Live data from Hacker News

Ignoring the amount customers confirm is no security bug according to PayPal

seclists.org

21–30 of 41 posts

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#21
post #14
post #5

Earlier quoted context omitted.

If a bug causes behaviour that everybody expects, is it still a bug?

Who is everybody? I never knew a website could charge via paypal $200 more than what I authorized. I thought PayPal was different than credit cards!

Sites that don't redirect to PayPal could charge you $200 more than what they display too -- even easier!

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#22
post #12

Earlier quoted context omitted.

It doesn't really matter because the customer isn't on the line. It's PayPal that is. Considering how fanatically PayPal fights fraud, that they don't consider this an issue pretty much tells you that it isn't one.

Sure the customer is on the line. You make a very large charge on a customer's credit card, and best case is that they can't make further charges on the card because they've hit their limit. Getting it resolved in a week or so is little consolation when you have a useless credit card.

[deleted]

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#23
post #21
post #14

Earlier quoted context omitted.

Who is everybody? I never knew a website could charge via paypal $200 more than what I authorized. I thought PayPal was different than credit cards!

Sites that don't redirect to PayPal could charge you $200 more than what they display too -- even easier!

So what? The whole point of that confirmation screen should be to let me confirm the amount with Paypak which authorizes the funds' release.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#24
I spotted this earlier this week when ordering a t-shirt through TeeSpring using PayPal. I authorized a payment of 22.95 USD. Here’s a screenshot from the payment confirmation email I received: http://i.imgur.com/BGjKcsW.png The math doesn’t quite add up.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#25

I've implemented express checkout on a few carts I've written. It isn't possible to calculate the shipping cost/method until the user gives at at minimum their zip code and country. So basically the flow of Express Checkout doesn't allow this since that information is sent back once they authorize a charge and return to your site. At that point the customer is prompted with an order confirmation, final total and to s…

I wouldn't mind entering my ZIP to precalculate the shipping costs. But seriously, Shipping costs are a lame excuse. There is nothing that stops paypal to call back to the shop to get the shipping costs. Or just make a CORS request from the browser itself and have the shop sign the shipping costs so paypal knows.

> Sure your cart page says you'll charge X amount, there is NOTHING keeping you from charging some other arbitrary amount when they press pay.

Which is exactly why I only use shops with paypal where I see the amount charged on paypal.com if I don't completely trust the shop. I was under the impression that this was the value paypal provides. Apparently I was wrong. Might as well get a prepaid credit card now.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#28

I've implemented express checkout on a few carts I've written. It isn't possible to calculate the shipping cost/method until the user gives at at minimum their zip code and country. So basically the flow of Express Checkout doesn't allow this since that information is sent back once they authorize a charge and return to your site. At that point the customer is prompted with an order confirmation, final total and to s…

Of course it is a bug. Proper behavior would be to confirm the amount plus shipping, or at very least, limit the change to an amount no greater than $20 more than what was confirmed.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#29
Seems like the sort of trust system that is common in restaurants.

1) You get the check with a total of food and drink.

2) The waiter/waitress takes your card to the register for authorization.

3) You get your card back.

4) You hand-write the tip amount and total, then walk away. You trust the merchant to charge the amount you wrote.

5) The restaurant charges the amount you wrote, but you don't know this for sure until you check your statement.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#30
post #29

Seems like the sort of trust system that is common in restaurants. 1) You get the check with a total of food and drink. 2) The waiter/waitress takes your card to the register for authorization. 3) You get your card back. 4) You hand-write the tip amount and total, then walk away. You trust the merchant to charge the amount you wrote. 5) The restaurant charges the amount you wrote, but you don't know this for sure unt…

Not really common in European restuarants. They bring you a card machine, you swipe and add the tip right there on the machine.
Post reply on HN