Earlier quoted context omitted.
If a bug causes behaviour that everybody expects, is it still a bug?
Who is everybody? I never knew a website could charge via paypal $200 more than what I authorized. I thought PayPal was different than credit cards!
Ignoring the amount customers confirm is no security bug according to PayPal
21–30 of 41 posts
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#22Earlier quoted context omitted.
It doesn't really matter because the customer isn't on the line. It's PayPal that is. Considering how fanatically PayPal fights fraud, that they don't consider this an issue pretty much tells you that it isn't one.
Sure the customer is on the line. You make a very large charge on a customer's credit card, and best case is that they can't make further charges on the card because they've hit their limit. Getting it resolved in a week or so is little consolation when you have a useless credit card.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#23Earlier quoted context omitted.
Who is everybody? I never knew a website could charge via paypal $200 more than what I authorized. I thought PayPal was different than credit cards!
Sites that don't redirect to PayPal could charge you $200 more than what they display too -- even easier!
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#24Re: Ignoring the amount customers confirm is no security bug according to PayPal
#25I've implemented express checkout on a few carts I've written. It isn't possible to calculate the shipping cost/method until the user gives at at minimum their zip code and country. So basically the flow of Express Checkout doesn't allow this since that information is sent back once they authorize a charge and return to your site. At that point the customer is prompted with an order confirmation, final total and to s…
> Sure your cart page says you'll charge X amount, there is NOTHING keeping you from charging some other arbitrary amount when they press pay.
Which is exactly why I only use shops with paypal where I see the amount charged on paypal.com if I don't completely trust the shop. I was under the impression that this was the value paypal provides. Apparently I was wrong. Might as well get a prepaid credit card now.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#26Re: Ignoring the amount customers confirm is no security bug according to PayPal
#27Re: Ignoring the amount customers confirm is no security bug according to PayPal
#28I've implemented express checkout on a few carts I've written. It isn't possible to calculate the shipping cost/method until the user gives at at minimum their zip code and country. So basically the flow of Express Checkout doesn't allow this since that information is sent back once they authorize a charge and return to your site. At that point the customer is prompted with an order confirmation, final total and to s…
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#291) You get the check with a total of food and drink.
2) The waiter/waitress takes your card to the register for authorization.
3) You get your card back.
4) You hand-write the tip amount and total, then walk away. You trust the merchant to charge the amount you wrote.
5) The restaurant charges the amount you wrote, but you don't know this for sure until you check your statement.
Re: Ignoring the amount customers confirm is no security bug according to PayPal
#30Seems like the sort of trust system that is common in restaurants. 1) You get the check with a total of food and drink. 2) The waiter/waitress takes your card to the register for authorization. 3) You get your card back. 4) You hand-write the tip amount and total, then walk away. You trust the merchant to charge the amount you wrote. 5) The restaurant charges the amount you wrote, but you don't know this for sure unt…