Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s going on with security at PayPal?

christianvarga.com

Post reply on HN
Print view View original

21–30 of 103 posts

Re: What’s going on with security at PayPal?

#21

Post by WA »

I had the exact same flow: received a SMS instead of asking for my TOTP, despite having enabled it.

I think I removed and re-added my Authenticator from PayPal’s settings and now it works again, never sending the SMS.

(This was about a year ago.)

Re: What’s going on with security at PayPal?

#22

Post by devoutsalsa »

My recent PayPal experience:

- try to pay for rental car in Mexico

- transaction declined

- get email saying account permanently locked

- get 2nd email w/ link to unblock (says click on unblock notification)

- no notification

- chatbot asks if I want help, redirects me to help page

- help page contains none of the following: unblock, unlock, locked

- chatbot asks if I still need help, says I have to call

- call link redirects to account home page

Re: What’s going on with security at PayPal?

#24

Post by levymetal »

throwawybllion wrote: post #9

No strong disagreements with the article, however... It's TOTP, not TOPT (a mistake made throughout the article). I am skeptical of the qualifications and much of the basis for complaint. Using anything based on a phone for sole verification is inexcusable in any situation, but is that really the case with PayPal? I have an account with MFA and... I don't think that's true

OP here - thanks for pointing that out, for some reason when I try to type TOTP my fingers keep defaulting to TOPT - some kind of muscle memory I guess. In any case, this has been corrected, although I'm unsure how a simple spelling mistake discredits the basis for the complaint.

> I have an account with MFA and... I don't think that's true

Try log in using Incognito/private browser. I am either defaulted into the one-time SMS flow, or given the option to log in with a one-time SMS code. In either case, if I enter the SMS code I am not prompted for my password nor TOTP.

Re: What’s going on with security at PayPal?

#25

Post by byhemechi »

levymetal wrote: post #20
oefrha wrote: post #17

> So I have a complex password and TOPT to protect my account. Forget these, because PayPal’s default method of login is now a one-time code sent via SMS. Yes, the very same medium that is generally considered unsafe for two-factor authentication is used by PayPal as the only factor; bypassing both password and TOPT for what appears to be full access to your account. You cannot disable this method of login, and you c…

OP here - I just tried again and got the normal flow this time. Guessing they must be A/B testing SMS one-time codes as the default.

i've had it like that for months now, maybe it's a geographical thing, for some reason a lot of this stuff comes early to australia?

Re: What’s going on with security at PayPal?

#27

Post by 88913527 »

devoutsalsa wrote: post #22

My recent PayPal experience: - try to pay for rental car in Mexico - transaction declined - get email saying account permanently locked - get 2nd email w/ link to unblock (says click on unblock notification) - no notification - chatbot asks if I want help, redirects me to help page - help page contains none of the following: unblock, unlock, locked - chatbot asks if I still need help, says I have to call - call link…

Too much software development is getting divvied into different product development groups, and collectively it leads to the creation of flows through the product that make literally no sense, yet all of the smaller parts are seemingly fine, because nobody is the thinking of macro-level experience.

Re: What’s going on with security at PayPal?

#28

Post by lambdasquirrel »

Believe it or not, PayPal has finally set up security keys and authenticator apps as a 2FA. This must have been recent. I remember trying to do this a year or two ago, after someone cracked my LinkedIn password (but not the 2FA), and 2FA was not available on PayPal at the time.

Re: What’s going on with security at PayPal?

#29

Post by Thorrez »

silisili wrote: post #12
hedora wrote: post #10

If true, this is borderline criminal incompetence. However, I can't reproduce the issue described in the article.

Same. The author says when you enter an email, an SMS is sent and number revealed. What really happens is that it asks me for a password. Below that there's an option to get a one time code. Clicking that reveals the first digit of the area code, then the last 4 digits. You must then click yet again to make it actually send. So in short, it didn't immediately send an SMS and never showed the full number.

The author never says the full number is revealed. The author says the partial number is revealed.

Re: What’s going on with security at PayPal?

#30

Post by m-ee »

The past week I've received two invoices for "bitcoin" in my rarely used paypal account. More deviously, the notes for the invoice contain the phone number to a fake paypal support center run by the scammers. So if you were savvy enough not to pay the invoice they might still steal your info when you call to dispute.

There's no way to report it through their website, because it's not a completed transaction. I didn't feel like waiting on hold so I sent a chat message and forwarded the email to phishing@paypal. One invoice still remains in my activity but says "no longer available" when I click on actions.

Already had me more paranoid about their security and now this comes out. My account still seems to be password + SMS thankfully.

EDIT- I didn't know you could even set up TOTP. Last time I used paypal SMS was the only option for 2FA.

Post reply on HN