Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ignoring the amount customers confirm is no security bug according to PayPal

seclists.org

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#11

Post by david_b »

beejiu wrote: post #2

This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…

While I can see how this behaviour of PayPal is close to credit cards, I cannot see how they can show an amount that may be incorrect - they could just ask the shop whether the amount is final or not and indicate that in some way.

I wouldn't be astonished to see chargebacks (by buyers who think they were overcharged) resulting from this - that can hardly be in anyones interest.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#12

Post by kelnos »

onewaystreet wrote: post #10
jackweirdy wrote: post #6

Earlier quoted context omitted.

True, but how many customers read the documentation? If that's the way it is, the user should at least be told that on the checkout screen.

It doesn't really matter because the customer isn't on the line. It's PayPal that is. Considering how fanatically PayPal fights fraud, that they don't consider this an issue pretty much tells you that it isn't one.

Sure the customer is on the line. You make a very large charge on a customer's credit card, and best case is that they can't make further charges on the card because they've hit their limit. Getting it resolved in a week or so is little consolation when you have a useless credit card.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#13

Post by Hermel »

beejiu wrote: post #2

This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…

> any charges can be reversed

Good luck with that. It's very hard to get your money back when the merchant knows how to answer Paypal's questions. I failed at doing so when a merchant sold me something he could not deliver and then insisted on giving me a voucher instead returning my money.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#14

Post by EGreg »

seabee wrote: post #5
beejiu wrote: post #2

This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…

If a bug causes behaviour that everybody expects, is it still a bug?

Who is everybody? I never knew a website could charge via paypal $200 more than what I authorized. I thought PayPal was different than credit cards!

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#15

Post by EGreg »

Hermel wrote: post #13
beejiu wrote: post #2

This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…

> any charges can be reversed Good luck with that. It's very hard to get your money back when the merchant knows how to answer Paypal's questions. I failed at doing so when a merchant sold me something he could not deliver and then insisted on giving me a voucher instead returning my money.

PayPal nearly always sides with customers in a chargeback dispute. I'm not sure how this business was able to get around that.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#16

Post by benmorris »

I've implemented express checkout on a few carts I've written. It isn't possible to calculate the shipping cost/method until the user gives at at minimum their zip code and country. So basically the flow of Express Checkout doesn't allow this since that information is sent back once they authorize a charge and return to your site. At that point the customer is prompted with an order confirmation, final total and to select their shipping information. When they click confirm the charge is actually made. Express Checkout is extremely popular on all of the sites I've worked with and is probably quickest payment method people can use. In the 6+ years we've been using it we have not had one single complaint about charging the wrong amount shown on the PayPal confirmation page. Customers understand they must select their shipping method and I would rather not have them enter duplicate information.

I am confused how this "bug" is any different that using something like the payments pro API. Sure your cart page says you'll charge X amount, there is NOTHING keeping you from charging some other arbitrary amount when they press pay.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#17

Post by [deleted] »

beejiu wrote: post #2

This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…

[deleted]

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#18

Post by MichaelApproved »

Hermel wrote: post #13
beejiu wrote: post #2

This is how it has always been; it's written in the documentation. I don't personally consider this a bug, since a retailer could feasibly accept a credit card and charge whatever they want to it. The fact the PayPal allows the amount to be changed is not dangerous, because PayPal holds the liability and any charges can be reversed. Furthermore, the business who charges consumers without consent will be committing fr…

> any charges can be reversed Good luck with that. It's very hard to get your money back when the merchant knows how to answer Paypal's questions. I failed at doing so when a merchant sold me something he could not deliver and then insisted on giving me a voucher instead returning my money.

This story is going to need more detail because one of the biggest complaints merchants have is how PayPal will pretty much always side with the customer.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#19

Post by arkonaut »

MichaelApproved wrote: post #18
Hermel wrote: post #13

Earlier quoted context omitted.

> any charges can be reversed Good luck with that. It's very hard to get your money back when the merchant knows how to answer Paypal's questions. I failed at doing so when a merchant sold me something he could not deliver and then insisted on giving me a voucher instead returning my money.

This story is going to need more detail because one of the biggest complaints merchants have is how PayPal will pretty much always side with the customer.

Agree here - That has always been one of the thorns in accepting PayPal on any decent scale. At least with chargebacks, you can fight them and win about 50% of the time with the right docs. PayPal barely entertains dialogue.
Post reply on HN