Leaking the email of any YouTube user for $10k
brutecat.com
Leaking the email of any YouTube user for $10k
1–10 of 487 posts
Re: Leaking the email of any YouTube user for $10k
#2Am I very naive expecting the payout to be significantly higher?
Re: Leaking the email of any YouTube user for $10k
#3I’d misunderstood the title to refer to $10k of GPU compute or something like that. Unfortunately I suspect there’ll be tens or hundreds of occurrences of this bug given that they just picked one old Google product and immediately found a hole.
Re: Leaking the email of any YouTube user for $10k
#4Breaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.
Re: Leaking the email of any YouTube user for $10k
#5Am I very naive expecting the payout to be significantly higher?
Interesting that the bounty amount went down due to how obscure the attack vector was.
Re: Leaking the email of any YouTube user for $10k
#6This is a puny payout IMO. If they poked around a bit more they may have found a better GAIA->Email vulnerability or perhaps could just use the one they found. A database of emails for every major youtube channel would be worth an awful lot.
Re: Leaking the email of any YouTube user for $10k
#7Breaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.
Unfortunately with the number of users Google has, any deprecation will be met with cries of pain / I-rely-on-the-spacebar-to-heat-up-my-computer. See https://killedbygoogle.com/.
Re: Leaking the email of any YouTube user for $10k
#8Question is is this patched or the vulnerability still exists?
Re: Leaking the email of any YouTube user for $10k
#9Am I very naive expecting the payout to be significantly higher?
Unfortunately high payouts is just not how cyber security industry work. Instead of high payouts you get vanity and higher chance to get well-paid job.
Re: Leaking the email of any YouTube user for $10k
#10It's (channel-name)@gmail.com
I'll take a cheque.