Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Let's Fix PayPal #1026

Closed
26 of 44 tasks
jamcat22 opened this issue Mar 22, 2015 · 12 comments
Closed
26 of 44 tasks

Let's Fix PayPal #1026

jamcat22 opened this issue Mar 22, 2015 · 12 comments
Assignees
@jamcat22

Comments

@jamcat22
Copy link
Member

jamcat22 commented Mar 22, 2015 •
edited
Loading

Get ready for the longest description of an issue yet. There are currently about 14 issues/PRs related to PayPal. Let's face it, their 2FA is broken. It's inconsistent, it's not user-friendly, there aren't adequate docs, and there are many loopholes (but I will give them a chance to fix them first). Let's fix it!

Todo

(A bullet point means in progress.)

  • Determine country compatibility. (See Changed PayPal exception, added more countries #1073.)
  • Fix compatibility matrix on main page. (See PayPal: hardware token supported #1074.)
  • Determine compatibility with desktop account page.
  • Determine compatibility with desktop checkout.
  • Determine compatibility with mobile account page.
  • Determine compatibility with mobile checkout.
  • Determine compatibility with physical store checkout.
  • Determine compatibility with iOS apps.
  • Determine compatibility with iOS APIs.
  • Determine compatibility with Android apps.
  • Determine compatibility with Android APIs.
  • Determine compatibility with Windows Phone app(s).
  • Determine compatibility with Windows 8/8.1/10 app(s).
  • Redo exceptions and add more information on the main page.
  • Write new doc page using information gathered and include instructions on how to use and activate 2FA for PayPal.

Key

  • Login=Can you even login with any 2FA enabled?
  • SMS=Can you use SMS 2FA?
  • Software/Hardware=Can you use Software/Hardware 2FA?

A dash through a property indicates that it is not applicable.
A question mark next to a property means the status is unknown.
A bullet point means the status depends on certain conditions.
When applicable, a screenshot will be provided below or next to the property.

Status

Desktop

Account Page

  • Login
  • SMS
    smsyes
  • Software/Hardware
    shyes

Checkout

  • Login
  • SMS
  • Software/Hardware

Mobile (Webapp)

Responsive Account Page

This is the new design. It is the same as the desktop account page (with the option to login with phone number and PIN added), and therefore inherits its login compatibility.

Responsive Checkout

This is the new design. It is the same as the desktop checkout, and therefore inherits its login compatibility.

Old Checkout (Typically used for donations.)

  • Login - This depends on whether you're logging in with a PIN code or a password. Software/Hardware is allowed when logging in with a password.
    loginno
  • SMS
  • Software/Hardware
    shyes

Physical Store

POS System (PIN Pad)

? Login
? SMS
? Software/Hardware

PayPal App Check In

This is inherited from the main PayPal app on whichever device you use.

iOS

Main App

  • Login
  • SMS
    smsyes
  • Software/Hardware
    shno

PayPal Here App

  • Login
  • SMS
    smsyes
  • Software/Hardware
    shyes

API (PayPal in other apps)

  • Login
  • SMS
  • Software/Hardware

Checking to see if this 2FA can be bypassed...

Android

Main App

  • Login
  • SMS
    smsyes
  • Software/Hardware
    shno

PayPal Here App

  • Login
    no
  • SMS
  • Software/Hardware

Checking to see if this 2FA can be bypassed...

API (PayPal in other apps)

? Login
? SMS
? Software/Hardware

Checking to see if this 2FA can be bypassed...

Windows Phone

Main App

  • Login
    no
  • SMS
  • Software/Hardware

PayPal Here App

  • Login
    loginno
  • SMS
  • Software/Hardware

Windows 8/8.1/10

PayPal Here App

This is inherited from the Windows Phone PayPal Here App, as it is a universal app that works on all Windows platform devices.

Help

Don't help me just yet... When I am done, I will need some help with wording and finding more information.
@jamcat22 jamcat22 self-assigned this Mar 22, 2015
@2factorauth 2factorauth locked and limited conversation to collaborators Mar 22, 2015
@jamcat22 jamcat22 mentioned this issue Mar 23, 2015
Closed
@mxxcon mxxcon mentioned this issue Apr 15, 2015
Closed
@jamcat22 jamcat22 mentioned this issue Apr 16, 2015
Merged
@jamcat22
Copy link
Member Author

I'll go ahead and unlock this now.
For now, just leave workarounds/bugs/loopholes out of the mix until PayPal replies.

@2factorauth 2factorauth unlocked this conversation Apr 16, 2015
@gberche-orange
Copy link

Note that Paypal France does not seem to support TFA: in the account preference, when choosing "security key" (Clé de sécurité), is says it is currently not available ("La clé de sécurité n'est pas disponible actuellement. Réessayez ultérieurement.")

@jamcat22
Copy link
Member Author

@gberche-orange Thanks for letting me know. According to a tweet from PayPal, they only support certain countries (see #1072).

This was referenced May 5, 2015
Closed
Closed
@abetancort
Copy link

Paypal as an online payment processor and bank and ough to support 2FA internationally.
They took upon them to manage their customers' money and credit cards, and because of their own business choice, as thus they have the fiduciary duty to employ the best known practices and maintain the highest standards to secure and maintain secured both online and offline their customers and any third party's financial information (current and past), money, accounts, and credit cards.
It's not their choice and it should not be.

We do need to keep the pressure up on them as they are getting too sloppy for their own good.

@Carlgo11 Carlgo11 mentioned this issue Sep 13, 2015
Closed
@Carlgo11 Carlgo11 mentioned this issue Oct 14, 2015
Closed
@jamcat22 jamcat22 mentioned this issue Nov 28, 2015
Closed
@jamcat22 jamcat22 mentioned this issue Jan 2, 2016
Closed
@jamcat22 jamcat22 mentioned this issue Mar 8, 2016
Closed
@jamcat22 jamcat22 mentioned this issue Apr 25, 2016
Closed
This was referenced May 9, 2016
Closed
Merged
@RichJeanes RichJeanes mentioned this issue Sep 8, 2016
Closed
@jamcat22 jamcat22 mentioned this issue Aug 19, 2017
Closed
@Carlgo11 Carlgo11 mentioned this issue Sep 22, 2017
Closed
@Carlgo11 Carlgo11 mentioned this issue Jan 28, 2019
Closed
@OLLI-S
Copy link

OLLI-S commented Feb 2, 2019

At the German website of PayPal only SMS authentication is available so I contacted the support and asked when 2FA by App will be available.
Here is their reply:

PayPal arbeitet an einer entsprechenden Lösung, kann diese aber aktuell noch nicht zur Verfügung stellen.

Translated into English:

PayPal is working on an appropriate solution, but can not currently make it available.

I asked when it will be available but received the answer that they can not tell me when it will be implemented.

@mxxcon
Copy link
Contributor

mxxcon commented Feb 4, 2019

@OLLI-S pretty much every single business will give you such a vague answer. Unfortunately, that's nothing unusual. :(

@OLLI-S
Copy link

OLLI-S commented Feb 4, 2019

@mxxcon I know, they won't tell us any details so they can't be nailed when they have a delay.

This was referenced Feb 10, 2019
Closed
Closed
@joshsleeper
Copy link

Just an fyi, as of PayPal's policy changes today, I'm now seeing software token as an option when configuring my U.S. account MFA.
This was not the case less than a week ago when I wrote their support contact about being frustrated over the same issue, so it's a pretty recent change.

@kmpoppe
Copy link
Member

kmpoppe commented Apr 4, 2019 via email

@OLLI-S
Copy link

OLLI-S commented Apr 4, 2019

I logged in at Paypay.com/de and went to the account settings.
Now I can add an authenticator app.

PayPal

@kmpoppe
Copy link
Member

kmpoppe commented Apr 7, 2019

Exactly what I was going to say, @OLLI-S ... FINALLY we can have a Software Token/Authenticator App on Paypal! Even in Germany ... dances frantically.
I'd love to know if there are other countries where this now works also?

@kmpoppe
Copy link
Member

kmpoppe commented Sep 21, 2019

PayPal seems to be "fixed" as far as TOTP is concerned.

@kmpoppe kmpoppe closed this as completed Sep 21, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jamcat22 jamcat22

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@mxxcon @joshsleeper @jamcat22 @abetancort @gberche-orange @OLLI-S @kmpoppe