Comments on: Protect PayPal Accounts With VeriSign Identity Protection Devices

By: Samy

Samy — Wed, 17 Aug 2011 11:46:54 +0000

Paypal Security Key shall be available worldwide by now. Why is it tacking so much to be offered in all other countries where Paypal offers its services?

By: Bob

Bob — Wed, 27 Jul 2011 19:15:53 +0000

I have a big concern..
When using these keys to login, ebay does not disclose the serial number of the device when asking for the code… however paypal does! Could the serial number be used by a hacker to help generate more probable codes (if they knew/reverse engineered the algorithm these devices use)?

Also, why does paypal allow you to bypass the code completely and answer secret questions (which all friends/family know anyway)?
Also.. it says something like “you can log in using your secret questions this time, but next time you’ll need to enter a code”.. yet it does not act on this. You can login as many times as you want subsequently without entering a code at all.

Ebay does not allow this. If you lose your reader/don’t have it on your persons etc it calls your home telephone number with a new code. It does not allow you to login using secret questions. It seems way more secure. Why is this? Paypal should be more secure than ebay!!! It has my money.. why is ebay more secured?

By: sulasno

sulasno — Sun, 19 Jun 2011 08:32:12 +0000

had to use this link

https://www.paypal.com/us/cgi-bin/?&cmd=xpt/Marketing_CommandDriven/securitycenter/PayPalSecurityKey-outside

By: If Caught in Hacking Crossfire, Defend Your Information Furiously

If Caught in Hacking Crossfire, Defend Your Information Furiously — Sun, 19 Jun 2011 08:04:41 +0000

[...] users can improve security with identity protection devices. It costs little money and adds two factor authentication to PayPal. Attackers who get your [...]

By: Facebook Login Approvals, Optional Two-Factor Authentication

Facebook Login Approvals, Optional Two-Factor Authentication — Fri, 13 May 2011 18:59:55 +0000

[...] for instance is offering VeriSign ID Protection devices that act as a second layer of authentication. Google recently introduced two-step [...]

By: Windows Live Login With Single-Use Code

Windows Live Login With Single-Use Code — Sun, 08 Aug 2010 19:42:09 +0000

[...] and password can log into the service.That’s why PayPal some time ago introduced optional VeriSign Identity Protection Devices. The devices generate a six digit code that is valid for 30 seconds. This code needs to be entered [...]

By: Windows Live Login With Single-Use Code | TechBlogger

Windows Live Login With Single-Use Code | TechBlogger — Tue, 15 Jun 2010 15:40:27 +0000

[...] why PayPal some time ago introduced optional VeriSign Identity Protection Devices. The devices generate a six digit code that is valid for 30 seconds. This code needs to be entered [...]

By: Bookmarks about Sandisk

Bookmarks about Sandisk — Thu, 01 Jan 2009 03:13:22 +0000

[...] – bookmarked by 3 members originally found by frederiekrys on 2008-12-30 Protect PayPal Accounts With VeriSign Identity Protection Devices [...]

By: PayPal Now Offering Mobile Security Key

PayPal Now Offering Mobile Security Key — Mon, 24 Nov 2008 18:14:55 +0000

[...] VeriSign send me a free PayPal Security Key after I mentioned that an unauthorized payment was done from my PayPal account. The security key acts as a new layer of defense. It has to be entered during login to complete the login. [...]

By: Dante

Dante — Sun, 20 Jul 2008 22:18:12 +0000

Thanks Jeff for the information.

Now I am curious. Martin, could you subject your fob to extremes of heat and cold? Just to see if the token’s timing can be thrown off :) You’ll know if your timing is off when the number you enter is not accepted. Of course, this will void your warantee.

Disclaimer, I do not hack, nor do I know how to. I’m just “curious” :)

By: Martin

Martin — Sun, 20 Jul 2008 20:43:56 +0000

Jeff thanks for clarifying, well done especially on a Sunday ;)

By: Jeff Burstein (VeriSign)

Jeff Burstein (VeriSign) — Sun, 20 Jul 2008 20:41:07 +0000

Martin:

Glad to hear it worked well for you! The PayPal Security Key and the VeriSign token you received (as well as the VIP Security Card) are all VIP Credentials, which mean they work on any site which is a member of the VIP Network. These sites include eBay, PayPal and AOL — the complete list is available at https://idprotect.verisign.com/wheretouse.v. Being part of a network means that you only need a single device to secure all of these sites, whether you got it from PayPal, directly from VeriSign, or from another network member.

By: Jeff Burstein (VeriSign)

Jeff Burstein (VeriSign) — Sun, 20 Jul 2008 20:33:10 +0000

@Dante, @Rarst:

The VIP Credentials from VeriSign use the open standard OATH HOTP algorithm (openauthentication.org), published as IETF RFC 4226 (http://www.rfc-editor.org/rfc/rfc4226.txt). This algorithm is based on HMAC-SHA1, which is a one-way hash function virtually impossible to reverse — http://www.openauthentication.org/pdfs/Attacks%20on%20SHA-1%20FAQ.pdf.

By: Rarst

Rarst — Sun, 20 Jul 2008 16:32:51 +0000

Hm… I am no expert but I always thought that basis of every single public/private key cryptography system is that private key can’t be calculated using public one.

It’s like hashes – you may know exact algorithm, you may know hash value… But you can’t reconstruct original object from hash.

By: Dante

Dante — Sun, 20 Jul 2008 15:50:32 +0000

@Rarst

All the fobs should be programmed to generate a number a certain “unique way”. The registration process merely tells Paypal the fob’s “unique way” – the unique key. This way, when the fob generates the number for you to put into your transaction, Paypal will generate the same number and agree with it.

If a phreaker have access to enough fobs, s/he should be able to figure out the algorithm. And when s/he sniffs the traffic, s/he will get the number given by the fob. Enough such numbers from one target, and a phreaker should be able to figure out the key if the algorithm is broken.

By: unruled

unruled — Sun, 20 Jul 2008 11:10:10 +0000

ah, thanks Gemini. I guess I will have to be patient then :|

By: Rarst

Rarst — Sun, 20 Jul 2008 09:10:55 +0000

@Dante

Could you please explain why do you think serial code can be sniffed?

I don’t see a single reason serial key must be exchanged between server and client except for initial registration.

By: Dante

Dante — Sun, 20 Jul 2008 01:31:04 +0000

All the physical keys use the same algorithm. That’s why the Fed regulates who has possession of their fobs. Paypal, due to their client base cannot. Once one figures out the algorithm of the fob. Than they just need to sniff the web traffic to find the account key associated with the fob.

Think of the fob as the private key of a PGP encryption that is registered with Paypal once you get the fob. And the number given from the fob is the public key. Once you figure the private key (fob) it’s pretty easy to get it all once you sniff out the public key.

That’s also why fobs sort of died in the banking industry. They’re now looking for physical keys – i.e. the ATM card with the embedded chip, and a customer specific reader to read the ATM card at a registered PC.

By: Gemini

Gemini — Sat, 19 Jul 2008 23:06:12 +0000

Just to get back on unruled’s comment:

Question :
Does the PayPal Security Key work on all PayPal country sites?

Answer :
No. The PayPal Security Key is currently available to eBay and PayPal members registered in the U.S., Australia, and Germany.

By: Rarst

Rarst — Sat, 19 Jul 2008 16:46:41 +0000

>Than they simply have to sniff your traffic for a bit and backward engineer your fob’s base code.

As far as I understand this system there is no need to transfer serial code (only once when registering) so there is nothing to sniff. Even if you do sniff one instance of access key – it expires in seconds.

Even if exact algorithm is known it’s no use unless serial for specific account is known, which requires access to physical key… Which is kinda the point. :)