“We found PayPal vulnerabilities and PayPal punished us for it”

Re:“We found PayPal vulnerabilities and PayPal punished us f... by rasengan on Monday February 24, 2020 @09:30AM (#22404196)

> Not anywhere on the page you linked.

Read the page carefully - it specifically states they are an auditor approved org.

Quote from page: “Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report.[1].”

Secondly, PayPal works with HackerOne officially [2] and within the CVSS standards as they clearly state on their HackerOne page, which is complying with PCI DSS.

[1] https://www.hackerone.com/product/challenge

[2] https://hackerone.com/paypal

Edit: Archived incase:

http://archive.is/CvZqg

http://archive.is/GGDs2

[ Parent | on HN ]

Re:“We found PayPal vulnerabilities and PayPal punished us f... by singlow on Monday February 24, 2020 @12:21PM (#22406052)

Even if HackerOne were a company that is licensed to do PCI DSS scans, they were not contracted by PayPal to do it. A PCI DSS scanning company cannot just do independent audits for PCI compliance unless solicited by the target. The auditing process you are referencing is not related at all to reports by unsolicited scanners.

[ Parent | on HN ]

Re:“We found PayPal vulnerabilities and PayPal punished us f... by ailideex on Monday February 24, 2020 @09:40AM (#22404289)

What is their certificate number?

[ Parent | on HN ]

Re:“We found PayPal vulnerabilities and PayPal punished us f... by hedora on Monday February 24, 2020 @10:05AM (#22404573)

> If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce.

This comment chain has convinced me that PCI-DSS is a farce.

[ Parent | on HN ]

Re:“We found PayPal vulnerabilities and PayPal punished us f... by ailideex on Monday February 24, 2020 @10:21AM (#22404728)

I'm not sure that you being convinced by someone who doesn't even understand that it was not hackerone that found the vulnerabilities says much about PCI-DSS

[ Parent | on HN ]

Re:“We found PayPal vulnerabilities and PayPal punished us f... by deadmetheny on Monday February 24, 2020 @10:14AM (#22404649)

Pretty much. All it really proves is that an org meets a bare minimum of security standards. As noted elsewhere in the thread, it's used more for marketing and to serve as a "hey look at us we're self-regulating within industry!" than anything else.

[ Parent | on HN ]

Re:“We found PayPal vulnerabilities and PayPal punished us f... by tomnipotent on Monday February 24, 2020 @01:04PM (#22406504)

> Read the page carefully

Emphasis mine.

"...satisfy the requirements for external penetration testing for audited PCI DSS and SOC2 Type II certifications."

"Final Report Delivered. Ready for Auditors."

[ Parent | on HN ]