3 ms·
Krebs talks about the supposed problem, but fails to point out a solution. Without knowledge based auth, what is PayPal supposed to say when someone calls them
by ryanlol 11y ago
Krebs talks about the supposed problem, but fails to point out a solution.
Without knowledge based auth, what is PayPal supposed to say when someone calls them and says that they lost their phone and therefore access to their email and can't remember their password?
Right now, to social engineer someones account (Like Krebs's in this case, I've personally listened to the call he's talking about here) you need almost all the information that's on the account already (besides payment history, which could be a big deal to someone I guess).
A detail worth noting is that stealing someones PayPal account in this manner doesn't allow you to steal money from them.
- pfg 11y agoImprove the UI for things like recovery codes in ways that essentially force users to print them. One thing I've seen out there is asking the user for a recovery code during the login process a few days after enabling 2FA (with an option to skip it a few times, and generate new recovery codes if the user failed to print them the first time.) Add a waiting period for affected customers, let's say a week or a month. During this period, try contacting the user on all known communication channels (email, SMS, push, robocalls; Coinbase does this quite well for Vault transactions) to inform them about the impending account change. It's certainly not the easiest thing to get right, but it's not asking for too much from a high-profile target like PayPal.