5 ms·
Step one for PayPal would be to always provide a reason when they take action, for all users. Every bad experience I have had with PayPal began with them doing
by njloof 14y ago
Step one for PayPal would be to always provide a reason when they take action, for all users. Every bad experience I have had with PayPal began with them doing something negative, and never explaining why they did it. I have had methods of payment locked out, I have had funds not released, I have been told I could not make an instant payment, and not once was I given a reason why.
- rhizome 14y agoPayPal is second only to the TSA in reflecting the futility of asking for such things.
- wpietri 14y agoI agree that they should always try to give you a reason. But that's not as easy as it sounds. Put yourself in the position of somebody who is trying to commit massive fraud. E.g., by purporting to sell a bunch of stuff on-line. Every bit of information you have about how PayPal combats fraud is helpful. Every time PayPal gives somebody a reason, it helps fraudsters avoid that particular wall or trap, letting them probe the defenses elsewhere. It's a hard problem. PayPal solved it the wrong way, but they'll never get to full transparency.
- Karunamon 14y ago>it helps fraudsters avoid that particular wall or trap, letting them probe the defenses elsewhere. Couldn't you say make the same argument of proprietary vs open source software?
- eli 14y agoYes. Does that make it untrue?
- Karunamon 14y agoNot at all, but wouldn't the benefits outweigh the risks? Security by obscurity really isn't security at all.
- wpietri 14y agoSecurity by obscurity is very, very effective in the short to medium term, especially you're paying attention to people hacking around it and are continuously evolving your defenses. Also, they've intentionally chosen a domain where full security isn't possible, mostly due to circumstances outside their control. Remember, they captured a huge new market mainly through the sophistication of their anti-fraud systems. So security through obscurity has to remain a major tool for them.
- ig1 14y agoTry asking your regular bank how their fraud detection works, or your insurance company, or the secret service. Basically if you work in fraud detection (or broadly any kind of crime detection) you keep your techniques secret because otherwise you're helping the criminals avoid you. Look at the source code for Reddit or Hacker News, notice how in the publicly released codebases they've both chosen specifically not to publish the code to do with vote-rigging detection. There's a strong argument for secrecy.
- vadiml 14y agoThe security by obscurity approach usually give you only an ILLUSION of security
- koenigdavidmj 14y agoYes...once they figure it out, you still need to change your spam filtering/fraud detection methods. But if they have the algorithms, then they can figure out how to bypass it offline, on their own hardware, and you'll never now that it is happening until it is too late.
- jasonlotito 14y agoSecurity has nothing to do with fraud. And in combating fraud, obscurity works. SSL is security, but it's meaningless if the site you just sent your CC data to is fraudulent. Then, you need to understand how open PayPal is to fraud. I can easily commit major crimes using PayPal, and security has nothing to do with it. This is the challenge they face. If you think it's an easy problem to solve, ask yourself: why is there no one else out there doing this same thing? Why are all the other supposed opponents limited in such drastic ways that PayPal is not? I'm not suggesting they are perfect, but your trite remark is meaningless and ignorant of the realities of the system.
- teyc 14y ago+1 Also don't want to help competing services. Another data point - spammers used to check their work against spam assassin, fine tuning them. Another data point - leaked password databases are a source of heuristics for generating word lists.