Email addresses can be hacked or perhaps even spoofed. I need to pay individuals via paypal and I fear that over time people's email will change or become compromised. How can I ensure I am paying the right individual?

If I ask them to give me a personal password and in return I give them each a unique public key, will that be enough to verify their identity assuming they took precautions to remove the email with the public key and place the key in a secure place?

The target audience will likely be people who have no idea what gpg is. And some would want to remain anonymous. And others would not want to give their mobile number.

Alternatively, is there a there a website that could handle all of this?

Another point on the importance of the question: A thief is one thing, it will annoy me and perhaps even hurt my feelings and rob the intended individual. But there's a more serious threat. If you've paid any attention to the news over the last few years there are certain "people" bent on "causing terror". If it fell into their hands it would put lives at risk. I certainly don't want to be party to that.

  • 3
    You say If it fell into their hands ... what is it? a payment would put lives at risk? – halfbit Jul 19 '15 at 20:06
  • 1
    Do you know what your legal obligations are? Do you have to refund it the way it was paid? Are you liable if the funds don't get to the correct recipient? This seems more like a legal than infosec question. – Neil Smithline Jul 19 '15 at 20:10
  • 1
    How will you get a personal password from them? Do you have a secure means of communication with them? If so, work something out with each of them. If you don't have a secure communication channel, you're likely in trouble. – Neil Smithline Jul 19 '15 at 20:12
  • 1
    Note that payments (distributions including gifts) over a certain amount may need to be filed with a government authority. - I'm not a lawyer, check with local laws first – halfbit Jul 19 '15 at 20:13
  • 1
    Can you just contact each person and ask them how they want their gift delivered? – Neil Smithline Jul 19 '15 at 20:13

"Remaining anonymous" and "verifying identity" are contradictory, aren't they? I would say if you want to pay someone and guarantee that they get the money, they can't remain anonymous.

If I ask them to give me a personal password and in return I give them each a unique public key, will that be enough to verify their identity assuming they took precautions to remove the email with the public key and place the key in a secure place?

I see a few problems that might come up:

  1. how would they give you the personal password if not by email? I guess you should better describe where you are starting from with them.

  2. deleting the email immediately does not guarantee safety. Compromised email accounts can be set up to forward emails to other accounts.

Usually what you want to achieve is done by communicating the "key" in an out-of-band method such as SMS. Those who don't want to divulge their number will just have to take the risk of losing their money, I guess.

If it fell into their hands it would put lives at risk.

That escalated quickly... you will have to explain more the threat you are really guarding against if you want a more helpful answer!

  • I trust that the initial two-way email communication would not likely be compromised and that the hacked accounts would be limited to a select few. But over time these problems would increase. – user2270773 Jul 19 '15 at 19:42

You can prove that someone owns an email address quite easily. You send them an email containing a random code, and ask the user to enter the code to confirm their email address. This is a very common technique for online signups, and the secret code is usually hidden inside a link, which the user has to click to confirm.

As you have identified, there are limitations to this technique. For example, if their email has been hacked, the hacker can confirm the email. Most websites do nothing to mitigate that; they simply require users to keep their email addresses secure. BTW, email spoofing is usually not an issue in this context, as the email address is used for sending emails.

If you need more security than this, you need to use channels other than email. You could ask for a phone number and send an SMS with a random code. Many major webmail providers (e.g. gmail) do this. Or ask for a postal address and send a physical letter with a random code. Postal verifications tend to only be done by financial organisations. You could even go all the way and tell the users to come into one of your offices with government issued ID, and verify them in person. You can also verify a Paypal address by asking for their postal address and verify this using an API that Paypal offer. All these options offer different levels of security, and come as different costs. You need to select an appropriate tradeoff based on how sensitive your application is.

I don't understand your final comment about putting lives at risk. Could you explain a little more about how your web site is likely to put lives at risk? If it really is that critical, you need to take expert advice beyond what Security Stack Exchange can offer.

  • I do not want the money accidentally falling into the hands of people that create "terror," I cannot be any more specific than that. – user2270773 Jul 19 '15 at 19:38

It all boils down to trust and the competence of the parties involved. If you send them a password(i.e. shared secret) and the recipients forget to delete it and remains in the inbox then any attacker with access to that account may claim to be the indented recipient and will also be able to perform valid transactions.

You could use an escrow service for better security.

  • Are you saying that what I intend to do is correct? – user2270773 Jul 19 '15 at 19:09
  • Yes, in principle it is. Practically, no(as you've mentioned the people you want to perform transactions with are not concerned about security). – Sebi Jul 19 '15 at 19:15
  • You can't have a "secret" if you've sent it in a clear text email. Even deleting it doesn't guarantee that it's not undeletable, in a backup, snarfed by a network or SMTP intermdiary, etc... You just can't know if it's secret any more. – Neil Smithline Jul 19 '15 at 20:08
  • The statement was made under the assumption that the a secure channel and storage recipient (on the receiver's end) are being used. – Sebi Jul 19 '15 at 20:10

Sometimes learning ahead of time is the best solution. Decide on the limits that your adversaries are placed under then make an attempt to use secure methods that will exceed the limits that are on your adversaries. At some point holding an exchanged secret is what a paypal transfer relies on. You can voluntarily transfer funds from your account to theirs or they can email you a request for funds. Now the problem arises if an attacker gains access to the paypal account or the email address or both. Paypal has implemented two factor identification making it much harder to attack. Several email providers have also. Outside of learning to use GPG those are your best options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.