What’s going on with security at PayPal?

I have seen this for weeks/months now. It happens when you are about to make a purchase. So for instance, if you click on pay with paypal on a different website, it shows up, presumably to reduce friction or improve clickthrough.

But why have the middleman if you can a avoid it.

For a long time you couldn't. They supported Symantec's app, which was TOTP but obfuscated. So for a long time, you had to extract/reverse engineer the seed from the Symantec app.

The author says when you enter an email, an SMS is sent and number revealed.

What really happens is that it asks me for a password. Below that there's an option to get a one time code. Clicking that reveals the first digit of the area code, then the last 4 digits. You must then click yet again to make it actually send.

So in short, it didn't immediately send an SMS and never showed the full number.

In my case, I had got 2FA through being called by an automated voice giving me a OTP. However, my number in their database had somehow been mangled with a 0 before the country code, so the 2FA had attempted to use the country code as a domestic area code.

BTW. The support assistant on the phone was a young person who had never used land-lines and did not understand what an "area code" was, so I had to explain it to her.

> I have an account with MFA and... I don't think that's true

Try log in using Incognito/private browser. I am either defaulted into the one-time SMS flow, or given the option to log in with a one-time SMS code. In either case, if I enter the SMS code I am not prompted for my password nor TOTP.

Because, in general, key management is hard, and your average user will likely not be able to understand such a flow, and will additionally probably lose their private key.

PayPal already has a pretty reasonable way to secure accounts: username+password+TOTP (using an app for the OTPs, not SMS). No, it's not perfect, and can be phished, but for most people it will be good enough. People who care about the phishing risk can use a FIDO2 hardware token instead of TOTP. All of this is common and widely-implemented enough that it's feasible to require that users do this.

But instead, probably in the name of reducing payment friction, they have decided on this horribly insecure method as described by OP. Ugh.

But at some point it all went off the rails: crypto became a deeply rigged casino targeting the most vulnerable people they could find, fueled by insane amounts of energy consumption and money laundering.

As they exist now, they are even more difficult to use safely and securely. For every one person who gets hacked via paypal's SMS crap and a simswap, there would be 50 people who would lose their crypto wallet to dropping their phone in the river and forgetting the passphrase.

It's perfectly consistent to have issues with cryptocurrency and with other centralized financial institutions since they both have awful security models for the average person. Financial institutes are too insecure, and crypto is too unusable.

I, personally, would like the government to provide a universal authorization server ("log in with GovID" or whatever), and require all banks in the country to support that auth mechanism, and then ensure that mechanism is both incredibly secure, but also has suitable fallbacks to recover access.

The government is uniquely positioned to be able to do that in theory, if only the government weren't wildly allergic to doing _anything_.

I'll settle for a bank that does not ever fall back to SMS and supports webauthn so I can use my yubikey, and fortunately such banks do exist, so things aren't actually so bad. As long as I don't use paypal or various other less competent software.

A lot of tech savvy people lost money due to losing their keys. Now imagine the disaster if your mother needs to handle them.

Payment solutions are also heavily regulated, often also in favour of the consumer. If my bank goes bankrupt or gets hacked I have much better garuantees of getting my money back compared to when I lose my private key.

The final reason (in my opinion) that "private key solutions" are not adding much is that to legally use it you need to comply with the regulations for traditional finance. Hosting an exchange without KYC can be considered illigal in many western countries.

Want to advocate for less regulations in finance? Sure, that's a valid political opinion. But you need to go into political solutions for that, not technological ones.

Biggest problem is losing the key. Also how to sync the key between devices. Not get tricked into giving it away.

Best case might be a authenticator type of app piggy backing on your phones physical and electronic security.

Most people look after their phones. Then maybe they back up somewhere else.

“We’re verifying your account, please read the number I’m about to send you.”

This is made worse because actual banks actually do this.

i've been using totp for a long time but webauthn has been long overdue.

I once paid for internet via public wifi for a time. When my CC expired and it was time to renew... that was literally impossible because of how they redirected you to their paywall when you tried to visit anything else. Even if you were trying to go to the billing page to renew. So you literally couldn't pay them. Oh, and even if you had other internet access, that wouldn't work either, because the billing site was nowhere on the open internet, only via the municipal wifi.

Or there are similar loops in Amazon's help system, where they make it hard to get a human and it just loops you around the same sets of options when you tell it that it's not working right. So you have to swear at it to see if you can trigger the algorithms to detect frustration and get you out.

And those aren't even deliberate, like the dark patterns some places engage when you try to cancel a service.