It's so easy to throw up a veil of security while doing absolutely nothing at all.
Just today I was helping somebody retrieve an export of older transactions from PayPal, and they were forced to go through a series of steps to sign up for "secure" access to a special account in order to download a "secure" zip file that PayPal had uploaded containing the transactions.
Which doesn't just mean that file had a crap password; I'd be willing to bet it means a whole bucket or type of files has the same password. So at least there's that.
Just today I was helping somebody retrieve an export of older transactions from PayPal, and they were forced to go through a series of steps to sign up for "secure" access to a special account in order to download a "secure" zip file that PayPal had uploaded containing the transactions.
The password on the zip file? PayPal123.