I have used a security key to protect my account for many years, specifically the VIP Access app by Symantec. Every year or so I get a new phone, and have to go through the process of deactivating my old key (assigned to my old phone) and adding a new one (on my new phone). I recently tried this, but have not had any success in adding a new key. I successfully deactivated the old key, but can't activate a new one.
Until now, the procedure has been; log in to my paypal account, go to settings, go to security, and choose security key - update, which brings up a list of my old (deactivated) security keys. When I click Get security key, it takes me right back to my summary screen. If I remember correctly, it's supposed to take me to a screen where I can order a device, and choosing not to, it then takes me to a screen where I can register a mobile number or a security key token, and finally to where I can add a new VIP serial number from my new phone.
I have tried this several times, in both Chrome and FireFox, on different computers, and even in VMWare virtual machines with extremely clean browser installs (no virus checkers, no ad blockers, no script blockers, etc.). All exhibit the same exact behavior.
I called tech support two days ago, and was told that they'd start a ticket, and hopefully others will have reported similar problems, and hopefully it will be fixed in a day or two. Well, I still can't add a new key after trying three days in a row. And I haven't heard anything back from PayPal.
In this age of massive breaches and hacks, I am frustrated that PayPal is still using highly vulnerable SMS for second factor authentication, and that I have to fall back to that in the absence of a more-secure code generator (how about supporting more standard authenticator apps, yubikey, FIDO, etc??). That makes me consider deleting my banking and credit card information because I'm much less confident PayPal can keep it safe.
