RSSPayPal takes another crack at tightening security
By Angela Gunn | Published November 25, 2008, 9:24 PM
EBay's PayPal service wants users to take security more seriously. To that end, it's combining an old security concept with a device most of us don't associate with security at all. Has PayPal chosen wisely?
The newly recruited security device is the humble mobile phone -- assuming it has SMS service. The old concept is a one-time credential, re-generated every few seconds or minutes and valid for just one use, used in conjunction with one's "other," more permanent password and one's username. The combination of something you know and something you have -- since you "have" the second number, though it'll only be useful for a moment -- is in turn a form of two-factor (or "strong") authentication.
The idea is that just before making a PayPal purchase, the user pings the SMS service (by clicking a button on the site) for a fresh one-time credential. The user types in the usual username and password info and logs in. The SMS service answers the ping with a six-digit number -- that is, the credential. The user types the credential into a field on the subsequent pop-up. If one's mobile provider has a nasty habit of delaying text messages, fear not; PayPal falls back to a series of security questions if the credential doesn't get through in time.
PayPal has made a two-factor effort before, and the new PayPal SMS Security Key is in fact closely related to the gadget-bsed PayPal Security Key, even using the same security infrastructure. The SMS functionality comes from VeriSign's Messaging and Mobile Division, which has been working with hundreds of carriers to build a global identity-protection system.
The entire PayPal program falls under the banner of the VeriSign Identity Protection Network. VeriSign itself, which offers a variety of authentication credentials, rates its own SMS one-time password offering as a 2 (out of 4) for both ease of use and security, but gives it the very best rating for support costs and ease-of-use. (The earlier Security Key version, in contrast, rates 3 for both ease of use and security, though it's a bit more expensive both to support and to deploy.)
PayPal has no plans to discontinue the $5 hardware Security Key, but the SMS version is free (aside from any charges levied by your mobile carrier). Like the Key, the SMS service will work not only on PayPal but on the eBay mothership. The service is available immediately for the US, Australia, Austria, Canada, and Germany.
I tried it. The initial sign up / Authorization message never came through to me. I am on Telus in Canada with unlimited free SMS (for being such a good customer)
Too bad they could not send it via Blackberry PIN message. Those are always instant.
Score: 0
I agree, stick with cash or debit cards. I had a Paypal account once and it was broken into. Luckily I caught it in time, merely by luck however and Paypal offers very little help when this happens and try to get help with it takes a act of congress. I closed my Paypal account, they are not necessary and are dangerous.
Score: 0
*Sticks to cash or debit card*
Score: 0
PAYPAL SMS SECURITY KEY
WILL NOT WORK EVERYWHERE!!!
Depending on carrier:
Some disable sms originating from businesses either in widespread fashion OR depending on text plan and/or account type. And that is often hard coded-- so no one, from the lowliest CS rep to third level Tech Support to the President / Chairman can do anything for you.
The best thing(to avoid this problem-- which can negatively affect banking and credit cards as well) is:
1. always, whenever possible, to sign up thru Business Division(assuming good credit)-- doesn't cost one penny more, & often can find much better deals than offered to the general public anyhow. Business plans expectedly have the least send & receive restrictions / filters in place...and Business Customer Service is not only EONS better, but their reps have 'more power / access to more settings'.
2. get unlimited text plan, rather than lesser text plan options.
3. avoid all prepaid, pay as you go, limited credit(such as T-Mobile FlexPay) plans.
#'s 2 & 3 will always have much more restrictions... not only for spam and other sexurity considerations, but also esp. to avoid a huge bill the customer may not be able to pay anyway.
Most folk AND lower level Customer Service Reps DO NOT KNOW THIS!!!!!!!
You will waste a lot of time troubleshooting to no avail(and as well you will already be hopelessly locked in to a contract without a very needed feature).
Most reps will shoot you a text from a house phone or their own personal phone...that always works...so they'll blame your sender...sending you back to your bank to keep resending...
THOU ART HEREBY FOREWARNED...DO NOT COMETH TO ME CRYING AFTERWARD!!!
Score: 0
There are too many problems with PayPal to ennumerate and more phony sites than real ones. I never use it and probably never will. I don't go to auction sites for the same reason and don't even have an internet messenger.
Why build a tight security system and then fill it full of holes? If that makes me a paranoid, then so be it.
Score: 0
I pretty much gave up on ebay. The last 3 things I've bought have been from sellers with 1000+ positive rankings, but were obviously broken and it was a hassle to either get them repaired, or return them. It just isn't worth it to me to save (pennies?) anymore.
Score: 0
If you aren't able to prevent trouble by buying items which have clear large pictures, you can easily get your money back. File the complaint, and you usually don't have to bother sending the item back, unless the seller responds to several rounds of emails from Paypal, which they usually don't.
Score: 0
eBay does the same thing now, you want to Sell something, they want to call and tell you a confirmation code to enter prior to listing your auction. If it was something they did like once ever 30 / 60 or say 90 days I would be cool with it, but almost every auction I do anymore I have to go through this.
With PayPal, if they went back to the Pre-Ebay owned days, they were much more secure and a better company. PayPal does not need to do anything further to drive people away. Join Google Checkout and sent invoices on the Side to your customers. Less hassle and you pay them less per transaction
Score: 0
That's just far too much p!ssing about in my opinion and totally unnecessary. Better make sure you have your mobile charged up at all times then. Oh and you better make sure you actually have a mobile first! What a pain in the backside this is. [tsk]
Score: 0
andwhat if you dont have a cellphone?
Score: 0
In the UK there are many more cellphones than people, I can't think of anyone over the age of about three that doesn't have one.
Score: 0
Errr not everyone has a mobile. I have one and I'm sure you have one and most people do. But most is not the same as all and I do know people who still don't have a mobile.
Score: 0
Then you use the hardware security key - not too difficult to understand is it?
Score: 0
I don't have a cell phone, have never had one, don't need one, and don't plan on ever having one.
Score: 0
I have a cellphone, I can't imagine too many people who don't but I don't subscribe to SMS. In fact, I have them blocked completely because it's a ****ing rip-off here in the US. I have email on my phone, that's all I need. Why should I pay $0.15 for what roughly equates to 160 bytes of data. Why should I pay that fee when people or companies text me unsolicited?
Score: 0
I know the $5 keyfob I have from them is optional, I assume that this is also. I used a simular service on my BofA account for a while, until I changed cellular companies. I turned it off when I switched.
I don't know how much the key fobs cost to PayPal, but I assume that the infrastructure cost is better for them when we use a cellphone. If you are worried about security, it is a good idea. I use it mainly because other people would be able to answer most of my security questions (ex-wife, sister, ...) that I don't want to access my account. This gives me peace of mind.
Score: 0
AMEN! Text messaging and the CrackBerry is a big WASTE of $$$$$...
Score: 0
I have the $5 hardware security key. Works great
Score: 0