4 ms·
Unfortunately, it seems that Paypal requires a phone number regardless of 2FA method, and there is indeed no way to disable this insane feature. Seems like may
by insanitybit 4y ago
Unfortunately, it seems that Paypal requires a phone number regardless of 2FA method, and there is indeed no way to disable this insane feature.
Seems like maybe a good idea for a class action lawsuit? I'm not sure what to do about that. A company shouldn't be able to do this and still meet compliance obligations.
I'll have to delete my account, unfortunately.
edit:
1. I didn't give Paypal my phone number so that they could use it for this. I gave it to them for banking purposes only. I wonder if this constitutes a GDPR violation?
2. I wonder if contacting their auditors would do anything.
3. Maybe email some of the politicians who care about this stuff - Ron Wyden, Elizabeth Warren?
- KingOfCoders 4y agoKey thing to understand is that auditors are paid by the company + often have side business with the company.
- insanitybit 4y agoYep, I have gone through SOC2 for a company I run, definitely aware. The idea is just to add pressure.
- hutattedonmyarm 4y agoPayPal frequently texts me an additional code either after I plugged in my OTP 2FA code or instead of it. Their 2FA implementation is… creative
- trollied 4y agoA class action lawsuit because you don't like the way that a private company, one that you are not forced to use, has designed functionality? Bit of a stretch...
- wizzwizz4 4y agoGDPR Article 5, 1(b): > Personal data shall be: […] collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
- thayne 4y agoSo it would have to come from someone in the EU.
- insanitybit 4y agoThe GDPR applies in the US but I do think that PayPal is likely only using US numbers for this "feature" because the EU is much more aggressive about protecting users.
- wizzwizz4 4y agoThe GDPR actually only applies in the EU. You're probably thinking of the CCPA which applies worldwide.
- insanitybit 4y agoAh, yeah you're right, I got jumbled.
- zeeZ 4y agoThe GDPR applies to: 1. a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or 2. a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.
- wizzwizz4 4y agoYup! Something needs to be in the EU for the law to apply. It (sadly, imo) doesn't apply to EU citizens resident in, say, Texas.
- insanitybit 4y agoI agree, it is a bit of a stretch. Just brainstorming, not a lawyer. I think you'd have to either make a GDPR case or otherwise get a bunch of users together who have been targeted / attacked and make a case for PayPal not meeting their obligation to protect users/ making users think they are safer than they are (because they offer 2FA but it can be bypassed).
- kuroguro 4y agoIt was also possible to bypass the "give us your phone" nag screen by messing with the url after login. I've been doing it for years now. I think they "fixed" it sometime this year and I had to give them my number :<
- okasaki 4y agoThis still works for ebay. I get a prompt for a phone number that I can't cancel out of, but I can close that tab and open ebay and I'm logged in just fine.
- nerdponx 4y agoPhone number data is looking great! Here's your bonus.
- Strom 4y agoIt's still possible to "mess with the URL" .. you just go type paypal.com again and it won't show the phone number request the second time. So this number request seems to be part of the login flow, but the session cookie is created regardless. My PayPal account still doesn't have a phone number associated with it.
- bvrmn 4y agoIn what parallel universe auditors make anything meaningful? It's like buying an indulgence and have someone to delegate risks to.
- insanitybit 4y agoCompanies have to get certified, especially ones who handle payments. An auditor can absolutely push for better controls. Will they? Or will Paypal care? That I do not know, but getting pressure from multiple angles can't hurt.
- MichaelZuo 4y agoHow much would the 'pressure from multiple angles' cost? After all a free lunch doesn't exist.
- joeyh 4y agoI have never given paypal my phone number, and can still log in with password. (This August it would refuse to let me finish logging in without setting up a phone number. I discovered that getting a friend to send me a paypal requst for $1 would get around that requirement.)