Issue with PayPal and Two-Factor Authentication Using Safari as Authentication App

Hi everyone,


I'm writing about a rather strange issue I've been experiencing on Safari for Mac since I decided to stop using third-party apps to store authentication codes (via QR codes or codes). Some time ago, I switched everything to Safari, and since then, I've been encountering a problem exclusively with PayPal.


After activating two-factor authentication on PayPal and registering the code on Safari, the issue arises when I have to enter the 6-digit code through Safari.


The problem lies in the fact that the last digit automatically entered by Safari is incorrect.


This would suggest that the verification code entered on Safari is wrong. However, that's not the case. In fact, when I manually copy the code and then use it on the PayPal website, the pasted last digit turns out to be different, and the login proceeds without any issues.


I'd like to point out that this only happens with PayPal.


Thank you.


MacBook Pro 16″, 13.4

Posted on Jul 14, 2023 3:55 AM

Reply
Question marked as Best answer

Just updated to Safari 17 and my first login to PayPal has worked fine, and I no longer see this issue! Not sure if it's directly related to the Safari update or whether PayPal have changed something, but it seems to work OK now without using the workaround.


@cloudres, not sure if you now see this fixed too, and if so are you using Safari 17?

Posted on Sep 29, 2023 1:00 PM

Similar questions

21 replies

Jul 20, 2023 1:32 AM in response to mischa43

Yes, it works fine on my iPad and iPhone, it's only on my Mac where I see the issue. Mac is running Ventura 13.4.1 (fully up-to-date), but this was a problem on previous versions and at least the last full release of MacOS too. I noticed it some time ago, but the only reference to it on the web was cloudres posting about it, so until now I assumed it was just my machine.


Whilst the fill-delete-fill workaround does the trick, it's still annoying and is a hack rather than a fix. It's still unclear whether the issue is with PayPal or Apple, but given it works on all other devices and it works the second time data is filled without the PayPal webpage changing in any way, my immediate thoughts are it's an Apple issue in terms of how Safari recognises where to put the data. I've looked at the meta tags in the page itself and can't see any obvious problems or causes there, so it's unclear why this behaviour only shows up on this one website. No replies yet on the PayPal forum, but it would be ideal to be able to submit a user bug ticket to Apple, but unsure how to do that.

Jul 20, 2023 8:02 PM in response to PodgySamurai

Thanks for the very thorough info! They do need to fix it.


I think you need to be in software development to use the Apple bug tracker, but end user's can try 'feedback'. I've used it before, and it appears some of the bugs got fixed. Somebody will read it at the other end. You can link back to this forum as part of your feedback report; drop a link in there.


Feedback - Safari - Apple


Jul 20, 2023 8:45 PM in response to cloudres

As others have suggested, this is obviously a problem with PayPal.


The only thing I can add is an explanation of how the problem happens. PayPal is probably doing something funky with Javascript. Safari sees a text field and provides data to it. But PayPal isn't actually reading the contents of the text field. It is monitoring your keystrokes. Since Safari isn't pushing keystroke events through the website, PayPal doesn't know that anything has been typed, even though the numbers are on the screen.


PayPal might claim that this is some kind of security protection. But the important thing here is that PayPal is sampling keystrokes. In theory, any website can do this. Most websites don't do this because they are only interested practical applications, like entering an authentication code. But some websites monitor every keystroke you enter on the site. This can be a security concern. Just so you know.

Jul 21, 2023 4:00 AM in response to etresoft

Hi etresoft, thanks for the reply. However, I don't think that's the case as you can visibly see on the screen when the issue occurs that Safari is putting the wrong value in the text field. It's not just PayPal not understanding the code haas been entered or monitoring keystrokes, Safari is putting the wrong value into the text box itself, so when you click the 'Continue' button then PayPal receive that incorrect value and deny the logon.


I don't dispute the issue could be somehow JavaScript related, or indeed somehow related to the way in which the PayPal website has been built/configured (especially since it only seems to happen on this one site), but it's definitely an issue in the way the Keychain code is working out what to put where, caused either by an Apple bug in that code, or caused by something weird on the PayPal page/field tagging causing Safari to get confused. Either way, I'd say it's definitely a bug and not an issue with the website monitoring keystrokes.


As suggested by mischa43 I will try and submit a Safari feedback request, but may also raise a bug in the developer portal as clearly something isn't working correctly.

Question marked as Best answer

Sep 29, 2023 1:00 PM in response to PodgySamurai

Just updated to Safari 17 and my first login to PayPal has worked fine, and I no longer see this issue! Not sure if it's directly related to the Safari update or whether PayPal have changed something, but it seems to work OK now without using the workaround.


@cloudres, not sure if you now see this fixed too, and if so are you using Safari 17?

Issue with PayPal and Two-Factor Authentication Using Safari as Authentication App

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.