Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Innovation Nation: WePay is the anti-PayPal

money.cnn.com

Post reply on HN
Print view View original

41–50 of 54 posts

Re: Innovation Nation: WePay is the anti-PayPal

#41

Post by csomar »

sbov wrote: post #40
pinksoda wrote: post #14

I really hope WePay destroys PayPal. They have screwed myself and my friends too many times. The homepage layout is all wrong though. Poor element placement, messy typography, and the color scheme is off. It looks amateur and unpolished. All those SEO'd subpages are worthless if they don't convert. Also: - Upgrade to Nginx 0.7.67, there was a lot of bug fixes in 0.7.65 and 0.7.66. - Limit the number of login attempts…

> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously. Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.

but when signing up there is a captcha, unlike the login page.(Okay, unless it's AJAX).

Re: Innovation Nation: WePay is the anti-PayPal

#42

Post by _b8r0 »

seiji wrote: post #16
pinksoda wrote: post #14

I really hope WePay destroys PayPal. They have screwed myself and my friends too many times. The homepage layout is all wrong though. Poor element placement, messy typography, and the color scheme is off. It looks amateur and unpolished. All those SEO'd subpages are worthless if they don't convert. Also: - Upgrade to Nginx 0.7.67, there was a lot of bug fixes in 0.7.65 and 0.7.66. - Limit the number of login attempts…

Wow, "ssh wepay.com" works. Turn that off. Once again, "cloud" doesn't mean "lol, we don't need to know about servers!"

Don't necessarily turn it off. Make sure you've hardened SSH, only do key-based authentication and limit access to specific source IP addresses or use something like fail2ban.

Then spend the time to properly look at your information security requirements and develop a plan to comply with them.

If you just turn off SSH you're going to have a lot of pain with little gain or loss if it's properly configured.

Re: Innovation Nation: WePay is the anti-PayPal

#43

Post by sbov »

csomar wrote: post #41
sbov wrote: post #40

Earlier quoted context omitted.

> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously. Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.

but when signing up there is a captcha, unlike the login page.(Okay, unless it's AJAX).

Most websites out there don't actually require a captcha for signup. Paypal certainly doesn't. (I'm not going to create a fake wepay account to check if/when they do email uniqueness validation.)

Re: Innovation Nation: WePay is the anti-PayPal

#44

Post by iamdave »

jfager wrote: post #19
iamdave wrote: post #18

Earlier quoted context omitted.

No. Do you know why? Facebook acts as if it were completely incapable of knowing when far is too far. Whenever something new rolls out, it always comes off like outsourced peer-pressure. 'HEY LOOK AT WHAT EVERYONE ELSE IS DOING BUT YOU!!' No thank you, sir.

The question of whether FB as it exists now would abuse such a system (yes, of course they would, they're awful) is separate from the question of whether or not said system would make business sense for a gigantic social network. If FB were the kind of company that could figure out how to make money without ads or taxing 3rd party devs, maybe they'd also be the kind of company that would treat its users as customers…

You've actually got an excellent point to this.

Re: Innovation Nation: WePay is the anti-PayPal

#45

Post by viraptor »

_b8r0 wrote: post #42
seiji wrote: post #16

Earlier quoted context omitted.

Wow, "ssh wepay.com" works. Turn that off. Once again, "cloud" doesn't mean "lol, we don't need to know about servers!"

Don't necessarily turn it off. Make sure you've hardened SSH, only do key-based authentication and limit access to specific source IP addresses or use something like fail2ban. Then spend the time to properly look at your information security requirements and develop a plan to comply with them. If you just turn off SSH you're going to have a lot of pain with little gain or loss if it's properly configured.

It will certainly limit possibilities of 0day ssh exploitation.

Re: Innovation Nation: WePay is the anti-PayPal

#46

Post by pvg »

pinksoda wrote: post #32
smeagol wrote: post #27

Earlier quoted context omitted.

thanks for the feedback! can you be more specific about how we can improve the home page? we're constantly trying to improve it, but our oldest (and admittedly ugliest) one always converts the best. tell me the dominant page color and i'll know which version you're looking at.

White and blue are good colors for your industry, but the current homepage has too much blue above the fold. The blue is slightly too vibrant also. You want to be careful about the saturation of your colors. Vibrant/Saturated colors are subconsciously distracting and unprofessional. The hurdle to trust a vibrant website is much higher. "WePay helps you collect, manage, and spend money." should be displayed above the…

The blue is slightly too vibrant also. You want to be careful about the saturation of your colors. Vibrant/Saturated colors are subconsciously distracting and unprofessional.

This is completely subjective though. To me, for instance, We Pay's current webpage looks like a site I might use for the scenarios described in the NYT article, like a way to collect payment among a group of friends. Your mock-up looks like the site of a bank or mutual fund, which is exactly not the sort of site that comes to mind for the purpose. Again, this is completely subjective - I just don't think there is any way to justify something as vague as 'vibrant is unprofessional'.

Re: Innovation Nation: WePay is the anti-PayPal

#47

Post by _b8r0 »

viraptor wrote: post #45
_b8r0 wrote: post #42

Earlier quoted context omitted.

Don't necessarily turn it off. Make sure you've hardened SSH, only do key-based authentication and limit access to specific source IP addresses or use something like fail2ban. Then spend the time to properly look at your information security requirements and develop a plan to comply with them. If you just turn off SSH you're going to have a lot of pain with little gain or loss if it's properly configured.

It will certainly limit possibilities of 0day ssh exploitation.

Just out of interest, how many 0day pre-auth OpenSSH vulnerabilities are you aware of? The last publicly disclosed pre-auth OpenSSH vulnerability that if exploited would lead to arbitrary code execution came out in 2006.

I'm not saying that SSH 0day doesn't exist, but why SSH and not other 0day for say a VPN or the HTTP server? I think I see what you're saying, perhaps that SSH 0day is more valuable and less likely to be publicly disclosed but without any data on attacks in the wild, someone at wepay needs to make a risk decision.

My main point isn't that they shouldn't harden their platform, on the contrary I think they should, but they need to do so in a structured manner that doesn't leave them with a bigger mess to deal with. Hardening SSH isn't hard, hardening an IPSEC 2FA VPN is going to be a different story.

Re: Innovation Nation: WePay is the anti-PayPal

#48

Post by viraptor »

_b8r0 wrote: post #47
viraptor wrote: post #45

Earlier quoted context omitted.

It will certainly limit possibilities of 0day ssh exploitation.

Just out of interest, how many 0day pre-auth OpenSSH vulnerabilities are you aware of? The last publicly disclosed pre-auth OpenSSH vulnerability that if exploited would lead to arbitrary code execution came out in 2006. I'm not saying that SSH 0day doesn't exist, but why SSH and not other 0day for say a VPN or the HTTP server? I think I see what you're saying, perhaps that SSH 0day is more valuable and less likely t…

> but why SSH and not other 0day for say a VPN or the HTTP server

More hosts have SSH than VPN available. SSH is pretty much standardised in comparison to VPN. VPN touches mostly certificates and network interfaces, while SSH touches the whole authentication stack, so there's a possibility of exploiting whatever pam environment you're using. Also, you can drop root in most VPN solutions, but not in SSH (by design).

Sure - hardening SSH is enough and most likely thing to do in case of standard servers. But if you're providing some special services... why not add the special protection?

Re: Innovation Nation: WePay is the anti-PayPal

#49

Post by nwmcsween »

poet wrote: post #39
nwmcsween wrote: post #38

Earlier quoted context omitted.

Practicality trumps everything, after 10+ years of using ssh and trying port knocking and everything else none of it works when you're 4000km away in another country with only a handheld to access the servers.

I think it should probably company policy at a financial institution not to allow someone in a different control on a handheld device to access the servers.

I use layered security (in the sense of servers) with a password lifetime of 10 days. I deal with servers daily and the issue of compromise has been twice in on firewall containers/servers which was fine as the systems in place found it, found the issue with the net facing software and I fixed it. Practicality doesn't mean no security.

Re: Innovation Nation: WePay is the anti-PayPal

#50

Post by jscore »

Sounds like a play from the book REWORK: Mobilize against an enemy (or something like that).

It's just words; WePay is not another competing product, it's basically a bunch of features that PayPal can implement and with >80M accounts, they can easily kill it.

Say what you want about PayPal, but each one of you should read PayPal Wars to learn the inside story of how PayPal worked and competed. They basically pioneered the person-to-person payment service and faced a myriad of issues before eventually selling to eBay.

Post reply on HN