinator wrote: post #31

But as long as the attacker can detect when the user opens devtools all your efforts are futile. This sounds even scarier - the user should be in control and able to inspect the page without the page knowing, since as he mentions, the attacker could otherwise deploy countermeasures to evade.

Looking at the code it looks pretty easy to circumvent: don't use firebug, have the devtools open when loading the page or have them open undocked by default. The detection method for non-firebug devtools is pretty silly: it checks the window size.

Even so, I'd appreciate it if the browser vendors took additional steps to disable the detection of devtools, personally. I don't think they should be detectable under any circumstances, if that's possible to implement.
Post reply on HN