Hacker News Reader

Comment by insanitybit | Hacker News Reader

Unfortunately, it seems that Paypal requires a phone number regardless of 2FA method, and there is indeed no way to disable this insane feature.

Seems like maybe a good idea for a class action lawsuit? I'm not sure what to do about that. A company shouldn't be able to do this and still meet compliance obligations.

I'll have to delete my account, unfortunately.

edit:

1. I didn't give Paypal my phone number so that they could use it for this. I gave it to them for banking purposes only. I wonder if this constitutes a GDPR violation?

2. I wonder if contacting their auditors would do anything.

3. Maybe email some of the politicians who care about this stuff - Ron Wyden, Elizabeth Warren?

View on HN

It was also possible to bypass the "give us your phone" nag screen by messing with the url after login. I've been doing it for years now. I think they "fixed" it sometime this year and I had to give them my number :<

This still works for ebay. I get a prompt for a phone number that I can't cancel out of, but I can close that tab and open ebay and I'm logged in just fine.

It's still possible to "mess with the URL" .. you just go type paypal.com again and it won't show the phone number request the second time. So this number request seems to be part of the login flow, but the session cookie is created regardless. My PayPal account still doesn't have a phone number associated with it.

Phone number data is looking great! Here's your bonus.

In what parallel universe auditors make anything meaningful? It's like buying an indulgence and have someone to delegate risks to.

Companies have to get certified, especially ones who handle payments. An auditor can absolutely push for better controls. Will they? Or will Paypal care? That I do not know, but getting pressure from multiple angles can't hurt.

How much would the 'pressure from multiple angles' cost?

After all a free lunch doesn't exist.

PayPal frequently texts me an additional code either after I plugged in my OTP 2FA code or instead of it. Their 2FA implementation is… creative

Key thing to understand is that auditors are paid by the company + often have side business with the company.

Yep, I have gone through SOC2 for a company I run, definitely aware. The idea is just to add pressure.

I have never given paypal my phone number, and can still log in with password.

(This August it would refuse to let me finish logging in without setting up a phone number. I discovered that getting a friend to send me a paypal requst for $1 would get around that requirement.)

A class action lawsuit because you don't like the way that a private company, one that you are not forced to use, has designed functionality?

Bit of a stretch...

GDPR Article 5, 1(b):

> Personal data shall be: […] collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

So it would have to come from someone in the EU.

The GDPR applies in the US but I do think that PayPal is likely only using US numbers for this "feature" because the EU is much more aggressive about protecting users.

The GDPR actually only applies in the EU. You're probably thinking of the CCPA which applies worldwide.

Ah, yeah you're right, I got jumbled.

The GDPR applies to:

1. a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or

2. a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.

Yup! Something needs to be in the EU for the law to apply. It (sadly, imo) doesn't apply to EU citizens resident in, say, Texas.

I agree, it is a bit of a stretch. Just brainstorming, not a lawyer. I think you'd have to either make a GDPR case or otherwise get a bunch of users together who have been targeted / attacked and make a case for PayPal not meeting their obligation to protect users/ making users think they are safer than they are (because they offer 2FA but it can be bypassed).

Reply on news.ycombinator.com