New Paypal Security

[Rich Tate]

Folks who are concerned about the integrity of their Paypal account will soon have an ability to use a keychain like device that will generate a new key every 30 seconds or so.

The PayPal Security Key is actually a small electronic device, designed to clip on to a keychain, that calculates a new numeric password every 30 seconds. PayPal users who sign up to use the device will need to enter their regular passwords as well as the number displayed on the key whenever they log in to the online payment service.

 

[jayx9]

Yeah, this doesnt help people getting scammed through paypal. When someone makes a claim about you and they take your money, or you send someone money and they dont send you anything and you cant get your money back... They need to work on that first before this..

 

[APE992]

It's called a token. Been used for network security for years.

 

[jandar]

Still doesn't help the security of the numerous sellers who used paypal and had their money held for 6 months because Paypal wanted to see reciepts for everything you sold.....


screw paypal

 

[nilepez]

Isn't this still subject to a man in the middle attack? Given that we saw in the past few days that there is some sort of tool that will dynamically copy a website, what's to stop a phisher from copying the site, asking for your info, passing it to paypal, letting you do your thing, then emptying out out whatever is in there (and perhaps more) via some automated script? Presumably, it could skip logging you out when youre done and have it's way with your money.

I suppose, however, that this may be more sophisticated than most phishing systems...they may just collect info and then manually steal your money later on.

 

[Lazybones]

Isn't this still subject to a man in the middle attack? Given that we saw in the past few days that there is some sort of tool that will dynamically copy a website, what's to stop a phisher from copying the site, asking for your info, passing it to paypal, letting you do your thing, then emptying out out whatever is in there (and perhaps more) via some automated script? Presumably, it could skip logging you out when youre done and have it's way with your money.

I suppose, however, that this may be more sophisticated than most phishing systems...they may just collect info and then manually steal your money later on.

True, but this significantly narrows the window of opportunity.

1. The generated keys are only good for a few seconds.
2. As far as man in the middle goes, they would have to be watching you in real time.
3. They would have to fake logging you out, because if the user logged out the system should be locked again.

I think it is a great improvement on the account security front... It is surprising they haven't offered something like this earlier for large copanies doing business on eBay.

 

[pixelbender]

So lets see.....

It makes a crappy service more difficult to use and...
You're still going to get screwed at some point, no matter what.

 

[robble]

I'e had to use these things at work. It's a pain in the a$$.

 

[Fooshnik]

The best way to avoid falling victim to a phishing 'attack', is not to give your password to a phisher, you moron.

 

[Killermac]

I used these at my work to access the VPN servers and to gain access to the intranets. It works very well. While I will agree that they can be a pain it is pretty interesting. I think they might have some problems with people taking on the system at first but it is an interesting way to secure your site.

I believe this will be most popular with Ebay sellers and power users of paypal. I will be interested to see how google checkout takes this on.

KM

 

[robowang]

Will misplacing the key lock you out of your account until it is replaced?
If so, I don't won't it.
Maybe get two devices? That would add a risk.
Lost too many keys, wallets, etc to feel comfortable with this.

 

[Killermac]

Paypal has an FAQ to answer those types of questions. If you were to misspalce the device you just have to verify that you are the owner of the account by answering your security questions.

KM

 

[Diablo2K]

I want to get it just for the novelty of it all, its only 5 bucks! I wonder if there will be more sites/programs that will be able to use it as well.

I think Microsoft should use something like this to stop piracy of Windows, it could be a small USB Key, if they key aint plugged in you get limited access, you could also install windows on ceveral machines and be able to switch between them, add a little memory to the key and you could take your personal setting and bookmarks with you. It wont STOP the piracy but it should at least cut down on it, I know when they made it harder to use pirated versions of windows sales always goes up as people go legit to avoid the hassels.

 

[nilepez]

I want to get it just for the novelty of it all, its only 5 bucks! I wonder if there will be more sites/programs that will be able to use it as well.

I think Microsoft should use something like this to stop piracy of Windows, it could be a small USB Key, if they key aint plugged in you get limited access, you could also install windows on ceveral machines and be able to switch between them, add a little memory to the key and you could take your personal setting and bookmarks with you. It wont STOP the piracy but it should at least cut down on it, I know when they made it harder to use pirated versions of windows sales always goes up as people go legit to avoid the hassels.

I believe that's called a dongle, and pirates have been defeating them for years..

As for sales of windows, perhaps they went up, because in the past you were allowed to install multiple copies, so long as you weren't using them at the same time (thus I could have buy a copy of Windows and install it on the machine at home, my condo Manhattan, the winter house in Cannes without buying a copy for each machine. Can't do that now....I supsect that is true for office as well, but I'm still using office 97, so I have no idea.