<story><title>Bypass PayPal&apos;s Two-Factor Authentication</title><url>https://www.duosecurity.com/blog/duo-security-researchers-uncover-bypass-of-paypal-s-two-factor-authentication</url><text></text></story><parent_chain></parent_chain><comment><author>ashishgandhi</author><text>I&amp;#x27;m glad this was found independently and reported. While I was at PayPal I had started email threads about it but nothing was done. I am sure I was not the only one there who &amp;quot;discovered&amp;quot; this. For instance, even if you have 2FA you can add PayPal to Uber as if you never had 2FA.&lt;p&gt;The other big issue with their 2FA authentication is that it really isn&amp;#x27;t two factor. You can say you don&amp;#x27;t have the token and instead can answer security questions. Two factor is supposed to be something you know plus something you have. &amp;quot;Falling back&amp;quot; to security questions is basically just relying on things you know.</text></comment>
<story><title>Bypass PayPal&apos;s Two-Factor Authentication</title><url>https://www.duosecurity.com/blog/duo-security-researchers-uncover-bypass-of-paypal-s-two-factor-authentication</url><text></text></story><parent_chain></parent_chain><comment><author>rdl</author><text>Based on this timeline, I don&amp;#x27;t understand why Duo didn&amp;#x27;t go public on 2014-04-28 when PayPal began being weasely about their bug bounty program.  This probably would be better for users for two reasons: one, in the past 2 months, this bug may have been exploited in the wild, and two, it would make it easier for users to make informed decisions about which payments providers to use in the future (as well as which 2fa providers are technically competent).</text></comment>