31–40 of 103 posts
Moreover, PayPal is the only financial institution I know that regularly sends emails with a juicy "click here to login" button. All other institutions are trying to teach "don't click links in emails that claim to be from us, only phishing mails will contain links".
I think imma close my PayPal.
Earlier quoted context omitted.
Same. The author says when you enter an email, an SMS is sent and number revealed. What really happens is that it asks me for a password. Below that there's an option to get a one time code. Clicking that reveals the first digit of the area code, then the last 4 digits. You must then click yet again to make it actually send. So in short, it didn't immediately send an SMS and never showed the full number.
The author never says the full number is revealed. The author says the partial number is revealed.
> enter an email address to log into PayPal, an SMS is immediately sent and the phone number is partially revealed.
That said, below that it mentioned number guessing so I probably could have guessed that's what they'd meant to write.
On the one hand, there are so many stories on HN complaining about incompetent and dystopian security practices in the financial industry.
And many tips on how to cope with it. Like not giving PayPal your bank account, rather pay 3% to put a credit card between PayPal and your bank account. And to keep your phone number secret to avoid sim swapping and PayPal exposing it.
It seems to be a fight between customers who are supposed to try and hide as much data as possible from the companies. Because that data causes a threat to you. And the companies that try to get as much data as possible.
On the other hand, cryptographic solutions which put the user in control and do not expose any data to the outside world are frowned upon. To me, it seems the logical solution. I want a private key, that only I know. And to be able to sign transactions with it without exposing any data.
If such a solution based on cryptography would be widely used, I would hold a smallish amount of buying power on my "crypto wallet" and use that for day to day transactions. And regularly refill it directly from my bank account.
The best of both worlds: For my smallish day-to-day transactions, I am in full control of the security and privacy. And my savings stay on my bank, completely shielded from my day-to-day transactions.
Why does everyone on HN hate this approach?
Earlier quoted context omitted.
The author never says the full number is revealed. The author says the partial number is revealed.
The article has been changed. The word partially was added in the sentence below after I commented. > enter an email address to log into PayPal, an SMS is immediately sent and the phone number is partially revealed. That said, below that it mentioned number guessing so I probably could have guessed that's what they'd meant to write.
This confuses me about discussions like these on HN: On the one hand, there are so many stories on HN complaining about incompetent and dystopian security practices in the financial industry. And many tips on how to cope with it. Like not giving PayPal your bank account, rather pay 3% to put a credit card between PayPal and your bank account. And to keep your phone number secret to avoid sim swapping and PayPal expos…
Because, in general, key management is hard, and your average user will likely not be able to understand such a flow, and will additionally probably lose their private key.
PayPal already has a pretty reasonable way to secure accounts: username+password+TOTP (using an app for the OTPs, not SMS). No, it's not perfect, and can be phished, but for most people it will be good enough. People who care about the phishing risk can use a FIDO2 hardware token instead of TOTP. All of this is common and widely-implemented enough that it's feasible to require that users do this.
But instead, probably in the name of reducing payment friction, they have decided on this horribly insecure method as described by OP. Ugh.
This confuses me about discussions like these on HN: On the one hand, there are so many stories on HN complaining about incompetent and dystopian security practices in the financial industry. And many tips on how to cope with it. Like not giving PayPal your bank account, rather pay 3% to put a credit card between PayPal and your bank account. And to keep your phone number secret to avoid sim swapping and PayPal expos…
But at some point it all went off the rails: crypto became a deeply rigged casino targeting the most vulnerable people they could find, fueled by insane amounts of energy consumption and money laundering.
This confuses me about discussions like these on HN: On the one hand, there are so many stories on HN complaining about incompetent and dystopian security practices in the financial industry. And many tips on how to cope with it. Like not giving PayPal your bank account, rather pay 3% to put a credit card between PayPal and your bank account. And to keep your phone number secret to avoid sim swapping and PayPal expos…
As they exist now, they are even more difficult to use safely and securely. For every one person who gets hacked via paypal's SMS crap and a simswap, there would be 50 people who would lose their crypto wallet to dropping their phone in the river and forgetting the passphrase.
It's perfectly consistent to have issues with cryptocurrency and with other centralized financial institutions since they both have awful security models for the average person. Financial institutes are too insecure, and crypto is too unusable.
I, personally, would like the government to provide a universal authorization server ("log in with GovID" or whatever), and require all banks in the country to support that auth mechanism, and then ensure that mechanism is both incredibly secure, but also has suitable fallbacks to recover access.
The government is uniquely positioned to be able to do that in theory, if only the government weren't wildly allergic to doing _anything_.
I'll settle for a bank that does not ever fall back to SMS and supports webauthn so I can use my yubikey, and fortunately such banks do exist, so things aren't actually so bad. As long as I don't use paypal or various other less competent software.
> So I have a complex password and TOPT to protect my account. Forget these, because PayPal’s default method of login is now a one-time code sent via SMS. Yes, the very same medium that is generally considered unsafe for two-factor authentication is used by PayPal as the only factor; bypassing both password and TOPT for what appears to be full access to your account. You cannot disable this method of login, and you c…
OP here - I just tried again and got the normal flow this time. Guessing they must be A/B testing SMS one-time codes as the default.
Earlier quoted context omitted.
OP here - I just tried again and got the normal flow this time. Guessing they must be A/B testing SMS one-time codes as the default.
i've had it like that for months now, maybe it's a geographical thing, for some reason a lot of this stuff comes early to australia?