Hacker News Reader

Comment by draebek | Hacker News Reader

I think they offer TOTP now, right? Started sometime last year? Do you have to activate SMS alongside it?

I have been using TOTP with PayPal for (I think) a few years now. You used to have to run some weird local Python script that somehow imitated the one RSA (I think) dongle they supported in a way I don't understand, but the net result was that you just get a TOTP key that works fine.

View on HN

I wasn't able to see any way to do even TOTP for PayPal when they insisted I enable SMS a few hours ago.

I don't have any money in there, it just mediates broken payment interfaces (e.g. Patreon rejected all my payment cards, from multiple banks apparently they're all fraud or something? No idea, the cards remain working no problem everywhere else, but I wanted to give people money for what they do, so I used Paypal to manage that)

It's pretty sad that in 2020 PayPal thinks SMS is a reasonable choice for protecting accounts that might actually have money in them...

Check the instructions at https://authy.com/guides/paypal/. Those seem to work for me, I can indeed now add an authenticator app just as shown there.

Thanks, I think it worked. At least they are no longer asking me to confirm the mobile number, although I can't seem to delete the unconfirmed number so who knows if there is still a way to use it to take over the account :(. Along the way I found a disturbing number of TOTP utilities that want you to pass the key on the command line :(. I found this one as a simple version that doesn't do that and uses OpenSSL or LibreSSL:

https://github.com/arachsys/totp

Nope, didn't fully work. The still won't let me add a credit card without receiving a text.

Multiple Paypal reps told me that SMS is the only way. It is possible they are all incorrect :/. I'll look into it, thanks.

Reply on news.ycombinator.com