Is this Paypal experience customary? • Hacker News Board

Re: Is this Paypal experience customary?

#251

Post by Thorrez » Fri, Jul 05, 2019, 8:26 PM UTC

jeromegv wrote: post #241

pteraspidomorph wrote: post #98

Earlier quoted context omitted.

I know the "logic" behind modern low password length limits for services like Paypal. Too many of their users are literally incapable of remembering their passwords and call/e-mail them bitching about how they're entering the right password and their account won't let them in and now they can't get to their money and bogus threats of legal action. So they encourage weak passwords and try to handle security on their s…

Their 2FA policy is awful, SMS or nothing. At least that's the case in Canada (I heard it might be different in other regions).

Just now I (in the US) added TOTP (Google Authenticator) 2FA, and removed my old SMS 2FA. It does seem a bit laggy but I was able to do it and log in.

Re: Is this Paypal experience customary?

#252

Post by nashashmi » Fri, Jul 05, 2019, 8:27 PM UTC

tobiasSoftware wrote: post #66

I recently had a similar experience with eBay, though it got resolved: -I had an old eBay account that was closed through inactivity -I wanted to buy some headphones so I decided to create a new account -When I went to eBay it had already given me a username through some sort of linked google account feature that used the google account I was logged in to -I tried to buy 2 $40 headphones and it wouldn't let me, sayin…

You are lucky. I had a very old account that got suspended. Any further account on the same address also got suspended. They blacklisted the address.

I called and spoke with them for an hour and they would not tell me why they suspended the account, other than "I have reviewed the information and have decided the suspension is correct. But cannot tell you why it is being suspended." they kept repeating that she personally reviewed and therefore suspension must be legitimate. I said to her that her review of the account sucks.

And I had my pitchfork out to sue because they should not be doing that.

Re: Is this Paypal experience customary?

#253

Post by tgb29 » Fri, Jul 05, 2019, 8:27 PM UTC

Paypal has taken thousands of dollars from me and won't let me access my account with a pre-paid phone. It's hard, but avoid them if you can. I inherently distrust Facebook's Libra project because of Paypal's involvement.

Re: Is this Paypal experience customary?

#254

Post by parliament32 » Fri, Jul 05, 2019, 8:29 PM UTC

driverdan wrote: post #235

parliament32 wrote: post #209

Earlier quoted context omitted.

Probably because they can't legally hold the data of a minor (who wasn't able to consent to their data policy or whatever at the time) so they have to delete everything.

Nope. The account isn't deleted, it's locked. And if they did need to delete the data they could easily delete everything from when they were under age.

Eh, kinda. If they entered their name/address/phone when they were underage, it's still data collected from a minor (even if it hasn't changed). To cleanup PayPal would have to have them re-enter everything... which is basically the same thing as creating a new account.

I'm not saying they're right, but I can see why this is the easiest way for them to fix the legal situation.

Re: Is this Paypal experience customary?

#255

Post by Thorrez » Fri, Jul 05, 2019, 8:32 PM UTC

slondr wrote: post #250

davnicwil wrote: post #64

I rarely use Paypal, but was forced to use it recently for something with no other payment option. Whilst there I decided to change my password, and was horrified to find that they limit passwords to 20 characters. It got me thinking about the standard assumption that any system limiting chars in a password must be storing passwords in plaintext and not hashing them, else there would be no logical reason to do so (si…

My PayPal password is along the lines of thirty-two characters, so this comment confuses me a lot.

I just now went to paypal and tried to change my password to something long. It said "Try another password. It must be less than 20 characters."

Re: Is this Paypal experience customary?

#256

Post by TazeTSchnitzel » Fri, Jul 05, 2019, 8:32 PM UTC

lucb1e wrote: post #203

TazeTSchnitzel wrote: post #73

Earlier quoted context omitted.

The EU has a lot of law about digital payments. In September this year, a new provision will come into force in the entire EEA that requires digital payments to be made with two-factor authentication, for example. I don't know whether or how that affects PayPal though.

Ugh, I'm really going to need virtual phone numbers for all these "second factors" (i.e. linkable identifiers), I'm just not sure where to get them. Twilio requires a credit card, and most other businesses that offer this look super shady.

There's no requirement it be SMS. Card payments in Sweden are already able to comply with this just by having a phone app for authentication.

Re: Is this Paypal experience customary?

#257

Post by Marsymars » Fri, Jul 05, 2019, 8:35 PM UTC

ken wrote: post #242

davnicwil wrote: post #64

I rarely use Paypal, but was forced to use it recently for something with no other payment option. Whilst there I decided to change my password, and was horrified to find that they limit passwords to 20 characters. It got me thinking about the standard assumption that any system limiting chars in a password must be storing passwords in plaintext and not hashing them, else there would be no logical reason to do so (si…

When I changed my password there, not too long ago, it was worse. The "change password" page (I later discovered) silently cropped the long random password I pasted, while the "log in" page required the saved (truncated) password exactly. I don't know how they expected anyone to figure that out. I suspect the answer to your question is that what we know as "Paypal.com" is a collection of 57 different legacy systems t…

This is true. For a good example, look at the process if you want to purchase something in a foreign currency on Paypal without Paypal taking an extra ~3.5% cut: https://www.gamedealscanada.com/2018/06/27/changing-paypals-...

Re: Is this Paypal experience customary?

#258

Post by Thorrez » Fri, Jul 05, 2019, 8:36 PM UTC

winkeltripel wrote: post #142

brownbat wrote: post #90

Earlier quoted context omitted.

It's possible, but this explanation still implies they're storing the passwords, not the hashes.

Think more along the lines of "they once had a mainframe in their infrastructure which stored passwords instead of hashes, which caused their requirements to limit the length of passwords to 20 characters, even if that system is no longer in use, or now uses hashes."

Sure, but that means that currently there's no reason to have the limit, except that they don't want to invest any effort to change it.

Re: Is this Paypal experience customary?

#259

Post by Thorrez » Fri, Jul 05, 2019, 8:37 PM UTC

astura wrote: post #175

chrisdew wrote: post #84

Earlier quoted context omitted.

Some financial systems, a large number of which run on mainframes, have databases where all fields are fixed length. (A database with fixed-length records is trivial to access randomly.) One of my credit cards lists my name as "Christophe" rather than "Christopher" as they have a fixed-length 10 character field for first names. Customer support said it was unfixable. It only takes one such system, in a complex web, t…

At least American Express automatically changes "Christopher" to "C" so your first name is abbreviated rather than just cut off.

Names are expected to be stored in a database, passwords are not (only the hash should be stored).

Re: Is this Paypal experience customary?

#260

Post by Thorrez » Fri, Jul 05, 2019, 8:40 PM UTC

gdfasfklshg4 wrote: post #115

ethbro wrote: post #67

Earlier quoted context omitted.

> Does anyone know of or can think of a better explanation for this? Mainframe.

This is a very likely answer. Strange that it is downvoted.

"Mainframe" doesn't seem like an actual answer to me. Why can't mainframes handle passwords longer than 20 characters? Are mainframes incapable of doing password hashing? Can't modern databases have text fields with a max of 20 characters, why is that problem unique to mainframes?