Hacker News Reader

Comment by bushido | Hacker News Reader

To my knowledge they don't know who the thief is.

The thief allegedly got the last 4 digits of the CC by posing as an employee.[0]

If true, it would mean paypal gave out financial information to an unknown third-party, which would be a breach of a bunch of laws, terms, internal policies etc.

The burden to prove innocence in this situation would definitely fall on paypal.

Excerpts from the original article[0]:

>I called paypal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling paypal and asking the agent to add a note to your account to not release any details via phone)

>Yes paypal told me them over the phone (I was acting as an employee) and godaddy let me “guess” for the first two digits of the card

[0] https://medium.com/p/24eb09e026dd

[1] https://news.ycombinator.com/item?id=7141532

View on HN

I dislike paypal as much as anyone, but since when does anyone have to prove innocence?

When you are a financial company.

edit: financial companies, or any company when dealing with a financial or privacy breach usually needs to prove their innocence when they are attributed to allegedly causing financial loss (to varied extents depending on the situation).

This is an expectation from society in general. It may not seem fair or be legally required, but that's just the way it is.

You need a course in elementary logic. Specifically, on the burden of proof. Also, everything you wrote in this comment here seems to be a complete fabrication.

The 'burden of proof' is a social/legal concept which has absolutely nothing to do with elementary logic, so maybe you're the one that needs the refresher.

From https://en.wikipedia.org/wiki/Philosophic_burden_of_proof

When debating any issue, there is an implicit burden of proof on the person asserting a claim. The fallacy of an argument from ignorance occurs if, when a claim is challenged, the burden of proof is shifted to be on the challenger.

The burden of proof is a philosophical concept which extends into the legal domain. In fact, it's the only sane way to process assertions made by purportedly rational actors, it's hardly limited to 'social/legal' contexts.

But I'm not sure why you didn't go look this up in Wikipedia before you commented.

That really does not apply in this situation. A thief made a claim that he tricked PayPal into giving out personal information on his victim. We know the thief got the personal information. What is in question is if he is telling the truth that he got it from PayPal.

You are looking at this as a claim between the thief and PayPal. The thief made the claim, so the burden of proof is on the thief.

But that's not what's going on. PayPayl is asserting a claim that they are safe, and the other party is every potential customer of PayPal. The burden is on PayPal to convince us of their claim that they are safe, in light of the claim against them.

To me, it is credible that the thief got the information from PayPal. Between the thief and PayPal, I think the thief has little incentive to lie about where he got the information, but PayPal has high incentive to cover up.

The burden of proof applies to all logical propositions. You are confusing two issues -- PayPal's marketing claims and those of a random thief. The truth is that you actually have insufficient information to decide one way or another who is telling the truth here, and at least you wouldn't be able to substantiate such a conclusion without appealing to prejudices. That's the point I'm making -- personally I think that the thief is telling the truth. But I'm reserving judgment because we certainly don't know enough to warrant some of the strong claims made on this thread.

I think you are concerned with correctly filling out The Universal Ledger of All Objective Truths. That's not what we're concerned with.

We're concerned with figuring out what we think is most likely. You are correct that we have insufficient information to know with high confidence who is telling the truth, but if we are in a position to use PayPal, we have to make a judgement anyway. Further, not having enough information to know most things with high confidence is the common case; we usually have to make decisions based on imperfect information.

In such cases, we have to use the imperfect information available to us. Prejudices is one word for it; Bayesians call it our priors.

For the record, I actually think PayPal is a net-good. I think that most of the negative press they put up with is unwarranted, and is a result of people not understanding how they are allowed to use the service. In addition, I think most people do not appreciate that PayPal is much more tolerant than the alternative that was the only-game-in-town before PayPal, which were merchant accounts with banks.

Well said, for the most part, although it should be noted that not all prejudices are appropriate priors!

Yes, agreed.

I work for a bank and it's absolutely on us to show that our transactions and treatment of financial information is verifiable. We have to be able to demonstrate due diligence, there is no assumption of innocence when the auditors come knocking on the door, whatever 'elementary logic' may say.

Thats why I completely believe the posters here claiming this wouldn't be possible in a banks call centre. What I don't know is whether PayPal operates at the same standard.

That's a different question altogether. Banks are required to keep meticulous and auditable transaction records -- nobody is disputing that or even questioning if PayPal does so. Banks are not required to show extend themselves to whatever demands made to them, in order to show that the claims of a random internet person are false.

Legally, no. But if enough people find the claim credible, then it is definitely in their best interest to convince everyone else that the claim is false. Whether or not you think that is fair is irrelevant; if enough people feel the bank is not safe to use, the bank will lose business.

Ok well if that's your hand, the converse principle is more pertinent -- if it has no impact on profits, nobody cares about the random rantings of an insular group of technologists, and how they think PayPal ought to conduct itself.

Since there is apparent evidence against their innocence?

What evidence? The chat transcript of a thief?

Since ever? For example anti-harassment law...

when there is a believable story about them getting socially hacked & they have a sea of clients they are trying not to lose...

Reply on news.ycombinator.com