3 ms·
I think I speak for us all when I say ???????!!!!!!!. This exploit is as big as they come. They should have paid him many times their $10k maximum bounty in ex
by downandout 12y ago
I think I speak for us all when I say ???????!!!!!!!. This exploit is as big as they come. They should have paid him many times their $10k maximum bounty in exchange for an NDA, as I am sure I am not alone in saying that this shakes my confidence in PayPal. While I have never trusted them as far as random account freezings etc., I didn't ever expect something as fundamental and serious as this. When you think of all the engineers they must have dedicated to security, it is almost unfathomable that this was missed.
- oxalo 12y agoSecurity is hard. I think the more important thing here is that Paypal fixed it quickly and honored the bug bounty. I'd be more worried if they tried to shove it under the rug.
- downandout 12y ago> Security is hard. Secuirty is hard. But activating tokens before a user has actually logged in is a breathtakingly incompetent, fundamental design flaw. How such code ever made it into the production code base of a company responsible for protecting billions of dollars along with financial information for a significant portion of the world is incomprehensible. It makes me wonder what else is lurking over there.