5 ms·

This story is horrifying because PayPal was the enabler. PayPal gave the attacker the last four digits of my credit card number over the phone That person sho

by ck2 13y ago

This story is horrifying because PayPal was the enabler. PayPal gave the attacker the last four digits of my credit card number over the phone That person should lose their job if it is not PayPal policy. I really hope by some small chance the person that did this gets some serious prison time, if not for this then anything else prior or down the road. Then maybe one of those mornings they wake up in prison they can ponder if it was all worth it.

fuj 13y ago
This wasn't paypal's fault. I mean entirely. The problem was with goDaddy. The last 4 digits of credit cards show's up everywhere. Check your receipts. Related question in stackexchange: http://security.stackexchange.com/questions/37758/safety-of-publishing-last-4-credit-card-digits-in-age-of-fast-computing http://security.stackexchange.com/questions/37758/safety-of-... GoDaddy should not use the 4 last digits as a way to confirm identity, exactly for the reason I mentioned above
- ck2 13y ago
  PayPal gives out info to someone completely unverified and it is not their fault? It would be one thing if this was a spouse or someone intercepting their physical mail. It's not. It's someone out of the blue who called PayPal to get the last four of a complete stranger. GoDaddy's verification is bad too but at least they had some kind of attempt.
- baldfat 13y ago
  Why oh why do people support GoDaddy? I find their TV Commercials the worst and makes us as a community go back to the 1950s stereo types???? Love it when I help churches with their websites and it has a GoDaddy account :(
mseebach 13y ago
It's possible that this was gross negligence on part of the employee and that the thief just got really, really lucky - but that seems unlikely. This is a systemic fault of PayPal and firing a lowly phone-jockey will not solve that. There are computer system protections that were clearly not in place (the representative was able to see this data on the screen, rather than having to enter it blind and have it validated - or, if they did, they had infinite re-tries which is also bad. Three wrong attempts, and the account should be locked and have to be escalated) but there are also culture/training problems: Until otherwise satisfactorily proven, anyone calling must be assumed to be in bad faith when they call. A representative with this mindset would not let a caller start guessing the "password".
- jotm 13y ago
  See, that "account should be locked" is what got people to hate Paypal in the first place - they used to be quick on the trigger, wrong IP = locked account; transfer to new account = locked account, etc. And it took 1-2 weeks to restore. Now they laxed the security somewhat and people give them sheet for that... There's no winning for them, is there? But really, the employees should not give away any user information, ever. It should be a one way street here. That would have stopped the attacker in this case, as well, I believe...
  - mseebach 13y ago
    I didn't mean locked from transactions or logins using existing good credentials - I meant locked from front line customer service reps accessing its details. If you loose your credentials and the token that you can use to recover your credentials with (credit card number), it's fine, even preferable, that it takes 1-2 weeks to recover them. Also, people don't seem to be up in arms over PayPal freezing funds on suspicious activity for 1-2 weeks. They seem to be up in arms over funds being indefinitely frozen with no recourse for the unambiguously legitimate account owner.
    - jotm 13y ago
      They're never indefinitely frozen - you can transfer them to your bank account after 6 months, that was always the case. People have a problem with sending their credit card scans, driver's license, birth certificate, marriage certificate and their first born in order to remove those dreaded limits that seem to be imposed for little reason :-). I gotta say that's not the case anymore, at the very least they don't limit the account for paying too much on eBay or logging in from a different IP in my experience (and that's a good thing).
- yuhong 13y ago
  I wonder if David Marcus can help here.

by ck2 13y ago

fuj 13y ago

This wasn't paypal's fault. I mean entirely. The problem was with goDaddy. The last 4 digits of credit cards show's up everywhere. Check your receipts. Related question in stackexchange: http://security.stackexchange.com/questions/37758/safety-of-publishing-last-4-credit-card-digits-in-age-of-fast-computing http://security.stackexchange.com/questions/37758/safety-of-... GoDaddy should not use the 4 last digits as a way to confirm identity, exactly for the reason I mentioned above

ck2 13y ago
PayPal gives out info to someone completely unverified and it is not their fault? It would be one thing if this was a spouse or someone intercepting their physical mail. It's not. It's someone out of the blue who called PayPal to get the last four of a complete stranger. GoDaddy's verification is bad too but at least they had some kind of attempt.
baldfat 13y ago
Why oh why do people support GoDaddy? I find their TV Commercials the worst and makes us as a community go back to the 1950s stereo types???? Love it when I help churches with their websites and it has a GoDaddy account :(

mseebach 13y ago

It's possible that this was gross negligence on part of the employee and that the thief just got really, really lucky - but that seems unlikely. This is a systemic fault of PayPal and firing a lowly phone-jockey will not solve that. There are computer system protections that were clearly not in place (the representative was able to see this data on the screen, rather than having to enter it blind and have it validated - or, if they did, they had infinite re-tries which is also bad. Three wrong attempts, and the account should be locked and have to be escalated) but there are also culture/training problems: Until otherwise satisfactorily proven, anyone calling must be assumed to be in bad faith when they call. A representative with this mindset would not let a caller start guessing the "password".

jotm 13y ago
See, that "account should be locked" is what got people to hate Paypal in the first place - they used to be quick on the trigger, wrong IP = locked account; transfer to new account = locked account, etc. And it took 1-2 weeks to restore. Now they laxed the security somewhat and people give them sheet for that... There's no winning for them, is there? But really, the employees should not give away any user information, ever. It should be a one way street here. That would have stopped the attacker in this case, as well, I believe...
- mseebach 13y ago
  I didn't mean locked from transactions or logins using existing good credentials - I meant locked from front line customer service reps accessing its details. If you loose your credentials and the token that you can use to recover your credentials with (credit card number), it's fine, even preferable, that it takes 1-2 weeks to recover them. Also, people don't seem to be up in arms over PayPal freezing funds on suspicious activity for 1-2 weeks. They seem to be up in arms over funds being indefinitely frozen with no recourse for the unambiguously legitimate account owner.
  - jotm 13y ago
    They're never indefinitely frozen - you can transfer them to your bank account after 6 months, that was always the case. People have a problem with sending their credit card scans, driver's license, birth certificate, marriage certificate and their first born in order to remove those dreaded limits that seem to be imposed for little reason :-). I gotta say that's not the case anymore, at the very least they don't limit the account for paying too much on eBay or logging in from a different IP in my experience (and that's a good thing).
yuhong 13y ago
I wonder if David Marcus can help here.