Hacker News new | past | comments | ask | show | jobs | submit login

Reminds me of how PayPal implemented 2FA, then someone immediately found a bypass since they only made 2FA a requirement for a particular web login page instead of EVERY login entry-point (ie mobile or APIs). PayPal's security continues to be embarrassingly bad.



Not only that - I recently spent about one week of constant back-and-forth with their developer support, because I couldn't pay with Paypal on certain sites.

Turns out their digital goods checkout is broken for accounts that have 2fa enabled. Their response was "WONTFIX, disable 2FA".


They're not laughably bad, they have had to manage a huge, aging software system and build infrastructure on top and around it.

They may have made many mistakes, but some of the smartest people I know work there, and most of the work they do is first-class.


> most of the work they do is first-class

Are we talking about the same PayPal?

Have you seen their web interface or their APIs? It hasn't evolved at all in 10 years. It's the same convoluted, bloated, and slow web experience as it was in 2005. Just because a few smart people work there doesn't mean the project is outputting quality software.

Countless software companies have been able to take aging and massive codebases and evolve them to more modern usable states. Most of the time these big companies such as Microsoft or Oracle still output bad software but at least they show signs of evolution and investment. From an outsiders perspective Paypal is particularly bad at this, their software quality and UX has been in a perpetual stasis while Stripe and others eat their lunch. And that's not simply because of their famously bad customer service.


I'm not a PayPal fan - but at least on my account, the UX has changed significantly since 2005 (especially last year or something), and I could find everything I need for my accounting easily.


The general consumer interface is great now. The business interface, however, is not. It's still the same slow UI from 2005. Actually, it feels like they are still running on servers from 2005. Simple (email, date range, etc...) searches take FOREVER.


The business interface is also upgraded unless you decided to opt out.


Can't say I noticed an opt-in, thanks for the info.


Ah, I thought I was automatically upgraded but it was a while ago.


    >> some of the smartest people I know work there
This ridiculously incompetent security flaw suggests otherwise.


The interesting thing is there was a time when PayPal was successful partially due to their excellent security. The story that some ex-PayPal people who are at Palantir tell is that PayPal was very successful in blocking fraudulent transactions where other early online payment players were not. This allowed them to keep their margins higher (not losing to fraud) and spend their money on improving the product.

I have no inside information here, this was told to me by Palantir people when interviewing there.


That sounds like an engineering culture that doesn't let their engineers do things properly. 'It takes too much time and political clout to properly secure our infrastructure, let just do it on one chokepoint!'




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: