4 ms·

I know the "logic" behind modern low password length limits for services like Paypal. Too many of their users are literally incapable of remembering their passw

I know the "logic" behind modern low password length limits for services like Paypal. Too many of their users are literally incapable of remembering their passwords and call/e-mail them bitching about how they're entering the right password and their account won't let them in and now they can't get to their money and bogus threats of legal action. So they encourage weak passwords and try to handle security on their side by flagging accounts for any reason and using 2FA. Recently they started requiring one number or special character in passwords, which puts them about 15 years behind the times when it comes to password policies.

katsura 7y ago
If you forget your password then there is basically no way of contacting them. I lost my 2FA phone number, and wanted to know if there is anything I can do to get my account back? There is no contact form, no customer chat/phone number, and their issue tracker is only available if you log in. Finally, I found an email address on some other website, contacted them, then I got an email saying they answered my issue, and if I'm satisfied with their answer? Of course, I never was able to see their answer because I cannot log in to open the issue tracker. So, in the end I just gave up.
- pteraspidomorph 7y ago
  Oh, I remember having that problem a long time ago! It's still like that? I'm pretty sure this was more than 10 years ago for me. I just abandoned that account.
jeromegv 7y ago
Their 2FA policy is awful, SMS or nothing. At least that's the case in Canada (I heard it might be different in other regions).
- Thorrez 7y ago
  Just now I (in the US) added TOTP (Google Authenticator) 2FA, and removed my old SMS 2FA. It does seem a bit laggy but I was able to do it and log in.
  - Doubl 7y ago
    Yes I (in eu) only recently added 2FA and I'm using Google authenticator
  - efreak 7y ago
    PayPal allows directly adding totp now? When I added 2fa, I had to use a python script that emulates the stupid Symantec software they were using in order to get the secret; it instead gave you a code to give the Symantec app, which prevented you from using 3rd party apps.
    - Thorrez 7y ago
      Yes, I think it's somewhat recent. The previous time I checked it didn't let me, now it does. I found this from 6 months ago mentioning it might only be US accounts[1], and this from March[2]. [1] https://www.reddit.com/r/YouShouldKnow/comments/a59knq/ysk_paypal_now_allows_2factor_authentication_from/ https://www.reddit.com/r/YouShouldKnow/comments/a59knq/ysk_p... [2] https://benbrian.net/authenticator-app-support-in-paypal-finally/ https://benbrian.net/authenticator-app-support-in-paypal-fin...

katsura 7y ago

If you forget your password then there is basically no way of contacting them. I lost my 2FA phone number, and wanted to know if there is anything I can do to get my account back? There is no contact form, no customer chat/phone number, and their issue tracker is only available if you log in. Finally, I found an email address on some other website, contacted them, then I got an email saying they answered my issue, and if I'm satisfied with their answer? Of course, I never was able to see their answer because I cannot log in to open the issue tracker. So, in the end I just gave up.

pteraspidomorph 7y ago
Oh, I remember having that problem a long time ago! It's still like that? I'm pretty sure this was more than 10 years ago for me. I just abandoned that account.

jeromegv 7y ago

Their 2FA policy is awful, SMS or nothing. At least that's the case in Canada (I heard it might be different in other regions).

Thorrez 7y ago
Just now I (in the US) added TOTP (Google Authenticator) 2FA, and removed my old SMS 2FA. It does seem a bit laggy but I was able to do it and log in.
- Doubl 7y ago
  Yes I (in eu) only recently added 2FA and I'm using Google authenticator
- efreak 7y ago
  PayPal allows directly adding totp now? When I added 2fa, I had to use a python script that emulates the stupid Symantec software they were using in order to get the secret; it instead gave you a code to give the Symantec app, which prevented you from using 3rd party apps.
  - Thorrez 7y ago
    Yes, I think it's somewhat recent. The previous time I checked it didn't let me, now it does. I found this from 6 months ago mentioning it might only be US accounts[1], and this from March[2]. [1] https://www.reddit.com/r/YouShouldKnow/comments/a59knq/ysk_paypal_now_allows_2factor_authentication_from/ https://www.reddit.com/r/YouShouldKnow/comments/a59knq/ysk_p... [2] https://benbrian.net/authenticator-app-support-in-paypal-finally/ https://benbrian.net/authenticator-app-support-in-paypal-fin...