Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Businesses Apple

PayPal Denies It Will Block Safari 98

Posted by kdawson from the phishing-for-apples dept.
Despite reports that PayPal may drop support for Apple's Safari browser because it lacks anti-phishing features, PayPal now says it ain't so. Though PayPal telegraphed displeasure with Safari last January, they're now unambiguous about their position: "We have absolutely no intention of blocking current versions of any browsers, including Apple's Safari, from our website."
This discussion has been archived. No new comments can be posted.

PayPal Denies It Will Block Safari More

PayPal Denies It Will Block Safari

Comments Filter:

  • Current versions? (Score:5, Interesting)

    by calebt3 ( 1098475 ) on Monday April 21, 2008 @09:23PM (#23153832)
    So up-to-date Lynx, Links2, Dillo, etc are all perfectly acceptable?

    • Re:Current versions? (Score:5, Insightful)

      by menace3society ( 768451 ) on Monday April 21, 2008 @10:17PM (#23154232)
      I think the point is that they won't specifically block them. They will block browser programs that are known to be unsuitable, like the Netscape 2, or IE 4, or Mosaic.

      However, if you use browsers don't support plug-ins/protocols/captchas/whatever that paypal demands of the browser, you may still be SOL.

      In short: I expect there will be a black-list of unacceptable browser versions, rather than a white-list of accepted browser versions.

    • Trying with Lynx: (Score:5, Informative)

      by SanityInAnarchy ( 655584 ) <ninja@slaphack.com> on Monday April 21, 2008 @10:30PM (#23154318) Journal
      lynx https://www.paypal.com/ [paypal.com]
      SSL error:no issuer was found-Continue? (y) y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: cookie_check=yes Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: navcmd=_home-general Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: navlns=0.0 Allow? (Y/N/Always/neVer)y
      # FINALLY there's a homepage. "Member Log In" is on the second page.
      SSL error:no issuer was found-Continue? (y) y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      Refresh: 1 seconds
      https://.../ [...]
      SSL error:no issuer was found-Continue? (y) y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y
      www.paypal.com cookie: (censored) Allow? (Y/N/Always/neVer)y ...

      Ok, if I'd hit "a" to those cookies, it would've been a lot better. And there are a fscking LOT of cookies.

      Now, I haven't actually tried to do anything with it so far, but I suspect that it would, in fact, work just fine. It's curious that it doesn't like the SSL -- I suspect that's a problem with my version of Lynx, as Firefox and Konqueror don't give me any SSL warnings. But other than that, Paypal isn't doing anything to block Lynx, and it looks reasonably navigateable.

      • Re: (Score:3, Informative)

        by JackieBrown ( 987087 )
        It works fine in elinks

      • Re: (Score:1, Funny)

        by Anonymous Coward
        You're using the Vista Lynx.
        • Nah, Lynx was always like that...

          Oh my god.

          That's where Microsoft got UAC from! Combine lynx with sudo, and... *shudders*
      • I wonder why they set so many cookies. Why not just have a single session cookie, and keep all other session values on the server? It must create a little extra traffic having to send back all those cookie values on every single request. Cookies have their use if you have no server-side scripting support, like on the old Geocities and Tripod hosting services, but I don't see much of a use for them otherwise.

        • Re: (Score:2)

          by yuna49 ( 905461 )
          Firefox lists eleven cookies from PayPal, only a few of which are session cookies. The rest all have expiration dates a decade or two from now. I presume some of these are used to track my behavior over longer periods for whatever advertising or marketing value this information might provide. Some seem rather weird though like a cookie called simply "Apache" with a 2037 expiry. Will we still be using Apache in 2037?

          There's also a paypal.112.2o7.net [omniture.com] cookie, which I find more obnoxious than PayPal's own.

          • Some seem rather weird though like a cookie called simply "Apache" with a 2037 expiry.

            That's interesting, given that the Unix Epoch [wikipedia.org] expires late January of 2038.

  • Backpedaling faster tha you can say... (Score:3, Interesting)

    by Fluffeh ( 1273756 ) on Monday April 21, 2008 @09:26PM (#23153848)
    Wowsa, that change is quicker than it takes the read the following:

    Previous: "We know better than you do about what you should and shouldn't be using, so we will stop you possibly getting yourself into trouble."

    Current: "Wow, there are so many of you that are quite happy to be wrong that we think you better be allowed to get yourselves into trouble."

    My interpretation: Right or wrong, the masses will always win it seems.
  • they're now unambiguous about their position "We have absolutely no intention of blocking current versions of any browsers, including Apple's Safari, from our website."

    It still sounds ambiguous to me. They could certainly mean "We will not target Safari by name, but we will just make you install a plugin that we know Safari can't use".

    • Re:Are you sure? (Score:4, Funny)

      by Anonymous Coward on Monday April 21, 2008 @09:45PM (#23153974)
      I work for PayPal, so I'm getting a kick out of these replies. Some of you guys are very good at making it sound like you know what you are talking about.

      But trust me.... You don't.

      I think you just want to make yourself sound smart, when in reality you don't know what you are talking about.

      This is how bad info gets passed around.

      If you don't know about the topic....Don't make yourself sound like you do.

      PayPal's only motivation in blocking Safari is to keep the gays out. That's all. Don't paint any sinister motivation. That's just good business sense.

      • Re: (Score:1, Offtopic)

        by menace3society ( 768451 )
        Well trolled, sir. Well-trolled.

      • Re: (Score:1, Funny)

        by Anonymous Coward

        I work for PayPal ...
        Don't ever shave your head then.

        The "666" will show.
      • You are new here aren't you?
      • Dude... this isn't Fark /Random slashie

      • Re:Are you sure? (Score:4, Funny)

        by RiotingPacifist ( 1228016 ) on Tuesday April 22, 2008 @04:09AM (#23155914)
        I work for the federal bank of Nigeria, i would like to inform you that a recently deceased prince, left 500 mod points in his acount. No one will ever come forward to claim them and according to The Law of Nigerian Government, at the expiration of 10 years the, Money will revert to the Ownership of the Nigerian Government. We decided to contact you to assist me in claiming these mod points for safe Keeping and investments on her behalf as everything will be taken over by the government as provided in section 129 sub 63(N), Africa Banking Edit of 1961.
        This prompted us to contact you. In exchange for passing on you slashdot account details you will be credited with 10% of the mod points, The Transaction is 100% Legal and totally free of risks as all modalities has been Perfected to ensure the hitch free success of the Transaction, however due to some security risks we can only accept applicants who are using an recent version of Mac os X

        I look forward to hearing from you http://www.slashdot.scam.nig/ [scam.nig]

    • Re:Are you sure? (Score:5, Insightful)

      by Admiral Ag ( 829695 ) on Monday April 21, 2008 @10:09PM (#23154168)
      They can't afford to block Safari, not because of the Macintosh or Windows version, but because of the iPhone/iPod Touch version. The latter is rapidly becoming the standard for mobile browsing (or at least has such a large share that it cannot be ignored).

      The increasing popularity of mobile browsing is an opportunity for Paypal to act as a mobile digital wallet. There's certainly no point in carrying a debit card if you can just use your phone. I'm guessing that is Paypal's aim. Whether or not they can beat the banks to direct money transfer is debatable though.

      • Re:Are you sure? (Score:5, Insightful)

        by Hal_Porter ( 817932 ) on Monday April 21, 2008 @10:12PM (#23154186)
        Yeah, Safari is great on the iPod touch. I can browse to a web page to jailbreak the machine.

        I can't imagine why anyone would think it was insecure.

        • Re:Are you sure? (Score:5, Insightful)

          by Admiral Ag ( 829695 ) on Monday April 21, 2008 @10:43PM (#23154404)
          Then it is in Apple's interest to work with companies like Paypal to improve security. This is a case where market incentives can provide a solution. Of course it ought to be done in such a way that doesn't prevent people from jailbreaking their units if they want to.

          • Of course it ought to be done in such a way that doesn't prevent people from jailbreaking their units if they want to.
            How will that work? The iPhone was supposed to be locked down like a cellphone and the Touch inherited that. If you can jailbreak a machine you can also run arbitrary code on it by definition. Which means it is insecure.

            • Re: (Score:1, Troll)

              by RiotingPacifist ( 1228016 )
              Yeah i mean its like they're running a web browser with admin privileges! Bash windows as much as you like but with windows you know you fscked, mac users seam to think they're safer, but running a web browser as root is a throw back to 2001. How hard would it be to crack out a wifi hostspot that modifies the webpage your browsing to install malicious payload. Hell the issue paypal are talking about is ssh, without something like EVS, it would be very easy to crack out wifi hot spots that steal all your pay

              • Re: (Score:1, Troll)

                by RiotingPacifist ( 1228016 )
                Yeah i mean its like they're running a web browser with admin privileges! Bash windows as much as you like but with windows you know you fscked, mac users seam to think they're safer, but running a web browser as root is a throw back to 2001. How hard would it be to crack out a wifi hostspot that modifies the webpage your browsing to install malicious payload. Hell the issue paypal are talking about is ssh, without something like EVS, it would be very easy to crack out wifi hot spots that steal all your pay

                • Re: (Score:2, Interesting)

                  by Hal_Porter ( 817932 )
                  I wonder if you could make a OS X exploit that works on both ARM and x86. You'd need to find a sequence of four bytes that was a NOP or something harmless on one architecture and a jump on the other?

                  I was thinking of something like this

                  0x67 0xE9 Lo Hi

                  Which is a jump rel16 on x86, overriden by the address size prefix. On a little endian ARM this looks like this

                  0xHiLoE967.

                  Now if rel16 was negative and between 0 and -256 I could make it Hi=0xFF. Which used to mean NV, i.e. the instruction would be a NOP regard

        • Re:Are you sure? (Score:4, Insightful)

          by mr100percent ( 57156 ) on Tuesday April 22, 2008 @04:54AM (#23156046) Homepage Journal
          That was in the 1.1.1 version, last year. Apple patched it up pretty quickly and the mobile apps are also running as a different, non-root user.

      • Re: (Score:2, Funny)

        by Anonymous Coward

        They can't afford to block Safari...

        And they don't need to. Steve Jobs reality distortion field automatically negates phishing. However unlike all other anti-phishing techniques, instead of patching the browser, this method patches the user. So never fear, you are safe...

      • Re: (Score:3, Informative)

        by xaxa ( 988988 )

        The increasing popularity of mobile browsing is an opportunity for Paypal to act as a mobile digital wallet. There's certainly no point in carrying a debit card if you can just use your phone. I'm guessing that is Paypal's aim. Whether or not they can beat the banks to direct money transfer is debatable though.

        But there's hardly any inconvenience through carrying a debit card anyway...

        Having said that, in Japan some phones have transport passes integrated into them, and in London there's an integrated transport pass, credit card and RFID 'small purchase' card [wikipedia.org] (for buying coffee etc), though I'm not sure how well the latter is catching on, I haven't seen anyone with one yet.

        Paypal would have to reduce their fees a lot to gain much use by retailers, but maybe that will encourage the card processing companies to re

  • When I heard... (Score:5, Funny)

    by v(*_*)vvvv ( 233078 ) on Monday April 21, 2008 @09:39PM (#23153940)
    they were going to deny certain browsers, I said the terrorists won.

    I take it back. PayPal are the terrorists.

  • People still use Paypal? (Score:3, Interesting)

    by Anonymous Coward on Monday April 21, 2008 @10:16PM (#23154214)
    I closed my Paypal *and* eBay accounts when eBay said you HAD to accept Paypal in order to sell stuff and Paypal said they would hold payments for 21 days. Hated to see all that positive eBay feedback go, but I don't like being dicked around by corporate bozos.

    There are so many other alternatives to Paypal that I don't see why people bother with it.
    • There are so many other alternatives to Paypal that I don't see why people bother with it.

      Hmm, maybe because PayPal works well for 99% of the set of users who aren't trying to pull something underhanded.

    • Re:People still use Paypal? (Score:5, Interesting)

      by dgatwood ( 11270 ) on Monday April 21, 2008 @11:29PM (#23154710) Homepage Journal

      If/when they do this in the U.S., I will stop using eBay. I'm no longer gong to deal with PayPal after the fiasco on a group buy I've been involved with.

      Backstory: A bunch of us on a home recording bulletin board set up a group buy to purchase microphones, preamps, shock mounts, etc. from a manufacturer in China. This is about the third or fourth group buy organized by the same person, so his reputation is darn near unquestionable.

      After order taking was done, we got sabotaged. Someone (who we strongly suspect works for a company that imports from this vendor and sells at a huge markup) signed up for a Yahoo email account and joined the group buy and requested a small item. Once about 10% of the people had paid their invoices, this person paid for the item, then sent in a claim to PayPal. The problem is that this person claimed to be a member of a bulletin board, yet that person has never been a member of the board in question. So basically the whole complaint was one giant fraud, and we're pretty sure we know who did it, as they have tried to sabotage group buys in the past....

      Since the complaint was filed, PayPal's story keeps changing. First, they said that the person claimed he hadn't received an invoice, which is absurd, but easily rectified if the person had contacted anyone involved. Next, PayPal provided lots of details about how the group buy worked (way more than you would normally expect) and said that it wasn't a type of transaction that they wanted to deal with. That I could believe, but it isn't a violation of their TOS as best I can tell. Finally, they claimed that someone had claimed the product was "not as described", which is pure comedy since the manufacturer hasn't started making the products yet. Basically one half truth after the next (and even that half is giving PayPal the benefit of the doubt...).

      After about a week of this crap, PayPal finally released everyone's funds. Fortunately, this time, one of the people they were screwing was friends with a highly placed executive at PayPal, so we had some leverage to get the situation expedited and get our funds back in a timely fashion. The last time PayPal screwed over a group buy, it took several weeks before we got our money back. (Yes, these dirty tricks have happened before thanks to a certain company who will remain nameless at least until I can prove it was them---if anybody in Yahoo's mail team would be willing to help with this, you'd have about 400 fans for life....)

      Unfortunately, however, the person who set up the group buy had received another payment for an unrelated sale and needed the money to pay his taxes. His account is frozen for something like six months, after which he'll get his money and his account will be closed... all because of a single complaint by someone who could not provide one shred of documentation of any communication with the seller prior to filing the complaint.

      Having seen how PayPal treats sellers, I'm no longer inclined to do business with PayPal. If I can't trust them to hold up their contractual obligations and do so in an equitable and reasonable fashion, then why should I trust them with my hard-earned money? I'm not protected any better than I used to be back when eBay sales all happened with cashier's checks, so why should PayPal be getting a cut if they aren't providing any real additional protection for the transaction?

      At this point all I can say is this: PayPal Sucks [paypalsucks.com], and if you deal with them long enough, you will eventually get burned. It's just a question of when.

      • Re: (Score:1, Troll)

        by RiotingPacifist ( 1228016 )
        Wait so you had an open group, and somebody messed up your group, so your blaming paypal. If I was paypal id of told you to sort out your end, and done whatever i wanted. I'm not sure if i understand this group buy stuff, but if their unrelated to paypal, its making a pool to pay for a something, you send somebody into a store, that person messes the store around, then blaming the store for thier actions.

        to GP: I'm sure they miss you! but in order to keep ebay popular they have a commitment to the users abo

        • Re: (Score:2)

          by makomk ( 752139 )
          Are you trolling or did you just not read the comment? The whole point was that the person who was doing the actual purchasing for the group buys was honest and did their part, but someone put in an order for a part in the group buy then made some blatantly false claims, and Paypal majorly (and unjustifiably) screwed over the person doing the purchasing as a result (which was probably the reason for the false claims in the first place).

      • Re:People still use Paypal? (Score:5, Interesting)

        by SirJorgelOfBorgel ( 897488 ) * on Tuesday April 22, 2008 @06:24AM (#23156362)
        Yup, PayPal definitely sucks.

        I run a business, about a month ago we started to accept PayPal as payment (while waiting for our own merchant account to clear). We made about $17k in a week. We transferred the first $7.5k to our bank account (thank god!) after a day or two. After no more than seven days, PayPal closed our account, without giving any reason.

        After having our lawyer write some letters to them (they didn't respond to us ourselves at all), and PayPal giving several different and evasive andwers, it came out that the 'contact person' for our business account had once ordered something of an erotic nature with PayPal, and that is against their agreement.

        Now, several things are wrong with that. I won't go so far as to say that person has never bought erotica, I don't know and really don't care. What is definitely wrong with that, though, is that said person has only made two PayPal payments in his life and they weren't related to erotica (yes I am sure of this). Furthermore, PayPal mentions accounts that do not actually exist and never have. It's complete BS.

        What else is wrong with that, how the hell can they close a business account because they do not like the contact person's personal account. Since when is a company responsible for their employees' private actions? What's worse, their allegations aren't even true.

        So now PayPal is sitting on $10k of my money I desperately need, without a valid reason. They refuse to clear it, they refuse to discuss it. They have even refused giving us the 'offending' transaction details (how the hell can we dispute anything if we don't have access to the data?) - lawyer is dealing with that, though.

        All in all, the money, the lawyer costs, the lost customers, reputation damage, etc, are now easily more than a $50k loss for us.

        Should you read this and be a no cure no pay type lawyer (hey, PayPal got my money) in the UK, feel free to drop me a line so we can talk about sueing PayPal's pants off (our company lawyers cannot help us there, as PayPal Europe operates under English law and we're not from England).

        Hey, I thought it wouldn't happen to me. But yeah I got burned. Doing business with PayPal is an accident waiting to happen...

        • Re: (Score:2)

          by jrumney ( 197329 )
          Paypal Europe operates under Luxembourg law now, and they are a bank, so subject to whatever requirements Luxembourg puts on banks for handling disputes and account closures. Fire your lawyer and get a new one, as they are clearly incompetent if they have not figured this much out yet.

        • Re: (Score:2)

          by dgatwood ( 11270 )

          Hey, I thought it wouldn't happen to me. But yeah I got burned. Doing business with PayPal is an accident waiting to happen...

          And the sad thing is how many people say just that. We read the stories and assume it's just a fluke---that it can't happen to us---but in reality, it can, and almost every person who PayPal screws is someone just like us. PayPal is basically the internet equivalent of a tumor. Most of the time, it's benign, but in those few cases, by the time you notice that it isn't, it's too

      • Wait... Paypal isn't regulated? [paypalsucks.com] What the hell? How can a company who deals with stuff like this not be accountable to anyone?
    • There are so many other alternatives
      How many of them have the international presense and existing userbase that paypal does?

      Yes paypal charges fees but paying both the foriegn transaction fee on my debit card AND bidpays fees is a lot more expensive.

      and the price for a bank transfer from my british account to a german account was stupidly high (I ended up sending cash through the post for that transaction because that was the only mutually acceptable method that the seller and I could come up with).
    • Tell me the alternatives. I am not trolling, I just want to know.
  • Common sense would say Why should we not block Safari ? It's up to the Safari developers to make it more secure, not PayPal to make exceptions because it's for "Mac" users.

    • Re: (Score:2, Funny)

      by Hal_Porter ( 817932 )
      But Mac users are oppressed! I went on the chans and posted a picture of my new Macbook Air with the text "My Daddy just bought me a Macbook Air" and was banned for something called "faggotry". Whatever that is. Where ever I go on the Internet it's the same.

    • Re: (Score:3, Insightful)

      by danielsfca2 ( 696792 )
      Oh stuff it.

      I don't need a phishing filter and I don't WANT a phishing filter. I'm a big boy who can read URLs just fine, thanks. I don't get to sensitive sites by untrusted links. I use my fingers to type the URL or I use a bookmark.

      I also don't need Norton Internet Security, or anti-spyware apps, on my Mac OR on my PC--because I don't install trash downloaded from the Internet willy-nilly.

      Aside from this worthless argument, no one has explained how Safari is any less secure than Firefox or MSIE.
      • EVS
        anti-phishing is important for the masses
        doest show you a URL, before you click it (by default, again default is important for the masses).

        Sure you dont need security, but that's like saying that corporate networks should use virus scanners because they're users should be smart enough to not get infected / scammed.

        I could browse the web using lynx and not get scammed, it doesn't mean that anybody else can.
        • Safari does show me a URL before I click it. In the status bar. Just like every other browser. When I have a link in Mail, the tooltip tells me. And I don't give a crap about Apple not showing the status bar by default. And most users don't know what the status bar is anyway and don't even look for the URL on mouseover one way or another. I guess Apple decided anyone who didn't look at the SB anyway wouldn't miss it.

          The only anti-phishing browser that's guaranteed to work would have to work like MSIE's or F

          • In the "blacklist" mode these silly add-ons are not likely to be nearly as safe as just having a clue.
            But 100% better than not having a clue, anti-phising tools help those that dont even know about the status bar.

            p.s safari could learn a thing from fission, I do quite like the safari look, plus its not hard to pop the address into the status bar on hover.
            • Hmm... An interesting add-on I had not looked at before. However as far as using the address bar to show the destination of a link, that bothers me. Then your scammer will make the whole page a giant link to http://www.realbank.com/ [realbank.com] so wherever your cursor is you'd see realbank.com in your address bar. Of course they'd add return false JS handlers to prevent a click from triggering said link.

              I still think just using the status bar is the best idea, and it's not tough to find in Safari. View>Status bar. N

    • Re: (Score:2)

      by kellyb9 ( 954229 )
      Common sense would also say - that ebay wants to make as much money from everyone they can.
    • I bring to you the entire history of the web vs IE.

  • Too late, CTO should resign (Score:3, Informative)

    by Ilgaz ( 86384 ) * on Tuesday April 22, 2008 @01:14AM (#23155202) Homepage
    I invite you to check Macworld discussion at
    http://forums.macworld.com/thread/98919?tstart=0 [macworld.com]

    I have never seen a thing like that. Macintosh community hates them so much after that disastrous stupid statement that I STILL get new message alerts after 2 months as people keep commenting how stupid they are, Verisign bribed them, MS lapdog, eBay is scam.

    This is a OS that loads ocsp on startup to check the SSL certs at core OS level:
    Apr 22 09:07:29 quad /usr/sbin/ocspd[1735]: starting (system.log)

    EV matters? How much it cost to a commercial site at size of Paypal? Does Paypal feel their consumers are insecure instead of using FREE data from community powered services like http://www.phishtank.com/ [phishtank.com] ?
    Post a job listing for Cocoa/Carbon, Objective C developer. Cough some money and distribute your plugin. Don't use "No XUL" as excuse, it is easy to watch current URL on Safari. ICQ from 2003 can still read it.

    • oh noes a bunch of fan boys rushed to irationally hate a company for putting out a whitepapper then implementing sane security messures, quick resign, infact the whole company should go bankrupt, hell they should go bankrupt then kill themselves for what theyve done.

      OH, right its just 5% of 5%, im tempted to start using pay pal, only if they ban safari, just to keep mac fanboys crying.

      EV matters? How much it cost to a commercial site at size of Paypal? Does Paypal feel their consumers are insecure instead of using FREE data from community powered services like http://www.phishtank.com/ [phishtank.com] [phishtank.com] ?
      Post a job listing for Cocoa/Carbon, Objective C developer. Cough some money and distribute your plugin. Don't use "No XUL" as excuse, it is easy to watch current URL on Safari. ICQ from 2003 can still read it.

      to the 5% of the users that know how to install plugins, thats great, but the fact is that unless its done by default, phis

      • Re: (Score:3, Interesting)

        by Ilgaz ( 86384 ) *
        Well here are facts. One of least popular (if popular at all) extensions for firefox is the EV certificate thing. They (Verisign) couldn't even make it work right. Phishing prevention is one thing, selling your soul to Google and send them every single URL (including the page part) you visit is another. There are Paypal phishing pages which are up for DAYS as you can see from http://www.phishtank.com/ [phishtank.com] which they (as they are mega corp) can call the countries police chief directly from his home phone and get

        • Well here are facts. One of least popular (if popular at all) extensions for firefox is the EV certificate thing. They (Verisign) couldn't even make it work right.

          Thats my point, few people are going to install extensions, and even fewer will do it for security extensions, that's why this sort of thing has to come by default.

          Phishing prevention is one thing, selling your soul to Google and send them every single URL (including the page part) you visit is another.

          True, but paypal havent said you have to sell your soul to google, hell i quite liked the FF2 method of downloading a list, do that regularly with diffs and you dont really need to send anybody your URLS

          There are Paypal phishing pages which are up for DAYS as you can see from http://www.phishtank.com/ [phishtank.com] which they (as they are mega corp) can call the countries police chief directly from his home phone and get site raided.

          True, but some sites can be unknowningly infected, others can be in strange juristicion, its alot harder to catch them than it is to try and

          • Just had "Update" window at 1Password.app , a shareware, 2 guys coded password manager which is practically all browser support (except Opera). It is not from $billion Paypal/Ebay empire.

            "The most notable improvements is a new Change Password window to make updating online password easy, as well as enhanced Anti-Phishing integration with PhishTank."

            See? That was what I mean to Paypal or anyone with billions of dollars in hand and thousands of IT personnel. 2 Guys from Canada who are in fact new to OS X (com

  • Missed Phishing Opportunity (Score:3, Insightful)

    by edalytical ( 671270 ) on Tuesday April 22, 2008 @01:40AM (#23155316)

    Perhaps PayPal realized what a phisherman's dream this would be: "Can't access your PayPal with Safari? Signup for PhishPal to get instant unrestricted access. We only need your email address, ssn, bank account number, credit card numbers and drivers license."

    Joking aside, just teach people to type addresses in the address bar, and to check the address bar and status bar when they are entering sensitive information. Problem solved.

    • Joking aside, just teach people to type addresses in the address bar, and to check the address bar and status bar when they are entering sensitive information. Problem solved.
      They tried that, it turns out users are idiots.

      • I don't mean teaching by forcing the users to view a page when the login. Of course that doesn't work. People are not idiots and they can quickly figure out how to skip nonsense to get to the real service.

        No this kind of basic computer education is up to the schools, parents, local communities, computer retailers, ISPs, television show and governments. If PayPal really wants to do something to help they should sponsor a bill that will make basic computer education part of a schools accreditation. Bett

        • Sounds good in theory, but given most people live to 80, it leaves you with a 70 year gap. Especially as its not kids that get phished but usually people who spent the first 40/50/60 years of thier life without a PC
          • That would be covered by "basic computer education is up to...local communities, computer retailers, ISPs, television shows and governments...to educate teens and adults."
  • I'm wondering... how those Paypal folks could "block" your browser? Do they rely on your UserAgent? There must be some UASwitcher plugin for every browser out there, so you can easily bypass their filter... Any idea about how they filter you out?
  • We all agree that IE sucks, right?

    Well by that logic, Microsoft sucks too, and people who think Microsoft is good, are Microtards.

    So,

    IE belongs in the TRASH MICROTARDS!!

Slashdot Top Deals

Children begin by loving their parents. After a time they judge them. Rarely, if ever, do they forgive them. - Oscar Wilde

Close