Lenovo Provides Computers With FIDO Authenticators

Lenovo has provided various computer models of so-called FIDO authenticators that let users login their accounts via a fingerprint scan or click on a prompt on the screen. The Fast IDentity Online (FIDO) Alliance has set itself the goal of replacing the password with authentication methods that are "safer and user-friendly."

Lenovo is one of the FIDO members, among other things, Google, Microsoft, MasterCard and PayPal. The parties involved develop products and services that make use of the FIDO protocol. This would automatically recognize devices that support FIDO and allow users to replace passwords by another authentication method.

Lenovo now claims that it is the first PC manufacturer to integrate directly into Windows computers by FIDO certified authenticators. Instead of a password to log in, users can choose from an alternative. For example, a fingerprint scan can be logged through the Universal Authentication Framework (UAF). In addition, the system also supports Universal 2nd Factor (U2F).

In case a user has enabled two-factor authentication for his account, it is no longer necessary to enter a separate security key or SMS. The two-factor authentication is built directly into the computer. In the case of two-factor authentication via U2F, users get a prompt to confirm, after which they are logged in to their account. This login method is supported by Google, Facebook and Dropbox.

To support UAF and U2F, Lenovo uses Intel Online Connect and Intel Software Guard Extensions (Intel SGX) on the latest Intel processors. The functionality will be delivered with different computer models and available for all models delivered. Intel Online Connect is available for download from Lenovo's website and will be available through Lenovo System Update and Lenovo App Explorer.

MEGA: PayPal Account Closed Due To Encryption

PayPal has the account of the online storage MEGA closed, according MEGA is due to the end-to-end encryption which it offers to users. That leaves the storage service of internet entrepreneur Kim Dotcom in a blog posting know. MEGA states that it is aware of a report that the storage service as illegal cloud storage service was dismissed.

This US Senator Patrick Leahy Visa and Mastercard put under pressure not to accept payments for more MEGA. Then the credit card companies would have PayPal put under pressure not to process payments more for MEGA. MEGA showed opposite PayPal know that it is indeed a legitimate service and provided all kinds of statistics to prove this. Yet PayPal decided to discontinue the service towards MEGA.

MEGA would have made the payment service excuses and admitted that it was a legitimate service. One of the biggest stumbling blocks, however, the end-to-end encryption it offers, which is unknown what is offered via the cloud storage service. MEGA still pointed to the encryption models of other cloud storage services such as Apple, Dropbox and SpiderOak, but that would be no problem for the pay.

"I want to thank PayPal for supporting MEGA for such a long period. The pressure of Hollywood and the US government was just too big," said Kim Dotcom , founder of MEGA. Then he calls his followers to go use bitcoin now.

Security Researcher Hijacks PayPal Accounts via Flash File

A security researcher has discovered a flaw in the PayPal website so he could take over users' accounts. The vulnerability was in the page to generate invoices. The page allows users to upload different types of files. PayPal turned out only to check the extension of the uploaded files, not the content, so the researcher discovered.

This allowed him to a Flash file with full read on www.paypal.com upload. Then, to take account of a user, the user must visit a Web site of the researcher. The researcher can then execute arbitrary commands with the PayPal account, such as the transfer of money and steal data.

The researcher reported the problem with us that rewards bug reports through a special program. However, eight days after he was told that another researcher had already reported the problem and, therefore, no compensation was paid. "I know that researchers sometimes find the same bugs, but I think that PayPal better to deal with this double bug reports," said the disappointed researcher.

PayPal lets bug webshops arbitrary amount Checkout

Paypal Bug

A bug in the online payment service PayPal enables webshops to settle after the customer has been given. Attachment for a different amount any amount Thus, the customer thinks he is buying something for one euro, for example, while the shop settles 200 euros.

However, the customer receives only the confirmation email from PayPal that 200 euros is charged. The problem is when using the PayPal Express Checkout, says the German security researcher Jan Kechel . This confirms the customer in its PayPal payment environment and think you have judged. After the payment through PayPal, the user is sent back to the shop, where another function is called that allows you to transfer, without the customer has given consent another amount will be.

Kechel discovered the problem and reported it to PayPal. The payment service stated that it is not a bug but is "intended behavior", due to small differences in transport costs and the like. The researcher believes that PayPal however all amounts greater than the fixed amount must confirm this. Again by the customer As evidence Kechel made ​​this demonstration .