Paypal login no longer required? Since when?

[hiЯez]

I purchased a game just now via the Steam website store, and I didn't have to enter my Paypal password, it just went ahead with the purchase. I'm wondering how this is possible?

It had my paypal credentials in memory still, and somehow authenticated my paypal in the background? I don't know how I feel about this. When it comes to any sort of paypal login bypass, I want to be aware what is going on. As it stands, it just happened without my decision to bypass the paypal login screen.

More than anything, I didn't think this was possible from Paypal's side. Does Valve have special permission from Paypal to store credentials and authenticate in the background? Perhaps they do, but I've never seen that before. Every transaction I usually do involves a paypal login page where I click "puchase". When did Paypal build a bypass around this?

[flamingjune86]

This just happened to me too! Thanks for the info!

[DrZnadvago]

Enormous thanks for bringing this up. Huge thanks to Miqueye for being the first to point to a solution. I am normally very careful and downright allergic to giving anyone - even valve - an open, unlimited access to my stash of money, so I really don't see how did they trick me to agreeing to it.

[grumbel]

The way the whole automatic payment works is really shady. When you buy a game you are presented with the normal login/payment screen, except at the bottom of that page there is a "I agree Valve can have access to all my money" text box that is extremely easy to overlook. Paypal doesn't require you to click a checkbox, confirm that you read the text and doesn't make it obvious in any way that you aren't just buying a game, but also giving Valve raw access to your account. And to make the situation worse, most people don't even know that Paypal even has a way to make automatic payments as it's hidden deep in the settings and hard to find even if you know what you are looking for.

It's mind boggling that Paypal allows that kind of raw access without any further checks.

[Bad 💀 Motha]

Αναρτήθηκε αρχικά από grumbel:

The way the whole automatic payment works is really shady. When you buy a game you are presented with the normal login/payment screen, except at the bottom of that page there is a "I agree Valve can have access to all my money" text box that is extremely easy to overlook. Paypal doesn't require you to click a checkbox, confirm that you read the text and doesn't make it obvious in any way that you aren't just buying a game, but also giving Valve raw access to your account. And to make the situation worse, most people don't even know that Paypal even has a way to make automatic payments as it's hidden deep in the settings and hard to find even if you know what you are looking for.

It's mind boggling that Paypal allows that kind of raw access without any further checks.

It is the same as allowing Steam to remember your CC# or DC# on file as a default payment method. How is THAT any different?

Its up to the user to know the settings/options available to them, like u say Paypal has that feature on their end for auto-payments and such.

What are services to do, remember if u are new to their system or not and provide a walk through guide before allowing to checkout and such? What is helpful before u deal through something where u might not know the whole picture is to review the options would provide (like a seller for example), the terms, as well as even the support for those.

People just get on the web and click things, as if reading is no longer required, or that safety is no longer required. Outside of the web do you blindly sign a contract or submit all sorts of personal info without reviewing the terms and alike?

[grumbel]

Αναρτήθηκε αρχικά από Bad-Motha:

It is the same as allowing Steam to remember your CC# or DC# on file as a default payment method. How is THAT any different?

CC are fundamentally broken. Having Paypal become more like CC is exactly the problem. Paypal used to work like this:

1. Go to a shop select stuff you want to buy
2. Get redirected to Paypal which shows you how much you pay
3. Confirm your payment

The way things works now (not everywhere, the interface varies from shop to shop):

1. Go to a shop select stuff you want to buy
2. Get redirected to Paypal which DOESN'T show you how much you pay
3. Confirm something, Paypal doesn't make it clear what exactly you are confirming

Most of the time you just end up paying what the shop shows you (+/- a bit due to currency conversion), but sometimes you also enter into an automatic monthly payment or give the shop free access to your bank account. Paypal doesn't make that clear at all what is happening, the interface looks mostly the same all the time and shows absolutely no indication of price. And worst of all, the things you might end up agreeing to probably haven't even existed the last time you read their Terms of Services.

It's a total ♥♥♥♥ up on Paypals side and it's probably deliberate. If they wanted to make it user friendly they would just need to make it obvious that you are not buying a game, but also agreeing to do lots of other stuff, but they don't. Even a simple checkbox to confirm that you agree with the additional stuff could go a long way.

[Bad 💀 Motha]

Yes I have to agree with that; but is it Paypal doing that, or is it the Paypal user having certain options enabled in their Paypal account-side settings?

I always get the full Paypal login on Steam; but I never let Steam save this as default payment method (is I guess is why). I only use that sometimes.

[grumbel]

I think it's this checkbox that Steam shows on the "Payment method" page that triggers it:

"[ ] Save my payment information so checkout is easy next time"

That sound like it's just for remembering that you want to pay with Paypal, instead it gives Steam free access to your Paypal account and by passes the Paypal login.

[grumbel]

Turns out, Paypal's old interface isn't secure either, apparently the shop can take any amount, not just the one you confirmed:

http://seclists.org/bugtraq/2014/Jul/85

[David's Shitty Tank]

I just discovered this today, it scares me how long this has been going on. That's some back-handed scripting on Steam's part, never even got a confirmation message. I've asked Paypal what the hell is going on that allows a vendor to just add themselves to the pre-approved list without any notice to the customer. I doubt I'll get a decent response though.