Hacker News Reader

Comment by dangrossman | Hacker News Reader

Mr. Langley posted screenshots and additional information on Namesake earlier today:

http://namesake.com/conversation/mattlangley/i-just-accident...

Among other interesting tidbits: "All users are potentially vulnerable, but users of free email services are the most vulnerable, for reasons that I won't divulge until Paypal have fixed it."

View on HN

That implies that it's easier to get the password change email sent to an address with a different local part at the same domain than to a completely different domain.

He also noted:

  @Alex Khomenko told me in another place, that there may be
  a secondary authentication on password changes from the
  forgotten password link, in the US PayPal. If true and
  currently in place this would mean that the US is not
  vulnerable, although they may still have the email bug

He said he doesn't use PayPal himself and that he only requested a change password link when he was trying to contact them about "effective spam". Perhaps he supplied them with one of his email addresses and it happened to have a counterpart at a different subdomain (like example@email.com vs example@email.com.au)?

EDIT: Formatting.

The opening statement (and URL) of this post is rather interesting: "I just accidental hacked PayPal" followed by "it took 30 seconds and I had total access to someone else's account".

Reply on news.ycombinator.com