Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Happens When You Send a Zero-Day to a Bank?

privacylog.blogspot.com

Post reply on HN
Print view View original

21–30 of 454 posts

Re: What Happens When You Send a Zero-Day to a Bank?

#21

Post by cyphar »

Kudos to the author, and hopefully they don't get sued as a result. This bullshit with corporations trying to cover up security vulnerabilities (rather than fix them) needs to stop.

"Sign this NDA or we will send the FBI to arrest you because you found that our banking website's security was completely fucking broken and told us about it." Jesus fucking christ.

Re: What Happens When You Send a Zero-Day to a Bank?

#24

Post by beaconstudios »

klapinat0r wrote: post #12

> if somebody sent you an email with that code (even if you never open the email) What is he trying to say here? How on earth would it be possible to execute the url in the context of your zecco cookies unless it's openend in a (browser) in which you've logged into zecco?

I'm guessing he meant a webmail client.

Re: What Happens When You Send a Zero-Day to a Bank?

#25

Post by klapinat0r »

xyzzy_plugh wrote: post #19
klapinat0r wrote: post #12

> if somebody sent you an email with that code (even if you never open the email) What is he trying to say here? How on earth would it be possible to execute the url in the context of your zecco cookies unless it's openend in a (browser) in which you've logged into zecco?

I'm guessing if you used a popular web-based email service, or any browser email client, then this would be possible.

Possibly, but you'd still have to (try to) "render" it in your browser by opening the mail.

On a similar note, your web mail could fetch images in emails ahead of time, but that would still be out of your browser's context

Re: What Happens When You Send a Zero-Day to a Bank?

#26

Post by wyldfire »

komali2 wrote: post #22

Why did the author post in 2017, so long after? He said in early conversations he was going to go public much sooner.

He was afraid that he was bound by the NDA not to disclose it.

Now, in 2017, he flouts the NDA and acts in the public interest.

Re: What Happens When You Send a Zero-Day to a Bank?

#27

Post by cmdrfred »

beefhash wrote: post #18
lisper wrote: post #7

The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.

Consideration is a common law concept as far as I can tell. As someone unfamiliar with how it came to be: Why was consideration introduced? What's the rationale, the goal behind it?

I believe the idea is nobody would willingly sign a contract that does nothing to benefit themselves so they must have been mislead into the agreement thus it is invalid. Sort of a rational actor theory of law.

Re: What Happens When You Send a Zero-Day to a Bank?

#28

Post by alistproducer2 »

On a similar, but separate note, my bank launched a new version of its online banking platform. From launch I noticed it opened my accounts in a new tab while leaving my credentials (password and all) in the sign-in form. Not so bad when signing in from home - horrific if you're signing in from a public computer. I tweeted to the bank and spoke to someone on the phone about it. It's been 3 months and the bug is still there.

[EDIT] I decided to log in today just to see if it's still there (was a couple days ago), and it's finally been patched. If I had used a throwaway I would gladly let you guys know the bank, but I won't since it's trivial to find out who I am from my handle.

Re: What Happens When You Send a Zero-Day to a Bank?

#29

Post by bjt »

devy wrote: post #16
lisper wrote: post #7

The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.

Are you saying NDA without putting a dollar value are unenforceable?

Consideration doesn't have to be denominated in dollars.

Re: What Happens When You Send a Zero-Day to a Bank?

#30

Post by Hermel »

devy wrote: post #16
lisper wrote: post #7

The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.

Are you saying NDA without putting a dollar value are unenforceable?

It's not about the dollar value, it's about having a contract. In a contract, the parties usually agree to do something in return for something else. This NDA is completely one-sided. The author gains nothing. So basically it is a gift, and not a contract. And in many legal systems, it is easier to take back a gift than to undo a contract.
Post reply on HN