Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A failure of security systems at PayPal is causing concern for German banks

nordbayern.de

Post reply on HN
Print view View original

161–170 of 222 posts

Re: A failure of security systems at PayPal is causing concern for German banks

#161

Post by mastermage »

tchalla wrote: post #102
Cthulhu_ wrote: post #26

Earlier quoted context omitted.

To add, on top of iDeal (I think they're on top anyway, they're digital payment whatsits anyway) there's an age verification system using a similar protocol - where a website gets a "yes this person is >18" signal, nothing else, from the user's bank. And there's "tikkie" (payment request), allowing people to request money through a link and people's own bank account - no need for everyone to use the same apps or serv…

> where a website gets a "yes this person is >18" signal, nothing else, from the user's bank. I am amazed on how this practical solution can't be implemented for age verification instead of all those ID uploads etc.

Because legislators don't understand how the internet works. Thats like the biggest problem. IMHO.

Re: A failure of security systems at PayPal is causing concern for German banks

#162

Post by majormajor »

o11c wrote: post #135
baxtr wrote: post #131

Earlier quoted context omitted.

Do you know how this exactly went down? How can a PayPal breach result in money being stolen from a bank account? Genuinely interested to understand

PayPal very strongly tries to make you give them your full bank info (remember that the banking system has absolutely no security as the computer world knows it - this is a feature required for checking to work - so this means anybody with access to your bank id numbers in PayPal's records can do arbitrary transactions to/from your bank account). When I last used it it was possible to avoid on the buyer end and just…

Routing and account numbers have been on every check written for decades. Banks usually aren't quite that naive to let anyone with the numbers transfer whatever they want. There's name validation they can do, but legally/contractually IIRC it's optional. So the numbers + a lot of social engineering skill can do damage.

But I kinda suspect the ROI is higher for social engineering into an online account portal to Zelle a bunch of stuff around vs waiting for ACH transfers. Breach a login vs find an ACH list and transfer stuff out of the high-value accounts without triggering any flags (imagine you had access to that Paypal list - how are you trying to exfiltrate from millions of accounts without looking suspicious?).

Re: A failure of security systems at PayPal is causing concern for German banks

#163

Post by lmm »

Vrondi wrote: post #107
mrweasel wrote: post #27

Earlier quoted context omitted.

They never really had much of a reason to create a competitor. There where already plenty of alternatives once online shopping/payments became a thing. Here you could do "cash on delivery", credit/debit card, account transfers (yes even across banks, it not as big an issue as US banks makes it) or you could send stamps (not a popular options). There was never a need for PayPal or PayPal style services. These days it'…

At the time PayPal rolled out, the single feature that made it popular in the USA is that it provided eBay sellers an easy/cheap way to receive credit card payments from buyers. That is all. Any person could set up a PayPal and instantly start receiving credit card payments without setting up a vendor account with a credit card company (which was not trivial at that time).

Right. But that was only relevant because US customers wanted to pay by credit card (because of some combination of credit cards being good and other payment methods being bad in the US). Which was not the case in most of Europe.

Re: A failure of security systems at PayPal is causing concern for German banks

#164

Post by lmm »

cultofmetatron wrote: post #12
ronsor wrote: post #2

PayPal security is amazing. It randomly locks people out of their accounts and randomly closes their accounts too, but actual fraudsters and criminals are never deterred.

> It randomly locks people out of their accounts and randomly closes their accounts too, yup, my paypal got locked after using it for over 20 years. Customer service refused to help and wouldn't even tell me why it was locked. I still get messages from paypal that they "couldn't get process subscription for X." won't delete my data either. Scummy behavior from them on multiple levels.

They'll do what your government lets them get away with. Demand better regulation.

Re: A failure of security systems at PayPal is causing concern for German banks

#165

Post by Dylan16807 »

dod9er wrote: post #152
Dylan16807 wrote: post #149

Earlier quoted context omitted.

If I have to accept it I think that's even worse than doing typical tracking behind my back. Also requiring acceptance from EU users would be a GDPR violation, I think? But it didn't ask me at all so I can't evaluate it well.

I think it is great that they are forced to show whats going one. Otherwise we wouldnt even discuss, just no one would care.

Forced to show is better than going behind my back.

But making me click an "accept" button is just dirty. I hate that.

Re: A failure of security systems at PayPal is causing concern for German banks

#166

Post by Dylan16807 »

tomschwiha wrote: post #153
Dylan16807 wrote: post #149

Earlier quoted context omitted.

If I have to accept it I think that's even worse than doing typical tracking behind my back. Also requiring acceptance from EU users would be a GDPR violation, I think? But it didn't ask me at all so I can't evaluate it well.

You are not required to accept the tracking. You can pay to remove tracking with their "Pur-Abo".

That is definitely a GDPR violation (for users in the EU).

And heise.de has already gotten in trouble for this before.

Re: A failure of security systems at PayPal is causing concern for German banks

#167

Post by hulitu »

heisenbit wrote: post #51

It is worth remembering that PayPal not only handles payments but also provides a degree of assurance to receive the goods. A pure payment system does not. From a customer perspective this can provide real value as filing a claim with PayPal gets merchants definitely to listen more closely.

> It is worth remembering that PayPal not only handles payments but

It is _also_ worth remembering that PayPal not only handles payments but _also blocks acounts based on random issues_. A lot of people lost access to their Paypal accounts. /s

Handle with care.

Re: A failure of security systems at PayPal is causing concern for German banks

#168

Post by horseradish7k »

skybrian wrote: post #91
dev_l1x_be wrote: post #79

Earlier quoted context omitted.

Ebay and Paypal are full of scam. Simply it is thei best interest to keep this up because it generates revenue for them.

That's a simplistic way of understanding "best interest." The optimal amount of fraud is neither zero nor "let it all through." Their "best interest" is a balance between allowing legit transactions to get through and blocking enough fraudulent ones that fraud doesn't become too common.

and of course, confiscating the fraudster's money without refunding it

Re: A failure of security systems at PayPal is causing concern for German banks

#169

Post by mrweasel »

rvnx wrote: post #134
mrweasel wrote: post #49

Earlier quoted context omitted.

I can't speak to how other European countries did only payments, but you never gave your credit card number to the merchant in Denmark. It was always done via a 3rd. party payment provider, initially mostly DIBS, then came WorldPay and later many more. Charge backs was also always fairly easily done via your bank. Though you did have to call them, so yes PayPal was/is easier. I don't know, the trust in PayPal was alw…

It was before 2006 (enforcement of PCI DSS), at that time, a lot of merchants just created and hosted themselves a payment form and stored bank card numbers themselves, numbers that they often collected on non-HTTPS pages

Because the banks are liable to fraud in Denmark, probably also other countries, they already had really strict rules for online payments. Denmark also has it's own national payment card "Dankort", and before 2006, you needed to accept Dankork as it was the most popular debit card. The Danish banks could make their own rules, separately from PCI DSS, and those where much stricter, so no http and only specially audited software was allowed to handle the transactions. The downside was a near monopoly from DIBS.

Re: A failure of security systems at PayPal is causing concern for German banks

#170

Post by Aefiam »

skybrian wrote: post #91
dev_l1x_be wrote: post #79

Earlier quoted context omitted.

Ebay and Paypal are full of scam. Simply it is thei best interest to keep this up because it generates revenue for them.

That's a simplistic way of understanding "best interest." The optimal amount of fraud is neither zero nor "let it all through." Their "best interest" is a balance between allowing legit transactions to get through and blocking enough fraudulent ones that fraud doesn't become too common.

The optimal amount of fraud is zero.

But fraud prevention is not free and has negative returns at some point.

I dislike it when people use "the optimal amount of fraud isnt zero", because it is wrong and makes the underlying problem harder to understand, which is that people like to overoptimize a single desirable property(fraud prevention) without considering other desirable properties(like ease of use and a low rate of false positives for legit transactions)

Post reply on HN