| PayPal Privacy Policy Policy Analysis Andre S. Burton March 17, 2003 |
|
Introduction The Problem at Large Companies would like to sell products online as the Internet affords its customers the convenience of not having to be physically present to purchase or browse a set of items. Reaching a larger customer base may sell more products but also comes at a greater cost - a more expensive means of ensuring security for both the business as well as its consumers. Greater security usually leads to greater efficiency and higher gains - a goal of any business or merchant. As consumers, we would like to feel confident in the purchases we make...that our security and personal information is not threatened by those how wish to take advantage of them. It is both the consumer and merchant's responsibilities to safeguard that information as best as possible. PayPal's Privacy Policy and
Analysis What is collected As a side note, a trade-off between security and convenience must be made in making decisions on how 'secure' a system really is. Honestly, when I want to purchase a product, I don't want to have to be asked for a fax of my driver's license or social security card when making online purchases despite the fact that it may be in my best interests. Interestingly, PayPal tracks referrer and browser information of each client. Although this information does not aid in verification, it supposedly helps assist PayPal in addressing user needs. Obviously, verification is null using this information as users logon from different machines with different settings and browsers. Also, PayPal pushes cookies onto the client as a form of maintaining state and some level of authentication. Although this may be the best method given the current state of HTTP, not everybody accepts cookies. Cookies are depend on user preferences and not offering another option for authentication may cause some users to deter from even using the system. Use and disclosure Since PayPal has been acquired by eBay, many of the same measures to ensure trust have been implemented. Measures of trust give users a sense of who is and isn't reliable. This is important in the world of invisible customers and merchants; both sides want to know who has and hasn't been reliable with payment. What the policy doesn't state, however, is how it ensures that the same person can have multiple usernames. A person with a bad level of trust can create a new account and simply start over as long as they have a different credit or debit card or bank account. Information Security Nowhere within the policy does it state anything about method of encryption; i.e. SSL or TTP (Digital Certificates). It should be a general rule for users to look for secure browser transmissions. Passwords seem to be the single-most important measure of security. PayPal's policy simply states that the liability of an account depends on the integrity of the password; should somebody else guess an account's password, PayPal is not responsible for loss. Unfortunately, the policy doesn't go into detail about password integrity and what measures are in place to ensure a user's password is both difficult to crack and in constant change. Other Recommendations for
Change Conveniently, the privacy policy leaves out the things some users find the most inconvenient or threatening to their security. This may add to the attractiveness of using PayPal. It also may be an executive decision to leave out sensitive information as it could possibly show weaknesses in its implementation. The policy seems to be straightforward about what information is collected, who has access to it, and how they protect it. What the policy does not go into detail about is how they ensure customers know they are giving their personal information to the correct people. It's like saying sure, we know it's you but we don't care if you know it's us.
|