6 ms·

If I read this correctly this is a case of credential stuffing meaning the breach isn't really related to PayPal as much as people had credentials stolen other

If I read this correctly this is a case of credential stuffing meaning the breach isn't really related to PayPal as much as people had credentials stolen other places and had used the same ones at PayPal. Maybe PayPal needs to enforce 2FA if they don't already do. 2FA SMS factor should be discontinued for any financial or otherwise important/sensitive service as SIM jacking is apparently quite easy. But anyone with properly secured accounts seems to not have been affected by this breach.

kennydude 4y ago
PayPal, at least for me, forces FaceID and an SMS 2FA to access it at all which is crazy. Probably would be great if they moved away from SMS though :(
- perch56 4y ago
  You can enable or disable FaceI ID from the settings. Just curious, why is using Face ID crazy?
toastal 4y ago
I've had to ignore my account. I originally want TOTP 2FA, but it wasn't an option. I set up 2FA through Google Voice because my number changes frequently. A few years later I tried to log in and Google Voice has been blocked as a 2FA option for SMS. I go to seek support and you, circularly, need to be authenticated to get support for authentication, and asking support on Twitter got me banned from their account. The last 2 years directly emailed all independent sellers to set up alternative payment options to not go through such a careless operation.
- gorbachev 4y ago
  Same. Can not log into my Paypal account any more, because they don't accept Google Voice numbers as valid phone numbers any longer.
- eloff 4y ago
  Always have a backup payment processor. PayPal especially, but even Stripe will shut you down or freeze your balance with little recourse. Amazon killed my parents business by just sheer incompetence and support took a year to get partially back to operation, by which time it was over. Facebook incorrectly nuked my wife’s Instagram account and hopes of becoming an influencer. No recourse. Google can ban your account with your email with no recourse. You lose your email history, contacts, documents, etc with no way to login to a myriad of online services. I’m really low on patience with the big tech companies. I hope the government reins them in.
  - bipson 4y ago
    As much as I have sympathy for the pain (besides the influencer thing) - what exactly do you expect from the government here? And I say this as European, I mean, we at least have some regulations...
    - Brian_K_White 4y ago
      There's lot's of things government could do. Start with codifying some concepts that define when a service is responsible for having too much impact on a user's life, and attach responsibility to that, instead of just 'private company, do anything you want' It's not an accurate or sufficient or desirable representation of reality to allow these various big companies to actively seek out having you entrust them with parts of various critical paths in your life, and then be able to nuke those with no protection or recourse on your part. In 1975 when no one had an email address or a cell phone, and neither were required to do anything in life, it was fine to treat them like luxiries that if you lose them, so what? That was still true but just a bit less so a few years later, and it's just been gradually becoming less so every year, and by now, it is simply not true at all. It should essentially be illegal for a service provider to completely break some of these services without some sort of graceful shutdown or hand-off process, in the same way and for the same reasons it's illegal to shut off electricity and gas and phone in a lot of cases even after the subscriber has failed to pay. They get shut off eventually of course, but there are exceptions and ways for the subscriber to fight, and they are mandated by the government, not out of the goodness of the power companies hearts. Basically the power company isn't allowed to just let grandma freeze in the winter even if she fails to pay. It's not unfair to the power company. The investors in the power company are free to be in some other business if they don't like those terms. Today, an email account should not be treated the same way as a spotify account, even if you're not even charging money for the service. If you don't like that, you don't have to offer an email service at all. The requirement I imagine is some minimal level of continued function enough to complete other account management procedures, which means being able to both receive and send at least some emails. Maybe a limited amount, maybe limited attachment size etc, but enough to at least send the one or few emails from the previously recognized address to other parties as part of the proof of identity to direct them to a new address. This even in cases where the account was terminated for supposed cause like illegal activity. This means that one of the other things government can do is recognize that exception for liability. The government can determine not to penalize a service provider or allow others to sue them for having one of these accounts active at that limited level of functionality if the account sends someone a phising email or something. Or maybe the procedure is the accounts do stop functioning so no email is passed, but, it can still be used by the owner to contact the service provider to invoke some kind of recourse procedure 9f they need it. So the spammer is blocked but mom can still jump through hoops and eventually regain access, including old mails and maybe even including unread received mails while it was down. There are all kinds of things a government can do, and fully fairly and defensibly and officially, just by codifying some principles. What do I expect from the government? Something. They can absolutely do something. It's work to work out exactly what and how and develop some consistent rational legal theory to base it on, but that it literally their job is to to exactly that.
- vorpalhex 4y ago
  You should be able to have them close your account by sending them a formal letter.
- latchkey 4y ago
  I use TOTP on my Paypal account. https://www.paypal.com/us/cshelp/article/what-is-2-step-verification-and-how-do-i-turn-it-on-or-off-help167 https://www.paypal.com/us/cshelp/article/what-is-2-step-veri...
- compsciphd 4y ago
  paypal works fine with my google voice account. get sms's and copy/paste them into the field.
brador 4y ago
I don't like the term credential stuffing. It is inaccurate by definition. Stuffing - "a material or substance used to stuff something". What alternative names could we use? Credential attack? Credential reuse attack? Secondary credential attack?
- doubled112 4y ago
  It's a verb. to stuff - to push something into a small space, often quickly or in a careless way https://dictionary.cambridge.org/dictionary/english/stuff https://dictionary.cambridge.org/dictionary/english/stuff As in "I am going to try these credentials quickly and carelessly and see if they get me in."
- abathur 4y ago
  Credential spray-n-pray
  - chatmasta 4y ago
    Credential stuffing and password spraying are two distinct classes of attack. [0] Stuffing is when you try passwords for certain users (hoping they re-used a known password), and spraying is when you try common passwords for every username. [0] https://security.stackexchange.com/questions/209266/what-are-the-differences-between-credential-stuffing-and-password-spraying https://security.stackexchange.com/questions/209266/what-are...
digitallyfree 4y ago
I don't use PayPal but was told by a user that their 2FA SMS system isn't really a second factor, but rather it replaces the password. Basically when you log in (with username only) it sends you an SMS code and you enter the code to log in with no password necessary. So basically this becomes a single factor. I hope they got rid of this feature now and went back to "traditional" 2FA requiring both a password and code.
latchkey 4y ago
https://www.paypal.com/us/cshelp/article/what-is-2-step-verification-and-how-do-i-turn-it-on-or-off-help167 https://www.paypal.com/us/cshelp/article/what-is-2-step-veri...

kennydude 4y ago

PayPal, at least for me, forces FaceID and an SMS 2FA to access it at all which is crazy. Probably would be great if they moved away from SMS though :(

perch56 4y ago
You can enable or disable FaceI ID from the settings. Just curious, why is using Face ID crazy?

toastal 4y ago

I've had to ignore my account. I originally want TOTP 2FA, but it wasn't an option. I set up 2FA through Google Voice because my number changes frequently. A few years later I tried to log in and Google Voice has been blocked as a 2FA option for SMS. I go to seek support and you, circularly, need to be authenticated to get support for authentication, and asking support on Twitter got me banned from their account. The last 2 years directly emailed all independent sellers to set up alternative payment options to not go through such a careless operation.

gorbachev 4y ago
Same. Can not log into my Paypal account any more, because they don't accept Google Voice numbers as valid phone numbers any longer.
eloff 4y ago
Always have a backup payment processor. PayPal especially, but even Stripe will shut you down or freeze your balance with little recourse. Amazon killed my parents business by just sheer incompetence and support took a year to get partially back to operation, by which time it was over. Facebook incorrectly nuked my wife’s Instagram account and hopes of becoming an influencer. No recourse. Google can ban your account with your email with no recourse. You lose your email history, contacts, documents, etc with no way to login to a myriad of online services. I’m really low on patience with the big tech companies. I hope the government reins them in.
- bipson 4y ago
  As much as I have sympathy for the pain (besides the influencer thing) - what exactly do you expect from the government here? And I say this as European, I mean, we at least have some regulations...
  - Brian_K_White 4y ago
    There's lot's of things government could do. Start with codifying some concepts that define when a service is responsible for having too much impact on a user's life, and attach responsibility to that, instead of just 'private company, do anything you want' It's not an accurate or sufficient or desirable representation of reality to allow these various big companies to actively seek out having you entrust them with parts of various critical paths in your life, and then be able to nuke those with no protection or recourse on your part. In 1975 when no one had an email address or a cell phone, and neither were required to do anything in life, it was fine to treat them like luxiries that if you lose them, so what? That was still true but just a bit less so a few years later, and it's just been gradually becoming less so every year, and by now, it is simply not true at all. It should essentially be illegal for a service provider to completely break some of these services without some sort of graceful shutdown or hand-off process, in the same way and for the same reasons it's illegal to shut off electricity and gas and phone in a lot of cases even after the subscriber has failed to pay. They get shut off eventually of course, but there are exceptions and ways for the subscriber to fight, and they are mandated by the government, not out of the goodness of the power companies hearts. Basically the power company isn't allowed to just let grandma freeze in the winter even if she fails to pay. It's not unfair to the power company. The investors in the power company are free to be in some other business if they don't like those terms. Today, an email account should not be treated the same way as a spotify account, even if you're not even charging money for the service. If you don't like that, you don't have to offer an email service at all. The requirement I imagine is some minimal level of continued function enough to complete other account management procedures, which means being able to both receive and send at least some emails. Maybe a limited amount, maybe limited attachment size etc, but enough to at least send the one or few emails from the previously recognized address to other parties as part of the proof of identity to direct them to a new address. This even in cases where the account was terminated for supposed cause like illegal activity. This means that one of the other things government can do is recognize that exception for liability. The government can determine not to penalize a service provider or allow others to sue them for having one of these accounts active at that limited level of functionality if the account sends someone a phising email or something. Or maybe the procedure is the accounts do stop functioning so no email is passed, but, it can still be used by the owner to contact the service provider to invoke some kind of recourse procedure 9f they need it. So the spammer is blocked but mom can still jump through hoops and eventually regain access, including old mails and maybe even including unread received mails while it was down. There are all kinds of things a government can do, and fully fairly and defensibly and officially, just by codifying some principles. What do I expect from the government? Something. They can absolutely do something. It's work to work out exactly what and how and develop some consistent rational legal theory to base it on, but that it literally their job is to to exactly that.
vorpalhex 4y ago
You should be able to have them close your account by sending them a formal letter.
latchkey 4y ago
I use TOTP on my Paypal account. https://www.paypal.com/us/cshelp/article/what-is-2-step-verification-and-how-do-i-turn-it-on-or-off-help167 https://www.paypal.com/us/cshelp/article/what-is-2-step-veri...
compsciphd 4y ago
paypal works fine with my google voice account. get sms's and copy/paste them into the field.

brador 4y ago

I don't like the term credential stuffing. It is inaccurate by definition. Stuffing - "a material or substance used to stuff something". What alternative names could we use? Credential attack? Credential reuse attack? Secondary credential attack?

doubled112 4y ago
It's a verb. to stuff - to push something into a small space, often quickly or in a careless way https://dictionary.cambridge.org/dictionary/english/stuff https://dictionary.cambridge.org/dictionary/english/stuff As in "I am going to try these credentials quickly and carelessly and see if they get me in."
abathur 4y ago
Credential spray-n-pray
- chatmasta 4y ago
  Credential stuffing and password spraying are two distinct classes of attack. [0] Stuffing is when you try passwords for certain users (hoping they re-used a known password), and spraying is when you try common passwords for every username. [0] https://security.stackexchange.com/questions/209266/what-are-the-differences-between-credential-stuffing-and-password-spraying https://security.stackexchange.com/questions/209266/what-are...

digitallyfree 4y ago

I don't use PayPal but was told by a user that their 2FA SMS system isn't really a second factor, but rather it replaces the password. Basically when you log in (with username only) it sends you an SMS code and you enter the code to log in with no password necessary. So basically this becomes a single factor. I hope they got rid of this feature now and went back to "traditional" 2FA requiring both a password and code.

latchkey 4y ago

https://www.paypal.com/us/cshelp/article/what-is-2-step-verification-and-how-do-i-turn-it-on-or-off-help167 https://www.paypal.com/us/cshelp/article/what-is-2-step-veri...