PayPal-Login stops after security check

[mac_pm]

Hello,

with my Palemoon (33.6.1) I have the issue that the login at www.paypal.com works only partial. After givin the credentials,
the security check shows up, I resolve it and then it gets stuck.

I have allowed all in uBlockOrigin and eMatrix but this does not help.

The output of the error console is included here at the bottom.

I hope that somebody can help me with this topic and I would appreciate any tips.

Sincerely

mac_pm

-----


Operating system: Win 7 (PC), Win 10 (Laptop)
Browser version: 33.6.1
32-bit or 64-bit browser?: 32bit
Problem URL: www.paypal.com
Browser theme (if not default): default
Installed add-ons:
> Add to search bar
> All-in-one-sidebar
> Classic Add-ons Archive
> eMatrix
> NoRedirect
> Pale Moon Locale Switcher
> RefControl
> Tab Mix Plus
> uBlock Origin
> User Agent Switcher

Installed plugins: (about:plugins):
> Java Platform
> Unity Player

If possible, please include the output of help->troubleshooting information (as text):

Zeitstempel: 01.04.2025 19:32:18
Fehler: 'postMessage' konnte auf 'DOMWindow' nicht ausgeführt werden: Der angegebene Ziel-Ursprung (origin - 'https://www.paypalobjects.com') stimmt nicht mit dem Fenster-Ursprung des Empfängers überein ('https://www.paypal.com').
Quelldatei: https://www.paypalobjects.com/web/res/3 ... abled=true
Zeile: 0

[UCyborg]

Strange, this error looks familiar, though I don't remember where I've seen it the last time. Login to Paypal works here, that error doesn't show on my end.

[suzyne]

I am using 33.6.1 and after entering my email and password, the next screen shown below appears. If I click on the Continue on web link, it goes direct to my account without any further challenges. Could this be because of my previous active use of PayPal on Pale Moon that I no longer need to go through confirmations? But I can appreciate that the sometime annoying "it works for me" response doesn't solve the problem.

Clipboard_04-02-2025_01.png

[Moonchild]

If PayPal throws up an extra verification check then it finds your login or connection suspicious. Normally there won't be an interstitial screen when logging in.
Are you blocking paypal domains/cookies/data or using a proxy or very stringent privacy settings?

[moonbat]

Same problem. I've whitelisted paypalobjects.com and a couple of related domains, then totally disabled uBO, but still get stuck on that page.

[Moonchild]

Not sure what to say. I'm unable to reproduce the issue.

[UCyborg]

After inputting email and password, I just get the usual 2FA code notification prompt, when I enter it, I'm in as usual. I've never seen the prompt to scan the QR code to download the app.

Maybe users with the problem have in common that they haven't setup to use TOTP code (for 2-factor authentication) for Paypal in the past?

[suzyne]

Maybe users with the problem have in common that they haven't setup to use TOTP code (for 2-factor authentication) for Paypal in the past?

Yes, I am in that category. In my defense, I use a strong and unique password.

[moonbat]

In my case I do have 2FA setup for it.

[UCyborg]

Maybe Paypal sends something different to certain users on Pale Moon. Guess we're in the dark unless one of the developers behind Pale Moon encounters it.

[karlkracher]

It's failing with this

Code: Select all

'postMessage' konnte auf 'DOMWindow' nicht ausgeführt werden: Der angegebene Ziel-Ursprung (origin - 'https://www.paypalobjects.com') stimmt nicht mit dem Fenster-Ursprung des Empfängers überein ('https://www.paypal.com'). 
recaptcha_v2.html
'postMessage' konnte auf 'DOMWindow' nicht ausgeführt werden: Der angegebene Ziel-Ursprung (origin - 'https://www.paypalobjects.com') stimmt nicht mit dem Fenster-Ursprung des Empfängers überein ('https://www.paypal.com'). 
recaptcha_v2.html

[Moonchild]

It's failing with this

Code: Select all

'postMessage' konnte auf 'DOMWindow' nicht ausgeführt werden: Der angegebene Ziel-Ursprung (origin - 'https://www.paypalobjects.com') stimmt nicht mit dem Fenster-Ursprung des Empfängers überein ('https://www.paypal.com'). 
recaptcha_v2.html
'postMessage' konnte auf 'DOMWindow' nicht ausgeführt werden: Der angegebene Ziel-Ursprung (origin - 'https://www.paypalobjects.com') stimmt nicht mit dem Fenster-Ursprung des Empfängers überein ('https://www.paypal.com'). 
recaptcha_v2.html

Yeah that's a security issue. You can't send postMessage data cross-origin. Pale Moon blocks that as it should.

[Nelraen]

FWIW, seems like PayPal have rolled this out in a wider range in the past few days/weeks. Had no problem paying about a week ago, now both the popup in eBay and the main paypal.com webpage does the same. Tried disabling ABP and eMatrix. Re-enabled webGL because console had a message about it being disabled. I restarted PM and ctrl-f5'd. Also tried waiting far longer than first load, until I could not see activity in the network tab.

Console logs datadoghq and paypal's tealeaftarget as last hits.

I also tried a freshly downloaded portable 33.8.0 and that did not work either.
Console logs from portable:

Code: Select all

Content Security Policy: Ignoring “'unsafe-inline'” within script-src: nonce-source or hash-source specified  (unknown)
Invalid URI. Load of media resource  failed.  (2) signin
Content Security Policy: Ignoring “'unsafe-inline'” within script-src: ‘strict-dynamic’ specified   (unknown)
Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified  (unknown)
Content Security Policy: Ignoring “http:” within script-src: ‘strict-dynamic’ specified  (unknown)
SyntaxError: ':autofill' is not a valid selector  tags.js:2

Some of these are probably just security checks, but I don't work with browser security, so that's just a guess.

The only thing I did not yet deactivate is my pihole, but I also can't see any blocked stuff on it either... beyond an ordinary b.stats.paypal block, everything is let through as far as I can see.

[Moonchild]

Yup, seems they rolled out some changes that Broke Things™
Not only does it hang on login (by the looks of it because it chokes on :autofill in tags.js - let's make CSS as fragile as scripting because why not, eh?), it also throws the Danish site at me, while I'm in Sweden. I don't speak Danish
And contacting them has become a terrible thing now too because... AI chat bot ("Paypal Assistant") that doesn't add anything other than "here are the same FAQ entries you already looked at in a chat-like format", no way to contact them otherwise except calling by phone with limited open hours, and their "How are we doing? take our survey!" link doesn't even work either...

I guess Issue #2790 (UXP) has now become high priority because of bad practice of checking CSS in js.

[suzyne]

For what it's worth, I use PayPal with Pale Moon 33.8.0 and can login without issues. At no point does the signing in process get stuck. I also have my account set to use 2FA where I need to enter a six digit code and that part works too.

Once in PayPal, sometimes a page might feel "not quite right" with the layout, but generally I have been able to do what I need to do without switching to another browser.

[Nelraen]

Hmm, yeah, interesting, it now works for me too. Same setup as previously. I guess they rolled back / fixed their code.

They did have a lot of calls to internal tracking and datadoghq too.

[Moonchild]

Yup looks like they rolled it back or fixed whatever it was. I can log in again as well (and the language stuff was fixed too).