3 ms·

And I'd agree. Their lawyers probably made them do it.

• londons_explore 4y ago
  As a bank, your agreements are with the actual humans, and your duty is to protect their money. The fact that you choose to use usernames and passwords to authenticate humans is your choice. It is well known that humans don't secure passwords well (reuse, writing on postit notes, etc). As a bank, any losses attributable to someone evil finding/guessing a password are your own. That's why credential stuffing counts as a breach. Even though most banks will try to tell you that it's your responsibility to protect your passwords, the law doesn't see it that way.
  • bob1029 4y ago
    > As a bank Technically, Paypal is not regulated as a bank (per FDIC). That said, they certainly have immense fiduciary & privacy duty to their customers considering the format of their business.
    • moxli 4y ago
      > Technically, Paypal is not regulated as a bank PayPal has a banking license in Luxembourg which allows them to operate in Europe. I guess it depends on the region/country.
  • boring_twenties 4y ago
    Well that sucks for those of us who can use passwords effectively, instead we all get this SMS 2FA crap which is both more annoying and less secure.
    • fmajid 4y ago
      PayPal now supports FIDO U2F keys like the Yubikey (very recent addition, only a month or two). Unfortunately, they do it wrong and only allow to register a single key, which means you will be locked out if you break or lose it.