PayPal

If you run into problems trying to remember a password on your mobile or computer when trying to buy something, then things could be about to get easier.

The days of the lowly password are numbered.

The fact is that the way we users typically deal with having multiple passwords for our online accounts makes us too vulnerable to spyware, phishing and identity theft. Many of us rely on the same password, while many more of us only use three or four passwords. Ideally, the best password would be something like Az1f6&jWz - but you'd never remember it.

Andy Steingruebl wants you to know that he's a glass-half-full kind of guy when it comes to information security.

The reason for this optimism is not strictly rooted in the groundbreaking work that Steingruebl, senior manager of customer and ecosystem security for PayPal, and his team are doing to protect users from today's assortment of internet threats.

Dangerous website flaws have been discovered in PayPal that grant attackers access to customer credit card data, account balances and purchase histories.

The holes — which still exist — were recently discovered by a security researcher.

One of the holes was publicly disclosed after a failed effort in July to responsibly disclose them under PayPal's bug bounty program. Neil Smith from Texas-based outfit Zing Checkout found that attackers could log into publicly-accessible PayPal administrative sites via authorisation bypass and cross site scripting (XSS) vulnerability.