Slashdot Log In
PayPal Denies It Will Block Safari
Posted by
kdawson
on Mon Apr 21, 2008 10:18 PM
from the phishing-for-apples dept.
from the phishing-for-apples dept.
Despite reports that PayPal may drop support for Apple's Safari browser because it lacks anti-phishing features, PayPal now says it ain't so. Though PayPal telegraphed displeasure with Safari last January, they're now unambiguous about their position: "We have absolutely no intention of blocking current versions of any browsers, including Apple's Safari, from our website."
Related Stories
[+]
Paypal Advises Users To Stop Using Safari 362 comments
eldavojohn writes "Over concerns for lack of an anti-phishing mechanism for Safari, Paypal is telling its Mac users to use another browser. An author from Ars Technica reveals that he has been using Camino and has fallen victim to a Paypal related phishing scam via e-mail so this story must hit home for him. 'Currently the Apple browser does not alert users to sites that could be phishing for your info, and it lacks support for Extended Validation. PayPal is, of course, a popular site among phishers in their neverending search for personal information, user IDs, and passwords. While it's not entirely fair singling out Safari (other Mac browsers like Camino also lack this support), it is perhaps at least a helpful reminder of the threat.'"
[+]
PayPal Plans To Ban Unsafe Browsers 367 comments
Alternative Details brings news that PayPal is developing a plan to stop users from accessing its financial services if they aren't using browsers with anti-phishing protection. PayPal is recommending the use of blacklists, anti-fraud warning pages, and EV SSL certificates. Browsers without anti-phishing features will be considered "unsafe." It seems likely Safari will be included in this category given PayPal's warning about the Apple browser last month.
"'At PayPal, we are in the process of reimplementing controls which will first warn our customers when logging in to PayPal of those browsers that we consider unsafe. Later, we plan on blocking customers from accessing the site from the most unsafe--usually the oldest--browsers,' he declared. Barrett only mentioned old, out-of-support versions of Microsoft's Internet Explorer among this group of 'unsafe browsers,' but it's clear his warning extends to Apple's Safari browser, which offers no anti-phishing protection and does not support the use of EV SSL certificates."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Current versions? (Score:5, Interesting)
Re:Current versions? (Score:5, Insightful)
However, if you use browsers don't support plug-ins/protocols/captchas/whatever that paypal demands of the browser, you may still be SOL.
In short: I expect there will be a black-list of unacceptable browser versions, rather than a white-list of accepted browser versions.
Parent
Trying with Lynx: (Score:5, Informative)
SSL error:no issuer was found-Continue? (y) y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: cookie_check=yes Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: navcmd=_home-general Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: navlns=0.0 Allow? (Y/N/Always/neVer)y
# FINALLY there's a homepage. "Member Log In" is on the second page.
SSL error:no issuer was found-Continue? (y) y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
Refresh: 1 seconds
https://.../ [...]
SSL error:no issuer was found-Continue? (y) y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
Ok, if I'd hit "a" to those cookies, it would've been a lot better. And there are a fscking LOT of cookies.
Now, I haven't actually tried to do anything with it so far, but I suspect that it would, in fact, work just fine. It's curious that it doesn't like the SSL -- I suspect that's a problem with my version of Lynx, as Firefox and Konqueror don't give me any SSL warnings. But other than that, Paypal isn't doing anything to block Lynx, and it looks reasonably navigateable.
Parent
Re: (Score:3, Informative)
Re:Like I care ? (Score:5, Funny)
Parent
Re:Like I care ? (Score:5, Funny)
*ducks*
Parent
Backpedaling faster tha you can say... (Score:3, Interesting)
Previous: "We know better than you do about what you should and shouldn't be using, so we will stop you possibly getting yourself into trouble."
Current: "Wow, there are so many of you that are quite happy to be wrong that we think you better be allowed to get yourselves into trouble."
My interpretation: Right or wrong, the masses will always win it seems.
Re:Backpedaling faster tha you can say... (Score:5, Informative)
They said that they would block the insecure browsers.
Specifically browsers like IE 5.5 which is old and should never be used anymore.
Parent
Re:Backpedaling faster tha you can say... (Score:5, Insightful)
Parent
Re:Backpedaling faster tha you can say... (Score:5, Interesting)
Ars link [arstechnica.com]
Anti Phishing Block [eweek.com]
So, the general meaning of "so we will stop you possibly getting yourself into trouble" really wasn't wrong. Just because you don't type it in with black and white fonts doesn't mean you don't mean it.
"Lets put this out and check public reaction before we make it 100% official.
Parent
Re: (Score:3, Funny)
It looks like only those that have upgraded from Vista to Win2k are being supported.
When I heard... (Score:5, Funny)
I take it back. PayPal are the terrorists.
People still use Paypal? (Score:3, Interesting)
There are so many other alternatives to Paypal that I don't see why people bother with it.
Re:People still use Paypal? (Score:5, Interesting)
If/when they do this in the U.S., I will stop using eBay. I'm no longer gong to deal with PayPal after the fiasco on a group buy I've been involved with.
Backstory: A bunch of us on a home recording bulletin board set up a group buy to purchase microphones, preamps, shock mounts, etc. from a manufacturer in China. This is about the third or fourth group buy organized by the same person, so his reputation is darn near unquestionable.
After order taking was done, we got sabotaged. Someone (who we strongly suspect works for a company that imports from this vendor and sells at a huge markup) signed up for a Yahoo email account and joined the group buy and requested a small item. Once about 10% of the people had paid their invoices, this person paid for the item, then sent in a claim to PayPal. The problem is that this person claimed to be a member of a bulletin board, yet that person has never been a member of the board in question. So basically the whole complaint was one giant fraud, and we're pretty sure we know who did it, as they have tried to sabotage group buys in the past....
Since the complaint was filed, PayPal's story keeps changing. First, they said that the person claimed he hadn't received an invoice, which is absurd, but easily rectified if the person had contacted anyone involved. Next, PayPal provided lots of details about how the group buy worked (way more than you would normally expect) and said that it wasn't a type of transaction that they wanted to deal with. That I could believe, but it isn't a violation of their TOS as best I can tell. Finally, they claimed that someone had claimed the product was "not as described", which is pure comedy since the manufacturer hasn't started making the products yet. Basically one half truth after the next (and even that half is giving PayPal the benefit of the doubt...).
After about a week of this crap, PayPal finally released everyone's funds. Fortunately, this time, one of the people they were screwing was friends with a highly placed executive at PayPal, so we had some leverage to get the situation expedited and get our funds back in a timely fashion. The last time PayPal screwed over a group buy, it took several weeks before we got our money back. (Yes, these dirty tricks have happened before thanks to a certain company who will remain nameless at least until I can prove it was them---if anybody in Yahoo's mail team would be willing to help with this, you'd have about 400 fans for life....)
Unfortunately, however, the person who set up the group buy had received another payment for an unrelated sale and needed the money to pay his taxes. His account is frozen for something like six months, after which he'll get his money and his account will be closed... all because of a single complaint by someone who could not provide one shred of documentation of any communication with the seller prior to filing the complaint.
Having seen how PayPal treats sellers, I'm no longer inclined to do business with PayPal. If I can't trust them to hold up their contractual obligations and do so in an equitable and reasonable fashion, then why should I trust them with my hard-earned money? I'm not protected any better than I used to be back when eBay sales all happened with cashier's checks, so why should PayPal be getting a cut if they aren't providing any real additional protection for the transaction?
At this point all I can say is this: PayPal Sucks [paypalsucks.com], and if you deal with them long enough, you will eventually get burned. It's just a question of when.
Parent
Re:People still use Paypal? (Score:5, Interesting)
I run a business, about a month ago we started to accept PayPal as payment (while waiting for our own merchant account to clear). We made about $17k in a week. We transferred the first $7.5k to our bank account (thank god!) after a day or two. After no more than seven days, PayPal closed our account, without giving any reason.
After having our lawyer write some letters to them (they didn't respond to us ourselves at all), and PayPal giving several different and evasive andwers, it came out that the 'contact person' for our business account had once ordered something of an erotic nature with PayPal, and that is against their agreement.
Now, several things are wrong with that. I won't go so far as to say that person has never bought erotica, I don't know and really don't care. What is definitely wrong with that, though, is that said person has only made two PayPal payments in his life and they weren't related to erotica (yes I am sure of this). Furthermore, PayPal mentions accounts that do not actually exist and never have. It's complete BS.
What else is wrong with that, how the hell can they close a business account because they do not like the contact person's personal account. Since when is a company responsible for their employees' private actions? What's worse, their allegations aren't even true.
So now PayPal is sitting on $10k of my money I desperately need, without a valid reason. They refuse to clear it, they refuse to discuss it. They have even refused giving us the 'offending' transaction details (how the hell can we dispute anything if we don't have access to the data?) - lawyer is dealing with that, though.
All in all, the money, the lawyer costs, the lost customers, reputation damage, etc, are now easily more than a $50k loss for us.
Should you read this and be a no cure no pay type lawyer (hey, PayPal got my money) in the UK, feel free to drop me a line so we can talk about sueing PayPal's pants off (our company lawyers cannot help us there, as PayPal Europe operates under English law and we're not from England).
Hey, I thought it wouldn't happen to me. But yeah I got burned. Doing business with PayPal is an accident waiting to happen...
Parent
Too late, CTO should resign (Score:3, Informative)
http://forums.macworld.com/thread/98919?tstart=0 [macworld.com]
I have never seen a thing like that. Macintosh community hates them so much after that disastrous stupid statement that I STILL get new message alerts after 2 months as people keep commenting how stupid they are, Verisign bribed them, MS lapdog, eBay is scam.
This is a OS that loads ocsp on startup to check the SSL certs at core OS level:
Apr 22 09:07:29 quad
EV matters? How much it cost to a commercial site at size of Paypal? Does Paypal feel their consumers are insecure instead of using FREE data from community powered services like http://www.phishtank.com/ [phishtank.com] ?
Post a job listing for Cocoa/Carbon, Objective C developer. Cough some money and distribute your plugin. Don't use "No XUL" as excuse, it is easy to watch current URL on Safari. ICQ from 2003 can still read it.
Re:Are you sure? (Score:4, Funny)
But trust me.... You don't.
I think you just want to make yourself sound smart, when in reality you don't know what you are talking about.
This is how bad info gets passed around.
If you don't know about the topic....Don't make yourself sound like you do.
PayPal's only motivation in blocking Safari is to keep the gays out. That's all. Don't paint any sinister motivation. That's just good business sense.
Parent
Re:Are you sure? (Score:4, Funny)
This prompted us to contact you. In exchange for passing on you slashdot account details you will be credited with 10% of the mod points, The Transaction is 100% Legal and totally free of risks as all modalities has been Perfected to ensure the hitch free success of the Transaction, however due to some security risks we can only accept applicants who are using an recent version of Mac os X
I look forward to hearing from you http://www.slashdot.scam.nig/ [scam.nig]
Parent
Re:Are you sure? (Score:5, Insightful)
The increasing popularity of mobile browsing is an opportunity for Paypal to act as a mobile digital wallet. There's certainly no point in carrying a debit card if you can just use your phone. I'm guessing that is Paypal's aim. Whether or not they can beat the banks to direct money transfer is debatable though.
Parent
Re:Are you sure? (Score:5, Insightful)
I can't imagine why anyone would think it was insecure.
Parent
Re:Are you sure? (Score:5, Insightful)
Parent
Re:Are you sure? (Score:4, Insightful)
Parent
Re:Wish Apple Would Fix it (Score:5, Informative)
Now you have a little bar at the bottom of Safari that shows you the actual target of links.
Parent
That isn't a difference based on browser (Score:5, Informative)
Since your IE and Firefox cookies are not shared, my guess is that you haven't logged in on IE recently. Try logging in for both browsers then logging out and attempting a purchase. You'll get identical behavior.
Disclaimer: IANAEOP (I am not an employee of Paypal) but half my business runs through them.
Parent
Re: (Score:3, Interesting)
The real question is what exactly does this do for "security". Anything that PayPal does on their end will have no affect on phishing sites. All current web browsers, regardless of how PayPal treats them, will function with phishing si