5 ms·

Another reason to remove your bank details is one-time login codes. PayPal is testing a feature that lets users log in using a 6-digit code sent over SMS, bypas

Another reason to remove your bank details is one-time login codes. PayPal is testing a feature that lets users log in using a 6-digit code sent over SMS, bypassing both password and TOTP/hardware authenticator, and the feature can’t be disabled. I refuse to use SMS as a second factor, so using it as the _only_ factor for what is effectively a bank account is absolutely batshit insane. They’ve completely lost their mind. https://www.paypal-community.com/t5/Managing-Account/How-do-I-disable-one-time-codes/td-p/2835147 https://www.paypal-community.com/t5/Managing-Account/How-do-...

b112 4y ago
Like google, they badly want your mobile number, for tracking and additional Pii/identity purposes. This is what it boils down to, not security. I cannot log in without a phone any more to paypal. At all. My mobile phone doesn't even work on my property, I live in a rural area, with no cell phone service for 1km. I have a phone. Email. I could set up 2fa via the internet. Nope. Because of course, cell phones are always reachable?!
- AlexandrB 4y ago
  > Because of course, cell phones are always reachable?! I don't get what you're supposed to do when travelling? Incur international texting charges?
  - shortcake27 4y ago
    People enforcing SMS login/MFA don't care. As someone who's frequently away my home country, I often find it difficult to log into services that are necessary for my survival (like banking), let alone regular apps which more and more frequently are ditching email address signup in favour of mobile numbers (BeReal, Artifact etc). At _minimum_ I need to swap the physical SIM card in my phone which for some reason breaks iMessage for a few days every time I do it. However roaming doesn't work in every country, so, sometimes I'm just fucked. eSIM could make the first problem easier, but it actually makes it harder. With a physical SIM, if I lose or break my phone I still have my home SIM so I can still access SMS on a new phone. With eSIM, if I lose or break my phone my home SIM is lost along with it. No problem, just provision a new eSIM, that's the whole point right? Well, one of my telcos doesn't support eSIM yet, but they enforce SMS MFA, so I can see where this is going. I'll only be able to provision a new sim if I have access to the old one. Absolutely braindead. Another of my telcos doesn't allow eSIMs to be provisioned digitally; you need to obtain a physical QR code from a shop or have it posted to an address within the country (they won't send one overseas). It's actually unbelievable how telcos have managed to make eSIMs less convenient than physical SIMs. Anyway, this means I need to return to my home country if I lose or break my phone because without SMS I won't be able to access banking. This is beyond infuriating, but I'm an edge case so no one cares. It should be illegal for critical services, banking/finance/govt etc to depend on SMS.
  - stefandesu 4y ago
    Do you get charged for _receiving_ texts when traveling internationally? Maybe it's different here in Europe, but as far as I know, I only get charged for active things - sending texts, making calls, accepting calls. Passive things - receiving texts, getting calls (but not accepting them) - do not incur any charges.
    - shortcake27 4y ago
      It depends on the telco. I have a telco that requires me to have an active roaming plan to receive SMS/calls. Which is about $5 a day from memory (I don’t use it overseas). Another telco has no requirements and no charge to receive SMS/calls overseas as long as the number is active.
- kube-system 4y ago
  > I cannot log in without a phone any more to paypal. I use TOTP with my account just fine?
  - Kwpolska 4y ago
    I suppose they might have an old account that does not have a phone number attached to it and PayPal won’t let them log in without providing one?
- nicolaslem 4y ago
  Receiving SMS via the Internet is possible by enabling WiFi Calling. It is a game changer for locations with good wired Internet but poor cell coverage. Of course it doesn't change the fact that using SMS for security should be illegal.
- Psychlist 4y ago
  I have an old-ish paypal account with no phone number attached and while they prompt me every time I have not supplied one. There was a period of a month or two a couple of years ago when I couldn't use paypal at all without providing a phone, but I was quite willing to live without paypal. Mysteriously when I tried to log in a few months later it let me.
- deleted 4y ago
  [deleted]
account42 4y ago
That's weird - PayPal has been doing the opposite to me: Making me do both reCatptcha and hCaptcha in addition to my password and TOTP. Seriously, who the fuck needs not one captcha after valid login information but fucking two.

b112 4y ago

Like google, they badly want your mobile number, for tracking and additional Pii/identity purposes. This is what it boils down to, not security. I cannot log in without a phone any more to paypal. At all. My mobile phone doesn't even work on my property, I live in a rural area, with no cell phone service for 1km. I have a phone. Email. I could set up 2fa via the internet. Nope. Because of course, cell phones are always reachable?!

AlexandrB 4y ago
> Because of course, cell phones are always reachable?! I don't get what you're supposed to do when travelling? Incur international texting charges?
- shortcake27 4y ago
  People enforcing SMS login/MFA don't care. As someone who's frequently away my home country, I often find it difficult to log into services that are necessary for my survival (like banking), let alone regular apps which more and more frequently are ditching email address signup in favour of mobile numbers (BeReal, Artifact etc). At _minimum_ I need to swap the physical SIM card in my phone which for some reason breaks iMessage for a few days every time I do it. However roaming doesn't work in every country, so, sometimes I'm just fucked. eSIM could make the first problem easier, but it actually makes it harder. With a physical SIM, if I lose or break my phone I still have my home SIM so I can still access SMS on a new phone. With eSIM, if I lose or break my phone my home SIM is lost along with it. No problem, just provision a new eSIM, that's the whole point right? Well, one of my telcos doesn't support eSIM yet, but they enforce SMS MFA, so I can see where this is going. I'll only be able to provision a new sim if I have access to the old one. Absolutely braindead. Another of my telcos doesn't allow eSIMs to be provisioned digitally; you need to obtain a physical QR code from a shop or have it posted to an address within the country (they won't send one overseas). It's actually unbelievable how telcos have managed to make eSIMs less convenient than physical SIMs. Anyway, this means I need to return to my home country if I lose or break my phone because without SMS I won't be able to access banking. This is beyond infuriating, but I'm an edge case so no one cares. It should be illegal for critical services, banking/finance/govt etc to depend on SMS.
- stefandesu 4y ago
  Do you get charged for _receiving_ texts when traveling internationally? Maybe it's different here in Europe, but as far as I know, I only get charged for active things - sending texts, making calls, accepting calls. Passive things - receiving texts, getting calls (but not accepting them) - do not incur any charges.
  - shortcake27 4y ago
    It depends on the telco. I have a telco that requires me to have an active roaming plan to receive SMS/calls. Which is about $5 a day from memory (I don’t use it overseas). Another telco has no requirements and no charge to receive SMS/calls overseas as long as the number is active.
kube-system 4y ago
> I cannot log in without a phone any more to paypal. I use TOTP with my account just fine?
- Kwpolska 4y ago
  I suppose they might have an old account that does not have a phone number attached to it and PayPal won’t let them log in without providing one?
nicolaslem 4y ago
Receiving SMS via the Internet is possible by enabling WiFi Calling. It is a game changer for locations with good wired Internet but poor cell coverage. Of course it doesn't change the fact that using SMS for security should be illegal.
Psychlist 4y ago
I have an old-ish paypal account with no phone number attached and while they prompt me every time I have not supplied one. There was a period of a month or two a couple of years ago when I couldn't use paypal at all without providing a phone, but I was quite willing to live without paypal. Mysteriously when I tried to log in a few months later it let me.
deleted 4y ago
[deleted]

account42 4y ago

That's weird - PayPal has been doing the opposite to me: Making me do both reCatptcha and hCaptcha in addition to my password and TOTP. Seriously, who the fuck needs not one captcha after valid login information but fucking two.