10 ms·
PayPal Denies Providing Payment Information to Twitter Username Hacker
- ColinWright 13y ago> PayPal Denies Providing Payment Information > to Twitter Username Hacker Well, they would, wouldn't they.
- deleted 13y ago[deleted]
- misnome 13y agoExactly - as the article points out, without released voice recordings (if they exist, which is not a given), they can't prove that they didn't. Haven't similar things happened before with paypal though?
- freerobby 13y agoIn a hearsay battle between Paypal and a thief, why is the burden on PayPal to prove its innocence?
- shrooms 13y agoBecause Paypal has a history of being full of shit.
- 1angryhacker 13y agothat's not a reason to convict without evidence. if paypal is so shit why is everyone using them. vote with your feet
- zamalek 13y agoWe aren't convicting them here - this isn't a court. It's just pointing out that, once again, as always: PayPal Not only did they screw up; but they also can't man up, tell the truth and be transparent - as usual. Shit happens. Slamming us with a denial that shit happened is implying that you aren't going to do anything about it; admitting it is a clear statement that you are not proud of it and will work to make sure it never happens again. It's come to the point where if someone said that PayPal are responsible for climate change; I would be inclined to believe them. No matter how much they denied it.
- jessedhillon 13y agoIn other words you're prejudiced and see no reason to logically validate your preconceptions? Great, that's what we need. More people commenting who have all the answers. What if PayPal were telling the truth, how exactly would that situation look different than the one we are in? Good thing PayPal's always wrong though!
- orclev 13y agoIt's more like extrapolation from a known set of data points. PayPal has a certain history. You can look up what's gone down in the past, and based on that, the accusations fall right in line with the sorts of things PayPal has historically done. At this point it seems far more likely that PayPal did in fact do what it's accused of than that it didn't. If PayPal is in fact telling the truth (and that's a big if), then the question becomes where did the hacker get the last 4 of the CC from? GoDaddy has confirmed the hacker had a large amount of info, including presumably the last 4 of the CC when he called them, so somewhere in this whole thing someone gave that data away.
- jessedhillon 13y ago...the question becomes where did the hacker get the last 4 of the CC from? That's always been the question. Until you know better, what you have is a situation where you're believing the word of an anonymous criminal, relayed to you second-hand, over PayPal. I'm just saying you have no evidence either way at this point, and are simply expressing your preconceptions, which are not helpful.
- Torn 13y ago@1angryhacker - they're the only game in town for a lot of people, notably ebay sellers and users. More tech-savvy sellers know to diversify or to use other payment gateways (amazon, google, etc) but paypal has a huge userbase of average internet users.
- bushido 13y agoTo my knowledge they don't know who the thief is. The thief allegedly got the last 4 digits of the CC by posing as an employee.[0] If true, it would mean paypal gave out financial information to an unknown third-party, which would be a breach of a bunch of laws, terms, internal policies etc. The burden to prove innocence in this situation would definitely fall on paypal. Excerpts from the original article[0]: >I called paypal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling paypal and asking the agent to add a note to your account to not release any details via phone) >Yes paypal told me them over the phone (I was acting as an employee) and godaddy let me “guess” for the first two digits of the card [0] https://medium.com/p/24eb09e026dd https://medium.com/p/24eb09e026dd [1] https://news.ycombinator.com/item?id=7141532 https://news.ycombinator.com/item?id=7141532
- dec0dedab0de 13y agoI dislike paypal as much as anyone, but since when does anyone have to prove innocence?
- bushido 13y agoWhen you are a financial company. edit: financial companies, or any company when dealing with a financial or privacy breach usually needs to prove their innocence when they are attributed to allegedly causing financial loss (to varied extents depending on the situation). This is an expectation from society in general. It may not seem fair or be legally required, but that's just the way it is.
- jessedhillon 13y agoYou need a course in elementary logic. Specifically, on the burden of proof. Also, everything you wrote in this comment here seems to be a complete fabrication.
- simonh 13y agoI work for a bank and it's absolutely on us to show that our transactions and treatment of financial information is verifiable. We have to be able to demonstrate due diligence, there is no assumption of innocence when the auditors come knocking on the door, whatever 'elementary logic' may say. Thats why I completely believe the posters here claiming this wouldn't be possible in a banks call centre. What I don't know is whether PayPal operates at the same standard.
- glanotte 13y agoI would tend to agree with you, but paypal was emphatic that they _did not_ (emphasis theirs) release anything. There is a difference between not finding evidence and saying as such, "We could find no evidence that that one of our employees failed to follow correct and established procedures". If they had said that, I would be more inclined to let them go. I believe that they placed the burden of proof on themselves by coming out with such a firm statement.
- taude 13y agoBecause 1) they likely have the actual recording on file 2) they are the service company that wants to convince us to continue using them.
- phaus 13y agoIts partly because PayPal's reputation precedes it. Paypal is a shitty company with often scummy policies. They also have a demonstrated history of employees making horrible decisions. If PayPal didn't do anything wrong, they would probably be far more eager to provide their customer with assistance. In their initial communication they should have volunteered whether or not there is a recording of any conversation they may have had with the attacker. If there is a recording, they should have immediately volunteered to play it back for the victim in order to give him peace of mind. That's basic customer service.
- at-fates-hands 13y agoThey're not, they're just covering their own asses.
- baddox 13y agoBecause the thief actually did acquire the last 4 digits of the credit card number, and there is plenty of anecdotal evidence that their techs can and will give out the last 4 digits of credit card numbers.
- scott_s 13y agoBecause there are three parties here, not two: PayPal, the thief, and all real and potential customers of PayPal. PayPal has no obligation to convince the thief that they are innocent. But if they want to retain business, they must convince all of their current and future customers that they are innocent.
- MattyMc 13y agoAlternatively, if this hacker had a method different than what he/she described to obtain the necessary information, it would make sense that he/she would describe a false sequence of events in order to throw the account holder off the trail.
- deleted 13y ago[deleted]
- sdaityari 13y agoNow who do we blame?
- Tepix 13y agoGodaddy.
- chris_wot 13y agoI'm waiting for the day that Godaddy buys Twitter and then is acquired by PayPal. At this point the nexus of evil will be mainly concentrated around one company. It would make a good acquisition target for EMC.
- uloweb 13y agoAnd then they would rename it to "Umbrella corporation"
- oneeyedpigeon 13y agoDid I miss something - why are Twitter evil now?
- lipanski 13y agoIn my opinion, the hacker who hijacked this guy's Twitter account didn't have had ANY interest in explaining how he got to it, besides creating a hoax to confuse and divert attention. Just think about it, in just one email he puts the blame on both GoDaddy, for doing phone validation over unsecure criteria (like credit card numbers), and PayPal (for giving out the last digits of the card number to a complete stranger). There might be some truth to it (GoDaddy's phone validation sucks and GoDaddy sucks altogether), but I've read the original HN thread and the majority of comments are directed against GoDaddy or PayPal, rather than the real perpetrator. There are a million ways to hijack someone's account - including but not necessary by exploiting flaws of GoDaddy / PayPal - but I wouldn't trust the hijacker to kindly explain to me how he actually did it.
- jader201 13y ago> didn't have had ANY interest in explaining how he got to it, besides creating a hoax to confuse and divert attention. Would the story have gone viral, though, had he just said, "I'm not going to say anything about how I did it."? The story would have just been another "I got hacked" story. If the hacker were really clever enough to fabricate such an elaborate hoax, I think he would have been clever enough to realize the best way to divert attention from the story, would have been to just keep quiet.
- Uchikoma 13y agoThe argument was, he was deflecting attention away from him towards others - which, as this thread for the parent poster shows, worked.
- jader201 13y agoMy argument is, this attention wouldn't even be here had he just kept quiet. I don't think he was clever enough to have foresight that a) this would get this much attention, and b) he would need to deflect said attention by fabricating an elaborate hoax. The guy was simply wanting to brag about what he did in the excitement of him actually pulling it off. I think this is much more believable than him fabricating this story.
- poizan42 13y agoWell PayPal once flagged a non-existent transaction on my account as suspicious. I had to call them to get it sorted out. The fact that something like that can happen surely doesn't help me trust PayPal...
- MarkTee 13y agoWhy? Sounds like they did you a favour.
- RexRollman 13y agoI am more interested in Twitter's response to all of this.
- uloweb 13y agoI am too. Just because Twitter can very easily prove that account was stolen and return it to the owner. I don't think it is possible to steal, for example, twitter name "jack" or "barackobama".
- jader201 13y agoWhile I think the right thing of Twitter would be to give the account back, they didn't really do anything wrong (if the story is to be believed). Hiroshima simply changed the account name, and let the hacker know it was available. Not sure Twitter could have done anything to prevent this from happening.
- chris_wot 13y agoI'd be reporting them to the authorities. Then I'd sue them, and get the recording in discovery.
- Torn 13y agoWho's going to cover the lawyer costs? I'd love to see a 'no win no fee' company prepared to take on paypal
- chris_wot 13y agoIt's done all the time with class actions.
- deleted 13y ago[deleted]
- ScottWhigham 13y agoThis line of reasoning doesn't make a whole lot of sense. As a member of several class action lawsuits over the past 20+ years, I bet I've made out like a bandit - no less than $2.50 distributed over maybe 5-7 CALs. Sweet! The lawyers, however, probably made $500,000,000 with those 5-7 lawsuits. So while there's a financial want from the lawyers' perspective, why would I want to go that route?
- jorgem 13y agoI think that the lawyers suing for class action status use one (or a few people) as their "examples" of people harmed by the complaint. Those people may make some money... You may just need to get into your class action suits much earlier... Sounds like a lot of other scams.
- Bluestrike2 13y agoGenerally speaking, class action suits--especially for smaller claims, like what chris_wot implies--are less about seeking individual relief and more about leveraging the potential for significant damages to force a defendant to initiate a change in a given behavior. So even though you might only walk away with a few pennies, on balance, there's a net benefit to the public value that stems from behavioral changes. If Mr. Burns is dumping his chemical waste into Lake Springfield and you're winding up with little three-eyed fish as a result, you're hoping to force Mr. Burns to stop polluting the lake. Are there sleazy class action attorneys? Absolutely. They can be found on late night television, ugly billboards with creepy mugshots, and stalking ambulance drivers (:D). Basically, anywhere your regular run-of-the-mill scheister attorneys can be found. But they're also fewer in number, mainly because class action litigation is significantly more resource-intensive than other types of litigation. And since class action attorneys are almost always working on a contingency basis, there's a lot to support the idea that they earn their fees here. It might not seem fair when you're looking at a $2.50 check, but that's the tradeoff you accept in order to bolster your ability to force a change.
- AccountsBlow 13y agoFuck PayPal, like you ever gave a shit about your customers. Do us all a favor and KILL yourselves
- leobelle 13y agoTake a timeout, come back in 20 and reread your post. Is it really worth it to get so angry and malicious? And protip, if you're going to get this angry, don't post it. It makes you look nuts, and does nothing to anyone about how they might feel about PayPal.
- givehimagun 13y agoI didn't see the original post, but this is an extremely thoughtful reply to anyone who is angry and acting illogically. Well done.
- Dylan16807 13y agoHonestly I think telling the corporation of PayPal that it should be destroyed, or truly threatened with destruction if they don't shape up, is a reasonable response to their abusive behavior. People are far too forgiving of misdeeds done by large corporations. It's certainly an angry and illogical post but I can't bring myself to actually disagree with it.
- bushido 13y agoWhat's interesting is in the original "i got hacked" post[0]. The email from the hacker says that he called paypal and posed as an employee. That may not be tough to do, i.e. if you call a call center, select the wrong department and request an internal transfer, it is quite possible that the person receiving the call would not be able to distinguish between an internal call or a customer call. So if the hacker told them he was Jack from xyz department, who would know the difference, better still, would they log the call at all? The alleged breach could in this situation be quite easy. [0] https://medium.com/p/24eb09e026dd https://medium.com/p/24eb09e026dd
- carlosrt 13y agoWhen I worked at a large bank many years ago, internal calls were verified to be bank employees. It was low tech, but when a bank employee called and asked about a customer we had them verify they were a bank employee by telling them to look up, and tell us what was on a certain page and line of an internal bank book. If their answer matched what we were looking at as well then the conversation continued. The books were changed/printed often.
- ionforce 13y agoThat's just like early days video game anti-piracy measure. What is the third word on the second paragraph of page 42 of the Dungeon Master's manual? Etc.
- jcfiala 13y agoThe Pragmatic Programmer website uses this system to allow you to prove that you bought a hard-copy of a book, so they can offer you a discounted ebook.
- nknighthb 13y agoMilitary codebooks are used in this way for authenticating over unsecured links. Letters or numbers laid out in a grid-like format, and you make the far side read off a certain cell. http://en.wikipedia.org/wiki/DRYAD http://en.wikipedia.org/wiki/DRYAD http://en.wikipedia.org/wiki/BATCO#Other_functions http://en.wikipedia.org/wiki/BATCO#Other_functions
- enscr 13y agoI didn't expect them to come forth and accept it. If it's an employee mistake, and not a standard broken process, they can erase the tracks.
- msandford 13y agoIf it's possible for employees to be able to make such a mistake, that's a standard broken process. It should not be possible for them to reveal the last four no matter how badly someone wants them to and how clever their social engineering skills. It shouldn't be possible from a technical perspective, not from a "we told employees not to do this" perspective.
- Uchikoma 13y agoIf you display 4 digits to the user for CC validation, as basically everyone does, then there will always be someone who can read those 4 digits and give them to someone else.
- rahimnathwani 13y agoYou don't need to display them to the user. The user can ask for them from the customer. The user types in the 4 digits the customer provides. The computer compares the two strings. The user need never see the real stored digits.
- Uchikoma 13y agoSorry, in my argument I meant user with what you've called customer.
- dutchbrit 13y agoAlternative option, thief has an insider at PayPal, or even worse, works at PayPal. But PayPal is probably just trying to cover their ass.
- datphp 13y agoI'm not a PayPal fan but reading how he supposedly obtained the digits, I immediately thought it was bullshit. An insider seems likely, and it doesn't even have to be at PayPal. Most companies where you use your credit card either have your email, or could figure it out using your name / address.
- parandroid 13y agoPerhaps the cracker is actually employed at PayPal for real? :) This thought amuses me, since it's a scenario with no leaks outside the circle of PayPal employees, yet it gives the opportunity to the bad guy to gain the info necessary for the deed.
- mpermar 13y agoAs if they would say if they were :-)
- slack3r 13y agohttp://thenextweb.com/insider/2014/01/30/godaddy-accepts-partial-responsibility-social-engineering-attack-ns-customer-account/ http://thenextweb.com/insider/2014/01/30/godaddy-accepts-par... "Our review of the situation reveals that the hacker was already in possession of a large portion of the customer information needed to access the account at the time he contacted GoDaddy. The hacker then socially engineered an employee to provide the remaining information needed to access the customer account. The customer has since regained full access to his GoDaddy account, and we are working with industry partners to help restore services from other providers. We are making necessary changes to employee training to ensure we continue to provide industry-leading security to our customers and stay ahead of evolving hacker techniques." It's likely the attacker obtained credit card info from GoDaddy rather than PayPal.
- MarkTee 13y ago"evolving hacker techniques"? I'm pretty sure that these fancy tactics can be found in The Art of Deception, which was released in 2002. Social engineering is nothing new.
- zimpenfish 13y agoThey can probably be found in any writing since about when people discovered that manipulation and lying got them a warmer spot in the cave and a bigger slice of mammoth pie.
- Frostbeard 13y agoAll the hacker claims to have obtained from PayPal is the last four digits of the credit card number. Perhaps this failed attempt they mention was them asking the hacker to provide the complete credit card number ending in XXXX as a form of verification?
- squigs25 13y agoPaypal's value lies in it's network and it's trustworthiness. There is no way in a million years they would divulge a f*-up of this magnitude unless there's was cold hard proof. But I think there is pretty convincing proof, and I think if anything, this makes them less trustworthy than if they had come out and accepted partial wrong doing. The "hacker" had no incentive to lie; the ace was in his hand.
- rwallace 13y agoActually, neither the hacker nor PayPal has presented any proof whatsoever (there is as yet no proof that the hacker even had the last four digits of the card number, and if he did, there are plenty of sources to get those from). Either could for all we know be telling the truth, but if you find yourself automatically taking the word of a known thief over that of a legitimate company, it's time to stop and re-examine, not only your conclusion in this case, but every aspect of the thought processes you use for such things. The hacker had several possible incentives to lie, and I'm sure you'd be able to figure out at least some of them if you stepped back and looked at the question objectively.
- ck2 13y agoPayPal is lying or playing dumb and here's why: Ask them if the customer service agents can see the last four or if they have to enter them first before the customer's records come up. They can see the last four right away. Call paypal and ask them which card you have on file, you cannot remember. The agent can give you last four to identify it.
- chimeracoder 13y ago> Call paypal and ask them which card you have on file, you cannot remember. Exactly. I've done this before when services ask me for my full credit card number or expiration date (to verify), and I ask them for the last four digits (to remind me which card I used). What PayPal did may be bad, but what GoDaddy did (use the last six digits) to verify is even worse. If you know the last four digits, you have a better than 1% chance of guessing the previous two, since they are not uniformly distributed: http://en.wikipedia.org/wiki/Luhn_algorithm http://en.wikipedia.org/wiki/Luhn_algorithm (There are actually even more restrictions than the Luhn algorithm on credit card numbers, but I won't go into them here. Suffice to say, there's a reason than the attacker says he was able to guess it in a single try - he was lucky, but not that lucky).
- ianstormtaylor 13y agoSomeone should just record a video of themselves doing it to their own account and post it online, that would be proof enough I'd think.
- erikpukinskis 13y agoYou are right that Last Six is a miserable password. One correction thought: the attacker didn't guess the two digits in a single try, they guessed them in a single phone call. The GoDaddy agent allegedly let them just try numbers until they got it.
- bluesmoon 13y agoThe last 4 digits are known, and the first 6 digits are based on the type of card (VISA/MC/AMEX + Bank/Issuer), so are guessable. Apply the Luhn algorithm to these, and you're left with only 10-100K possibilities for the remaining middle digits. If you're only required to specify the last 2, you can narrow it down significantly by only looking at valid combinations of those last 2, which is far smaller than 100. I've written up some of this here: http://tech.bluesmoon.info/2011/01/how-guessable-is-your-credit-card.html http://tech.bluesmoon.info/2011/01/how-guessable-is-your-cre...
- thehme 13y agoI am very interested in what comes out of this. When I read Hiroshima's blog post, I was getting chills thinking how angry I would be if I could not get into my own accounts thanks to someone taking over them simply by exercising human engineering tactics. Big and small companies need to implement 2-step verification, or better, and never give out information.
- melindajb 13y agoPayPal records every call, 100% and also all the screen captures of the agent answering the call. So, either they're telling the truth, or they're lying. Not sure how anyone could tell the difference. but I guarantee you, they listened to the call. I can't see why a hacker would actually give his secrets away.
- godgod 13y agoPaypal lies.
- homersapien 13y agoWhy doesn't Twitter simply quarantine the handle until some sort of dispute resolution is completed? Oh wait, Twitter doesn't "do" customer service, so forget about any sort of common sense solutions.
- jontas 13y agoShouldn't it be easy enough for Twitter to just return the handle to the original owner? I guess Twitter has to cover their own ass to a degree, and it is possible the original owner is making up this story and actually sold the Twitter handle (though I suspect this would be against Twitter's policies). However, based on what I've read, the people involved, and Occam's Razor, I believe the published story. Twitter should transfer ownership of the handle back to Naoki Hiroshima, do the right thing, and get some good press at the same time.