PayPal Privacy Policy
Policy Analysis
Andre S. Burton
March 17, 2003

 

Introduction
Paypal is an online e-commerce tool for sending and receiving payments online. Many merchants, individuals, auctions, and small businesses use Paypal to handle monetary exchange in real-time with low-overhead/maintenance.

The Problem at Large
The security measures for ensuring some level of trust between buyer and seller is easier to measure when both parties are physically present. A buyer can check a signature, get a card imprint, or check identification, and consumers can immediately obtain their desired product(s), conveniences not easily afforded on the Web as we know it today. Merchants always seem to get the bad end of the deal, however; sales made on a not present basis, in many cases, hold no weight even with so-called 'authorization'.

Companies would like to sell products online as the Internet affords its customers the convenience of not having to be physically present to purchase or browse a set of items. Reaching a larger customer base may sell more products but also comes at a greater cost - a more expensive means of ensuring security for both the business as well as its consumers. Greater security usually leads to greater efficiency and higher gains - a goal of any business or merchant.

As consumers, we would like to feel confident in the purchases we make...that our security and personal information is not threatened by those how wish to take advantage of them. It is both the consumer and merchant's responsibilities to safeguard that information as best as possible.

PayPal's Privacy Policy and Analysis
PayPal's Privacy Policy focuses in on four key points: what is collected, use and disclosure, security, and access and change. I'll address each topic separately. The policy can be accessed online at http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/privacy-outside.

What is collected
Anybody can open a PayPal account but it comes with set requirements. At a personal-level, name, address, phone number, and e-mail address are required. A credit or debit card or bank account information with payments totaling more than $1,000. Two distinct security questions with answers provided are employed as backup measures of security in case the user forgets his/her password, verification, etc. IP addresses are also collected so that exchanges made from different addresses will signal a need for further verification. In some cases, when verfication requirements are not met, the user may be asked to send a fax of a driver's license or even a social security card to the company.

As a side note, a trade-off between security and convenience must be made in making decisions on how 'secure' a system really is. Honestly, when I want to purchase a product, I don't want to have to be asked for a fax of my driver's license or social security card when making online purchases despite the fact that it may be in my best interests.

Interestingly, PayPal tracks referrer and browser information of each client. Although this information does not aid in verification, it supposedly helps assist PayPal in addressing user needs. Obviously, verification is null using this information as users logon from different machines with different settings and browsers.

Also, PayPal pushes cookies onto the client as a form of maintaining state and some level of authentication. Although this may be the best method given the current state of HTTP, not everybody accepts cookies. Cookies are depend on user preferences and not offering another option for authentication may cause some users to deter from even using the system.

Use and disclosure
PayPal exposes users' names, email addresses, dates of sign-up, and whether one has verified bank account numbers to other users. Paypal ensures that no financial information is disclosed to other users unless required by law.

Since PayPal has been acquired by eBay, many of the same measures to ensure trust have been implemented. Measures of trust give users a sense of who is and isn't reliable. This is important in the world of invisible customers and merchants; both sides want to know who has and hasn't been reliable with payment. What the policy doesn't state, however, is how it ensures that the same person can have multiple usernames. A person with a bad level of trust can create a new account and simply start over as long as they have a different credit or debit card or bank account.

Information Security
I found an inconsistency. The policy clearly states, "credit card and bank account information are stored only in encrypted form on computers that are not connected to the Internet." However, in a link to a page outside the policy (http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/security-outside), something different is said: "servers sit behind an electronic firewall and are not directly connected to the Internet...". So now, a server is on the Internet but not really. A firewall simply blocks out some services and only lets a few in. Regardless of what services are shut down, the internal server is indirectly accessible from the Internet if exchange is to happen automatically without the aid of the human eye.

Nowhere within the policy does it state anything about method of encryption; i.e. SSL or TTP (Digital Certificates). It should be a general rule for users to look for secure browser transmissions.

Passwords seem to be the single-most important measure of security. PayPal's policy simply states that the liability of an account depends on the integrity of the password; should somebody else guess an account's password, PayPal is not responsible for loss. Unfortunately, the policy doesn't go into detail about password integrity and what measures are in place to ensure a user's password is both difficult to crack and in constant change.

Other Recommendations for Change
Although PayPal uses some of the best Web practices, limitations are placed on ensuring true authorization given the limited amount of information available about customers. Although digital signatures and other new and innovative technologies are being developed, security is at the sacrifice of what is available about customers. Until technology can offer other means of ensuring authorization, weaknesses will continually be exploited.

Conveniently, the privacy policy leaves out the things some users find the most inconvenient or threatening to their security. This may add to the attractiveness of using PayPal. It also may be an executive decision to leave out sensitive information as it could possibly show weaknesses in its implementation.

The policy seems to be straightforward about what information is collected, who has access to it, and how they protect it. What the policy does not go into detail about is how they ensure customers know they are giving their personal information to the correct people. It's like saying sure, we know it's you but we don't care if you know it's us.