5 ms·

> “We reported this in February 2019 to PayPal via HackerOne,” they say. “After an initial rejection and several discussions, PayPal paid a bug bounty of $4,400

> “We reported this in February 2019 to PayPal via HackerOne,” they say. “After an initial rejection and several discussions, PayPal paid a bug bounty of $4,400.” The pair have not heard from PayPal, they say, since April 2019. But this week “tried and could still use the virtual credit card for online payments.” That means, they told me, “the bug has not been fixed.” > But in terms of the Fenske and Mayer disclosure, the researchers told me that this is not fixed, even after PayPal’s “mitigation” statement. If Paypal has known about it for a year and it still isn't fixed, then it means that either 1. Paypal didn't understand the bug report and "fixed" something else 2. Paypal understood the bug report, didn't fix it, and is trying to save face. Either one of those sounds pretty bad for their security policy...

rocqua 7y ago
As for paypal's security policy, note that they have a maximum password length of 24 characters, and routinely send people e-mails with a big 'log-in' link. These are both bad practice. The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords. The sending of log-in links makes people much easier to phish, since people are used to clicking on a link in e-mail and then entering their credentials on the site.
- beamatronic 7y ago
  I’ve been telling friends and family, for at least 10 years, maybe more, the only safe way to go to PayPal, is to type the address into the browser yourself, starting with HTTPS.
  - judge2020 7y ago
    Paypal is preloaded, so you're not required to start with HTTPS. https://hstspreload.org/?domain=paypal.com https://hstspreload.org/?domain=paypal.com
    - Retric 7y ago
      While that includes Chrome, Safari, Firefox, IE, and Edge that’s not every browser and it’s a really bad habit to get into. Especially as the preload lists are yet another attack surface.
  - rocqua 7y ago
    It would be so nice if paypal actually did the same thing. Instead they are training their users to just click on that link in the e-mail.
- humaniania 7y ago
  In what way does a password length limit suggest plain-text storage?
  - inetknght 7y ago
    In the same way that the best one-way hash algorithms can accept arbitrarily large inputs and produce a constant-sized digest.
    - SilasX 7y ago
      True but I thought you’d want to have some size limit regardless, if for no other reason than choking up the connection with a huge one.
      - inetknght 7y ago
        Sure, but "some size limit" can be as big as 500 or 1000 bytes. "Choking up the connection" won't be for very long at all. Even on a 2400 baud modem, you're talking only a few seconds to transmit a kilobyte of password. On modern cell networks or especially broadband connections, you pretty much won't choke the connection at all with a 1000-character password.
        johndough 7y ago
        To add to that, the login page (which contains nothing but two fields for email and password) weighs in at 1.5 MB, so bandwidth clearly is not an issue for PayPal.
        SilasX 7y ago
        Which still doesn't refute the need for a limit, and a large part of why I didn't defend a 24-character limit.
        SilasX 7y ago
        I agree, which was I was only criticizing the point against "there should not be a limit at all" -- I don't know what you're disagreeing with that I said.
- johndough 7y ago
  Recently, I received an E-Mail which looked a lot like a phishing attempt. It contained a link to sign in to "paypal.com", but when hovering over the link, it was revealed to be something like "https://epl.paypal-communication.com/T/ve3648d90e0f976ec10e4695329f313e/365c2df474b950c0690f92453d" https://epl.paypal-communication.com/T/ve3648d90e0f976ec10e4.... Really stupid idea to make users believe that "https://random.paypal-suffix.com" https://random.paypal-suffix.com" might be legit. I wonder why domains like "paypal-comunication.com" are not registered for nefarious purposes yet.
  - numakerg 7y ago
    Here's a sample of different "clickable" URLS you can find in an email from the NSLSC, the Canadian student loans department: click.csnpenslsc.ca csnpe-nslsc.cibletudes-canlearn.ca nslsc.ca app.studentlending.ca protege-secure.csnpe-nslsc.canada.ca Important to note that this is a department that manages tens to hundreds of thousands in loans per user, asked users to recreate an account multiple times, on a variety of domains, by providing critical personal info (including SIN), and sent threatening notices demanding payment for nebulous charges that later resolved themselves.
- Spooky23 7y ago
  > The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords No, it limits the effectiveness of passphrases. It does not suggest or not suggest plaintext storage.

rocqua 7y ago

As for paypal's security policy, note that they have a maximum password length of 24 characters, and routinely send people e-mails with a big 'log-in' link. These are both bad practice. The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords. The sending of log-in links makes people much easier to phish, since people are used to clicking on a link in e-mail and then entering their credentials on the site.

beamatronic 7y ago
I’ve been telling friends and family, for at least 10 years, maybe more, the only safe way to go to PayPal, is to type the address into the browser yourself, starting with HTTPS.
- judge2020 7y ago
  Paypal is preloaded, so you're not required to start with HTTPS. https://hstspreload.org/?domain=paypal.com https://hstspreload.org/?domain=paypal.com
  - Retric 7y ago
    While that includes Chrome, Safari, Firefox, IE, and Edge that’s not every browser and it’s a really bad habit to get into. Especially as the preload lists are yet another attack surface.
- rocqua 7y ago
  It would be so nice if paypal actually did the same thing. Instead they are training their users to just click on that link in the e-mail.
humaniania 7y ago
In what way does a password length limit suggest plain-text storage?
- inetknght 7y ago
  In the same way that the best one-way hash algorithms can accept arbitrarily large inputs and produce a constant-sized digest.
  - SilasX 7y ago
    True but I thought you’d want to have some size limit regardless, if for no other reason than choking up the connection with a huge one.
    - inetknght 7y ago
      Sure, but "some size limit" can be as big as 500 or 1000 bytes. "Choking up the connection" won't be for very long at all. Even on a 2400 baud modem, you're talking only a few seconds to transmit a kilobyte of password. On modern cell networks or especially broadband connections, you pretty much won't choke the connection at all with a 1000-character password.
      - johndough 7y ago
        To add to that, the login page (which contains nothing but two fields for email and password) weighs in at 1.5 MB, so bandwidth clearly is not an issue for PayPal.
        SilasX 7y ago
        Which still doesn't refute the need for a limit, and a large part of why I didn't defend a 24-character limit.
      - SilasX 7y ago
        I agree, which was I was only criticizing the point against "there should not be a limit at all" -- I don't know what you're disagreeing with that I said.
johndough 7y ago
Recently, I received an E-Mail which looked a lot like a phishing attempt. It contained a link to sign in to "paypal.com", but when hovering over the link, it was revealed to be something like "https://epl.paypal-communication.com/T/ve3648d90e0f976ec10e4695329f313e/365c2df474b950c0690f92453d" https://epl.paypal-communication.com/T/ve3648d90e0f976ec10e4.... Really stupid idea to make users believe that "https://random.paypal-suffix.com" https://random.paypal-suffix.com" might be legit. I wonder why domains like "paypal-comunication.com" are not registered for nefarious purposes yet.
- numakerg 7y ago
  Here's a sample of different "clickable" URLS you can find in an email from the NSLSC, the Canadian student loans department: click.csnpenslsc.ca csnpe-nslsc.cibletudes-canlearn.ca nslsc.ca app.studentlending.ca protege-secure.csnpe-nslsc.canada.ca Important to note that this is a department that manages tens to hundreds of thousands in loans per user, asked users to recreate an account multiple times, on a variety of domains, by providing critical personal info (including SIN), and sent threatening notices demanding payment for nebulous charges that later resolved themselves.
Spooky23 7y ago
> The password length limit reduces the quality of passwords, and suggests plain-text storage of passwords No, it limits the effectiveness of passphrases. It does not suggest or not suggest plaintext storage.