4 ms·
And composing an email to send someone money is secure how? What stops someone from spoofing my email address, CC'ing it to cash@square.com, and clearing me ou
by nly 13y ago
And composing an email to send someone money is secure how?
What stops someone from spoofing my email address, CC'ing it to cash@square.com, and clearing me out? And if someone does get in to my email account I'm toast?
- newhouseb 13y agoApparently, for suspicious activity, they'll send you an email back confirming the transaction. I would hope that most large-scale modern email services somehow sign emails to vouch for their authenticity to avoid email spoofing. I'd be curious how they handle dumb senders (I'd assume with a verification every time).
- nfoz 13y ago> I would hope that most large-scale modern email services somehow sign emails to vouch for their authenticity to avoid email spoofing. Wait, what? I don't think that is a thing.
- philfreo 13y agoThere is such a thing (lookup DKIM) but it's really only one factor of email authenticity and I'm sure Square isn't fully relying on it.
- uptown 13y agoYou’ll receive a reply from Square asking you to link a debit card." So you need to confirm it (and provide a debit account) I guess - but not sure how subsequent transactions are handled.
- meritt 13y agoSubsequent transactions are automatically debited without authorization.
- pavel_lishin 13y agoPresumably linking a debit card only happens once, and afterward, you're only contacted to verify suspicious transactions.
- dreaminconcert 13y agohttp://en.wikipedia.org/wiki/Dkim http://en.wikipedia.org/wiki/Dkim
- MRSallee 13y agoVia https://squareup.com/help/en-us/article/5144-square-cash-security https://squareup.com/help/en-us/article/5144-square-cash-sec... > Square verifies each Square Cash email to authenticate that it comes from a legitimate sender. For added security, we send you a text confirmation each time you send Cash if you have linked your mobile phone number.
- nly 13y agoif you link your mobile phone number
- moconnor 13y agoSurely it's the other end that is insecure. If this starts growing then sniffing unencrypted emails from Square offering "sign-up to receive your money" sounds profitable enough to be interesting to some actors.