3 ms·

So, how would I be able to verify that what I'm seeing is actually PayPal's login form, and not some phishing page? I thought that's the reason for doing a full

by pfg 13y ago

So, how would I be able to verify that what I'm seeing is actually PayPal's login form, and not some phishing page? I thought that's the reason for doing a full redirect. Or does this only work when you're already logged in on PayPal, and other than that you'd still be redirected?

defcon84 13y ago
Indeed, i'm glad i'm not the only one thinking this is a bad thing.. Without the URL bar, there is no direct way to be sure the form isn't fake.. before you know it, many many PayPal accounts will be comprimised..
nreece 13y ago
While it's a valid question, I suppose other payment solutions like Stripe Checkout (https://stripe.com/docs/checkout https://stripe.com/docs/checkout) and Braintree.js (https://www.braintreepayments.com/docs/javascript https://www.braintreepayments.com/docs/javascript) also work on a similar principle and hence pose the same vulnerability.
- IceyEC 13y ago
  To be fair, users don't have Stripe or Braintree accounts (usually), the goal there is to get your user to give credit card details, not to give you the login information for their other money handling site.
- pfg 13y ago
  Apart from the "Remember me anywhere"-feature (which I wasn't aware of, is this a recent addition?), I think Stripe and Braintree.js are recognized by users as yet another credit card form, and not as a virtual bank with a private login the way PayPal is. Most users probably don't even notice they're not handing their CC info to the website, but to some third-party service instead. So they'd have to be comfortable with giving their payment details to the shop anyway. If I chose PayPal however, which is marketed as a safe way to pay online, I don't want to have to put any trust in the site itself. That's why I want to be able to verify I'm actually entering my login details on PayPal's site.

3 ms·

So, how would I be able to verify that what I'm seeing is actually PayPal's login form, and not some phishing page? I thought that's the reason for doing a full

by pfg 13y ago

defcon84 13y ago
Indeed, i'm glad i'm not the only one thinking this is a bad thing.. Without the URL bar, there is no direct way to be sure the form isn't fake.. before you know it, many many PayPal accounts will be comprimised..
nreece 13y ago
While it's a valid question, I suppose other payment solutions like Stripe Checkout (https://stripe.com/docs/checkout https://stripe.com/docs/checkout) and Braintree.js (https://www.braintreepayments.com/docs/javascript https://www.braintreepayments.com/docs/javascript) also work on a similar principle and hence pose the same vulnerability.
- IceyEC 13y ago
  To be fair, users don't have Stripe or Braintree accounts (usually), the goal there is to get your user to give credit card details, not to give you the login information for their other money handling site.
- pfg 13y ago
  Apart from the "Remember me anywhere"-feature (which I wasn't aware of, is this a recent addition?), I think Stripe and Braintree.js are recognized by users as yet another credit card form, and not as a virtual bank with a private login the way PayPal is. Most users probably don't even notice they're not handing their CC info to the website, but to some third-party service instead. So they'd have to be comfortable with giving their payment details to the shop anyway. If I chose PayPal however, which is marketed as a safe way to pay online, I don't want to have to put any trust in the site itself. That's why I want to be able to verify I'm actually entering my login details on PayPal's site.