John wrote:
On May 14, 2:41 pm, "Michael J. Mahon" <mjma...@aol.com> wrote:John wrote:OK, this is a stretch to relate to Apple 2, but many foks here use ebay to make Apple 2 purchases.Some ebay vendors direct Apple 2 users only to Paypal through 3rd party checkouts pages (you go to their sites, fill out a bunch of market_junk, and eventually they direct you back to Paypal).Is this a security risk? Why? A vendor could send you to a phising site. I think this is possible, and some vendors come from places which are not so friendly.One of the main reasons I liked Paypal, from a user perspective, is that they insulate you from the vendor. 3rd parth checkout *seems* to defeat that insulation, deliberately, in a way which benefits vendors only.Thoughts?Who would be good to talk to about this? I was thinking of magazines or papers or something. I called CERT hoping they could direct me.(I have talked to Paypal about this twice, at least.)I haven't encountered this behavior, nor have I encountered a seller who took PayPal who was not happy with getting paid by going straight to PayPal. If there are such sellers, then don't patronize them. -michaelHere's another small twist ... this last vendor advertised Paypal no differently than any other seller (on their ebay posting). When I proceeded to checkout there was no clear alternative. The ONLY (almost ..) way was through their page. Even when they gave me an email address Paypal would not let that transaction proceed. It said something like "this vendor only allows checkout through their web site ....(paraphrased)" A Paypal agent said to ask the vendor to make a "Money Request" for the auction amount. That did work, or at least I didn't have to go through their marketing web site. Do you think this is excessive paranoia? I've heard of malicious Java scripts messing up IE without recent patches. I think it could change the DNS settings even. It seems hypocritical for Paypal to emphasize security and then turn around and encourage risky behavior when it makes them a little more coin.
No, I don't think its unduly paranoid (after all, "only the paranoid survive" ;-). Quite seriously, I think the answer is never to patronize such sellers, and report them to eBay--I can't imagine that eBay condones such a payment policy (even though they own PayPal). -michael NadaNet file server for Apple II computers! Home page: http://members.aol.com/MJMahon/ "The wastebasket is our most important design tool--and it's seriously underused."