Gadgetell | Tech News, Reviews, and Interesting Things

It looks like we may have all misinterpreted PayPal’s announcement that it will block users who are using old browsers when doing online transactions at PayPal. Some reports have included Apple’s Safari browser as among those that will be blocked by PayPal.

PayPal has denied this report by saying that it has no intention of blocking current versions of any browsers that include the Safari browser from accessing it’s site. And to clarify, it will only block customers from logging into the PayPal when using obsolete browsers on outdated or unsupported operating systems, such as IE4 running on Windows 98.

Actually, the confusion may have started when reports cited that the Safari browser does not support Extended Validation SSL Certificates.

So there, the confusion is cleared and clarified. Safari users can still access PayPal’s site using their trusty browser. End of story.

Via [Mac Daily News]

Ever since Paypal became the most used Internet payment site, they have had a huge problem with phishing schemes.  Now, in an effort to combat such schemes, Paypal has turned to their new Security Key, a keychain fob similar to the ones that online banks have been using for years.

With the new device, a unique one-time-use password is generated every 30 seconds.  Users will be prompted for not only their username (or email) and password as before, but they will also be asked to enter in this new number.  Regular users will be asked to pay $5 for the fob, while business users will be offered one for free.  The new layer of security may seem like it is indestructable, but as Jason from Gizmodo points out, there are two scenerios where the Security Key’s number will no longer matter.

In one scenerio, the phishers could somehow gain knowledge of your specific Security Key’s algorithm.  This is obviously very unlikely since the chance of finding any sequence in a series of 6 random numbers is near impossible.  The next scenerio is if a user is tricked into entering their username, password, and keygen in a phishing site, the phishers will have 30 seconds to login to Paypal.  I’d say this is VERY likely to happen, although it will still cut out a majority of phishing attacks that exist today.  Paypal, you’re off to a good start, but there’s still some work to be done.

Read [Paypal] Via [jkOnTheRun]