Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ignoring the amount customers confirm is no security bug according to PayPal

seclists.org

Post reply on HN
Print view View original

31–40 of 41 posts

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#31

Post by kuschku »

habosa wrote: post #29

Seems like the sort of trust system that is common in restaurants. 1) You get the check with a total of food and drink. 2) The waiter/waitress takes your card to the register for authorization. 3) You get your card back. 4) You hand-write the tip amount and total, then walk away. You trust the merchant to charge the amount you wrote. 5) The restaurant charges the amount you wrote, but you don't know this for sure unt…

Here in Germany it works like this:

1) You get the check with a total 2) the waiter hands you a mobile card terminal (like this: http://pay-tec.de/cms/paytec/wp-content/uploads/2014/04/1.jp... ) 3) You put your card in the terminal 4) waiter enters amount to pay + what you said you'd tip 5) You see the total, enter your PIN, press confirm 6) waiter hands you back your card.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#32

Post by efuquen »

kuschku wrote: post #31
habosa wrote: post #29

Seems like the sort of trust system that is common in restaurants. 1) You get the check with a total of food and drink. 2) The waiter/waitress takes your card to the register for authorization. 3) You get your card back. 4) You hand-write the tip amount and total, then walk away. You trust the merchant to charge the amount you wrote. 5) The restaurant charges the amount you wrote, but you don't know this for sure unt…

Here in Germany it works like this: 1) You get the check with a total 2) the waiter hands you a mobile card terminal (like this: http://pay-tec.de/cms/paytec/wp-content/uploads/2014/04/1.jp... ) 3) You put your card in the terminal 4) waiter enters amount to pay + what you said you'd tip 5) You see the total, enter your PIN, press confirm 6) waiter hands you back your card.

Yes, this is how it works in many places in Europe. I really wish I saw this in the US, such a shame.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#33

Post by alistairSH »

kuschku wrote: post #31
habosa wrote: post #29

Seems like the sort of trust system that is common in restaurants. 1) You get the check with a total of food and drink. 2) The waiter/waitress takes your card to the register for authorization. 3) You get your card back. 4) You hand-write the tip amount and total, then walk away. You trust the merchant to charge the amount you wrote. 5) The restaurant charges the amount you wrote, but you don't know this for sure unt…

Here in Germany it works like this: 1) You get the check with a total 2) the waiter hands you a mobile card terminal (like this: http://pay-tec.de/cms/paytec/wp-content/uploads/2014/04/1.jp... ) 3) You put your card in the terminal 4) waiter enters amount to pay + what you said you'd tip 5) You see the total, enter your PIN, press confirm 6) waiter hands you back your card.

The US lags behind in card payment systems. We usually hand the card over to the wait staff, they carry it away to a remote terminal (and we trust that they don't copy the card while in their possession), then we manually enter a tip after the fact.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#34

Post by arjie »

jdong wrote: post #26

This is hardly an issue with a system that by design allows payment reversals. If you get defrauded, just chargeback.

Now I have to pay, then verify each payment manually. This is the job I thought PayPal was doing for me. Instead they've created more work since now I have to check two places to make sure charges are correct: my credit card statement and PayPal.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#36

Post by arrel »

This is the magic if market dynamics. If a business fraudulently takes advantage of this they will not build up a customer base, paypal will shut down their account, and money will be refunded. PayPal is taking most of the risk so that businesses can be flexible and provide a better experience.

It's not a bug, it's the way things should work with more services. PayPal's product may be outdated in many ways, but this is not one of them.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#37

Post by kevinpet »

beejiu wrote: post #8
jackweirdy wrote: post #6

Earlier quoted context omitted.

True, but how many customers read the documentation? If that's the way it is, the user should at least be told that on the checkout screen.

It's shouldn't really affect customers in any way. By terms of Express Checkout, after returning from the authorization at PayPal (which is NOT a checkout screen), the business must show the final checkout screen with the finalised price. If the business doesn't do this, it is the business committing fraud. PayPal is rather good at holding payments from businesses until they are happy everything is legitimate.

Maybe, but the implied behavior from what the buyer sees is that they are verifying a specific amount on Paypal's (trusted vendor) site, not on marginally trusted random internet vendor.

The difference is that if I want to order some two dollar bike parts, I'm happy to risk that I won't receive them, but I'm not in the habit of giving my credit card to every random site on the internet.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#38

Post by anujnayar »

LeicaLatte wrote: post #35

They don't have David Marcus anymore to respond in these forums. Poor PayPal.

Hi - its Anuj Nayar, senior director of global initiatives at PayPal. I have been reading this string with interest. We offer both buyer and seller protection to try and make sure we cover everyone. We do not always side with the buyer. On the restaurant payment side, we have been rolling out mobile payments solutions at places around the world, that let you check out and pay from your phone (inc tip). You are notified via text and email as soon as it goes through.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#39

Post by anujnayar »

benmorris wrote: post #16

I've implemented express checkout on a few carts I've written. It isn't possible to calculate the shipping cost/method until the user gives at at minimum their zip code and country. So basically the flow of Express Checkout doesn't allow this since that information is sent back once they authorize a charge and return to your site. At that point the customer is prompted with an order confirmation, final total and to s…

Hi - It's anuj Nayar from PayPal. I can confirm that through our Bug Bounty Program a researcher reported this suspected vulnerability with our PayPal Express Checkout.

After looking into the issue, we don't think this is in fact a vulnerability. We work closely with our merchants who use Express Checkout to provide them the flexibility they need to complete their transactions in a timely manner so they can offer excellent payments experiences to their customers. We offer robust buyer and seller protection to cover both ends of the transaction and our systems are pretty good at finding and flagging this kind of illegal behavior if a merchant were to start overcharging your customers.

Re: Ignoring the amount customers confirm is no security bug according to PayPal

#40

Post by Hermel »

arkonaut wrote: post #19
MichaelApproved wrote: post #18

Earlier quoted context omitted.

This story is going to need more detail because one of the biggest complaints merchants have is how PayPal will pretty much always side with the customer.

Agree here - That has always been one of the thorns in accepting PayPal on any decent scale. At least with chargebacks, you can fight them and win about 50% of the time with the right docs. PayPal barely entertains dialogue.

What happened is that I wanted to register a domain using www.mediaon.com, but that failed because someone else registered the same domain in the meantime using another company. When I asked for my money back because they failed to register the domain, they refused, saying that firstly it wasn't there fault (which is technically true) and secondly that I would be free to use the paid money to register another domain. That's in direct contradiction to their "money-back guarantee". Anyway, Paypal sided with them. It seemed to me that they exactly knew what to tell PayPal and PayPal does not seem to be very consumer-friendly when it comes to digital products (the policy for physical products differs).
Post reply on HN