4 ms·
Why does PayPal have so many bugs and security issues?
I don't know a single big player on the web that has similar amounts of bugs and security issues as PayPal -- not even close. Why is that?
* They have issues with their sign-in window opening in a pop-up/dialog instead of a new tab/window. [1]
* When I received money in a foreign currency recently, it didn't appear in my PayPal dashboard. I had to talk to three PayPal employees on the phone support before the fourth told me this was apparently a bug. All my settings were correct but I had to add an additional balance in the foreign currency, temporarily, to receive the money. Actually, I should be asked what to do with the foreign-currency amount (create new balance, convert, etc.).
* I'm using two-factor authentication and it's just annoying: On their main site, I can sign in, that's fine. On other pages, they just ask me for the 2FA token from my token generator (which I don't have) and don't offer the SMS verification which should be there, too. Somestimes I have to disable 2FA completely before I can perform certain actions.
* Until a few days ago, you could capture CSRF tokens that were valid for all accounts, not just your own. [2]
* They have XSS vulnerabilities from time to time. Okay, lots of sites have those. If you don't escape by default, this can happen, although it shouldn't. [3][4]
I know, big legacy code base. But other companies have similar challenges. PayPal wants to work with your money, they should be as least as good as Twitter, Facebook, Github, and hundreds of other sites that work better.
[1] http://homakov.blogspot.de/2014/12/new-paypal-gateway-ui-is-disaster.html
[2] http://www.theregister.co.uk/2014/12/04/paypal_csrf_bug_bounty/
[3] https://nakedsecurity.sophos.com/2013/05/29/paypal-refuses-to-pay-bug-finding-teen/
[4] http://www.forbes.com/sites/firewall/2010/10/06/hackable-bug-found-on-paypal-com/
- striking 12y agoTwo reasons, to me: * "Move fast and break things" mentality that made it big is now making it bad * Peter Thiel isn't as much of a genius as he thinks he is (although he is pretty smart in some respects, sometimes he's completely wrong, akin to some modern-day Aristotle) and the attitude of the founders of a company creates the culture as it grows
- marco1 12y agoThe first may definitely be true, i.e. their legacy code base may be a heavier burden that some other companies'. Don't know about Peter Thiel, if there's still influence on today's work. Anyway, it's mostly programming, implementation, craftsmanship which seems to be so bad.
- yuhong 12y agoI remember the days when David Marcus was the CEO, then he left the company, and now they are finally planning a break-up from eBay.
- MalcolmDiggs 12y agoI've wondered this myself. My hunch is that an unusually large amount of the their talent/engineering resources are tied up fighting fraud and abuse...leaving a skeleton crew to do all things front-end. Again, just a hunch though.
- debacle 12y ago* PayPal is the most comprehensive payment integration solution on the Internet. That brings a lot of complexity. * They also make money on relatively low fees. That requires good cost controls. * They're no longer a prestigious company to work at. They pay a bit higher than standard because it's harder to recruit talent. * Once you get to a certain size and complexity, especially in the financial world, changing things becomes terrifying.