PayPal Closes Security Hole, But Now How Can It Get iPhone Users To Upgrade?
Written by Frank HayesSuccess in mobile commerce depends on getting millions of copies of smartphone apps to customers—which is great if you get the details just right. But last Thursday (Nov. 4), PayPal had to rush out a new version of its mobile payments iPhone app. The old version—which has been downloaded more than four million times since its April release—turned out to have a security hole that could let a thief trick a user through a “man in the middle” attack. PayPal says it will cover any customer losses from fraud due to the security flaw.
That’s great for PayPal users. For PayPal, it’s a problem. The success of its iPhone app means there are millions of users at risk. And PayPal’s promise to reimburse any fraud loss related to that risk means there’s nothing to motivate users to upgrade from the old version that, to users, seems to be working just fine. Result: All the risk is on PayPal—and the only way to get out from under that risk is to irritate its customers.
The security problem with the iPhone app was easy enough for PayPal to repair. The app neglected to confirm that it was actually connected to the PayPal Web site before doing any business. The app should have done that by checking the PayPal site’s digital certificate. The failure was spotted by security research firm viaForensics, which announced the problem the same day PayPal rolled out its fix and said the Android app and PayPal Web site don’t share the problem.
That failure to check the certificate creates the risk of a “man in the middle” attack, in which a thief sets up a public Wi-Fi hotspot that includes a phony PayPal Web site in a place where users might connect to it—say, an airport, train station or shopping mall—and then waits for victims to discover the hotspot and log in. It would be a low-percentage attack, and PayPal says it hasn’t detected any fraud. But it’s a real risk, especially with a recent wave of hacking software for public Wi-Fi networks that are designed for almost anyone to use.
Now PayPal’s challenge is to get users to download the new app. That may not be easy. The new version doesn’t have any compelling new features. Except for the quickly patched security hole, it’s exactly the same as the old version. There’s nothing to encourage users to upgrade—a process that requires time and bandwidth for users, and always comes with the nagging fear that something will go wrong. With a cost that users care about and no benefit they can see, why should users upgrade? That’s the problem PayPal faces four million times over.
-Marc
November 11th, 2010 at 9:40 am
And there lies the inherent problems with “apps”. The whole point of the internet was to provide functionality and make it universally available from anywhere and anytime. The internet essentially fixed the software distribution problems that have plagued the industry since its early days. In order to differentiate itself (and to mask the fact that it is not a “cloud” company like Google but rather a “hardware” company liked Dell), Apple has pushed the idea of mobile apps onto us. Customers don’t care and ran with Apple who, truth be told, has traditionally offered superior usability and an “integrated” (some say closed…) ecosystem. BUT…the model is inherently flawed. Mobile apps are flawed and are, for all intents and purposes, a giant step back in the evolution of computing and convenience. I hope we collectively move towards HTML5 mobile apps which will have the same use and feel as native apps (in the majority of cases) but are “always up to date” and have the distribution advantages of web applications.