5 ms·

Paypal's Bug Bounty program, for the curious: https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/

Paypal's Bug Bounty program, for the curious: https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...

talles 12y ago
Paypal detects that I'm in Brazil and gives me the brazilian version of the website, in which the link is 'Not Found'. There is no locale on url whatsoever. I have to manually change my country to United States in their menu and then I'm able to access the url. So annoying. Why not showing the page with a simple warning such as "Sorry, we don't have this content in your language, here's the original:"...
- rtpg 12y ago
  From what I've understood about Paypal, international entities are more or less completely separate from Paypal US (hence these sorts of events). Commonly it was API features that work subtly differently depending on the region of the world you're in, but help pages also end up with completely different URL schemes.
  - jbkkd 12y ago
    That's not an excuse really, they could easily have gotten that sorted if they PayPal HQ (US I guess?) wanted to.
  - fiatjaf 12y ago
    They cannot be: I had an account at the american Paypal and it was automatically transferred to Brazil when they opened here.
    - jotm 12y ago
      Huh, they just told me to open a new account in Europe...
- stickydink 12y ago
  It's a bad link, doesn't work in the US either
  - pc86 12y ago
    Works fine for me
- baby 12y ago
  Doesn't work in France either :(
- MichaelGG 12y ago
  This kind of thing is so frustrating. It's one of those features where "somebody got a raise for that", except it's so hostile towards users. Google is absolutely the worst. Installed an app in one country that's not available in another? Cool now you get a 404 in the play store. In Denver, Google has also at times decided I'm in France, then Hungary, with absolutely no way to fully disable it on sites like YouTube or Google.com (you always get the links and logos, and alt-text for images is still in the "local" language). Play Store shows certain section subtitles in one language, even though Android and everything else is in another. I recently went to buy some books for my kids. The publisher's site detected I was in another country, and hid the book information with a page suggesting I contact a local reseller. Despite that I was just visiting another country at the time. No way to override. Chrome would do the same on install, and offer no way to remove the default search engine from the localized copy. You could change to another one, but not fully delete it. Meanwhile, the entire UI stays in whatever language they decided. So despite using Windows in English, browser in English, etc. etc., Google though it'd be cool to run in Spanish, or Russian, or whatever, based on your IP address. Moronic. Netflix has similar problems - the site does not respect language preferences completely and things like search autocomplete will use the "detected" language. Traveling and contacting support? Cool. Despite every indication you're using English, they'll route you to support in a local language. It's insane. The one thing the HTTP spec got right, Accept-Language, and everyone just ignores it and implements this shitty geo localization + language handling. And they think it's a feature, and every time someone implements this, they probably get a pat on the back and a raise for doing something intelligent. FFS.
danielsamuels 12y ago
Correct link: https://www.paypal.com/us/webapps/mpp/security/reporting-security-issues https://www.paypal.com/us/webapps/mpp/security/reporting-sec...
- Derpdiherp 12y ago
  Is it just me or are these bounties really low. Unless I'm misunderstanding identification bypass could be incredibly damaging for the company and their customers, but it's only got a $3000 reward? In my personal opinion you want to balance bounties against how much money that the person could receive using the exploits, vs the amount of trouble they could potentially get into.
  - atmosx 12y ago
    That's kinda hard to evaluate not having actually do it. That said, such a bug, if works as expected might be much more highly priced in the black market.
  - ceejayoz 12y ago
    They're a "here's a token of thanks", not a "please don't sell it".
  - driverdan 12y ago
    It's insultingly low. Auth bypass is easily worth 5 or 6 figures if you can use it to transfer money.
    - onewaystreet 12y ago
      You overestimate the value of these bugs to the black market. There is no shortage of hacked PayPal accounts for sale on the various dark net markets because the hard part is getting money off the accounts. PayPal will flag a transfer for a dozen different reasons. If you don't login to the hacked account from an IP close to the location of its owner; if you immediately attempt to transfer money off the account to a bank account; etc.
  - 12y ago

Paypal's Bug Bounty program, for the curious: https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...

talles 12y ago

Paypal detects that I'm in Brazil and gives me the brazilian version of the website, in which the link is 'Not Found'. There is no locale on url whatsoever. I have to manually change my country to United States in their menu and then I'm able to access the url. So annoying. Why not showing the page with a simple warning such as "Sorry, we don't have this content in your language, here's the original:"...

rtpg 12y ago
From what I've understood about Paypal, international entities are more or less completely separate from Paypal US (hence these sorts of events). Commonly it was API features that work subtly differently depending on the region of the world you're in, but help pages also end up with completely different URL schemes.
- jbkkd 12y ago
  That's not an excuse really, they could easily have gotten that sorted if they PayPal HQ (US I guess?) wanted to.
- fiatjaf 12y ago
  They cannot be: I had an account at the american Paypal and it was automatically transferred to Brazil when they opened here.
  - jotm 12y ago
    Huh, they just told me to open a new account in Europe...
stickydink 12y ago
It's a bad link, doesn't work in the US either
- pc86 12y ago
  Works fine for me
baby 12y ago
Doesn't work in France either :(
MichaelGG 12y ago
This kind of thing is so frustrating. It's one of those features where "somebody got a raise for that", except it's so hostile towards users. Google is absolutely the worst. Installed an app in one country that's not available in another? Cool now you get a 404 in the play store. In Denver, Google has also at times decided I'm in France, then Hungary, with absolutely no way to fully disable it on sites like YouTube or Google.com (you always get the links and logos, and alt-text for images is still in the "local" language). Play Store shows certain section subtitles in one language, even though Android and everything else is in another. I recently went to buy some books for my kids. The publisher's site detected I was in another country, and hid the book information with a page suggesting I contact a local reseller. Despite that I was just visiting another country at the time. No way to override. Chrome would do the same on install, and offer no way to remove the default search engine from the localized copy. You could change to another one, but not fully delete it. Meanwhile, the entire UI stays in whatever language they decided. So despite using Windows in English, browser in English, etc. etc., Google though it'd be cool to run in Spanish, or Russian, or whatever, based on your IP address. Moronic. Netflix has similar problems - the site does not respect language preferences completely and things like search autocomplete will use the "detected" language. Traveling and contacting support? Cool. Despite every indication you're using English, they'll route you to support in a local language. It's insane. The one thing the HTTP spec got right, Accept-Language, and everyone just ignores it and implements this shitty geo localization + language handling. And they think it's a feature, and every time someone implements this, they probably get a pat on the back and a raise for doing something intelligent. FFS.

danielsamuels 12y ago

Correct link: https://www.paypal.com/us/webapps/mpp/security/reporting-security-issues https://www.paypal.com/us/webapps/mpp/security/reporting-sec...

Derpdiherp 12y ago
Is it just me or are these bounties really low. Unless I'm misunderstanding identification bypass could be incredibly damaging for the company and their customers, but it's only got a $3000 reward? In my personal opinion you want to balance bounties against how much money that the person could receive using the exploits, vs the amount of trouble they could potentially get into.
- atmosx 12y ago
  That's kinda hard to evaluate not having actually do it. That said, such a bug, if works as expected might be much more highly priced in the black market.
- ceejayoz 12y ago
  They're a "here's a token of thanks", not a "please don't sell it".
- driverdan 12y ago
  It's insultingly low. Auth bypass is easily worth 5 or 6 figures if you can use it to transfer money.
  - onewaystreet 12y ago
    You overestimate the value of these bugs to the black market. There is no shortage of hacked PayPal accounts for sale on the various dark net markets because the hard part is getting money off the accounts. PayPal will flag a transfer for a dozen different reasons. If you don't login to the hacked account from an IP close to the location of its owner; if you immediately attempt to transfer money off the account to a bank account; etc.
- 12y ago