Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaking the email of any YouTube user for $10k

brutecat.com

Post reply on HN
Print view View original

61–70 of 487 posts

Re: Leaking the email of any YouTube user for $10k

#61

Post by zwnow »

nullderef wrote: post #4

Breaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.

The point is: security is fake. No app is truly secure. You can spend millions on app security and all it takes to breach that is one slip up of a human user.

Re: Leaking the email of any YouTube user for $10k

#63

Post by mosselman »

tptacek wrote: post #53
55555 wrote: post #6

This is a puny payout IMO. If they poked around a bit more they may have found a better GAIA->Email vulnerability or perhaps could just use the one they found. A database of emails for every major youtube channel would be worth an awful lot.

Serverside vulnerabilities have essentially no market outside of bug bounties. This is a hell of a payout for a web finding.

Unless you build a “get email for all of your viewers” service that streamers use to gather emails

Re: Leaking the email of any YouTube user for $10k

#64

Post by KomoD »

imdsm wrote: post #45
55555 wrote: post #6

This is a puny payout IMO. If they poked around a bit more they may have found a better GAIA->Email vulnerability or perhaps could just use the one they found. A database of emails for every major youtube channel would be worth an awful lot.

Think this is puny — I found the ability to reveal emails in npmjs.org but as it hadn't been included in the new GitHub/Microsoft bug bounty scope yet, I was given a t-shirt and $1000. Talk about puny!

I think this is puny: I was able to take over accounts on a cybersecurity platform just by knowing their account email and was only paid $200

Re: Leaking the email of any YouTube user for $10k

#65

Post by tptacek »

mosselman wrote: post #63
tptacek wrote: post #53

Earlier quoted context omitted.

Serverside vulnerabilities have essentially no market outside of bug bounties. This is a hell of a payout for a web finding.

Unless you build a “get email for all of your viewers” service that streamers use to gather emails

And then Google notices, kills the bug, and comes after you. Meanwhile, each of those streamers is criminally liable. Sounds like a great business!

Re: Leaking the email of any YouTube user for $10k

#66

Post by GuB-42 »

sd9 wrote: post #29
doctorhandshake wrote: post #16

Is it me or are all the dates in this timeline in the future? Isn’t it Feb 2025 now? Do you smell toast? EDIT: oh I see .. DD/MM/YY is a new one to me

MM/DD/YY is an exclusively American standard https://en.wikipedia.org/wiki/List_of_date_formats_by_countr... I have no idea why America settled on MM/DD/YY, which seems like absolutely the least intuitive permutation of D, M, and Y. Except perhaps MYD.

It seems like it comes from an british convention of spelling dates "February 12, 2025" instead of the now more common "The 12th of February, 2025".

Like US customary units, imported from the british, but the UK modernized its system, not the US.

Re: Leaking the email of any YouTube user for $10k

#67

Post by SigmundA »

sd9 wrote: post #29
doctorhandshake wrote: post #16

Is it me or are all the dates in this timeline in the future? Isn’t it Feb 2025 now? Do you smell toast? EDIT: oh I see .. DD/MM/YY is a new one to me

MM/DD/YY is an exclusively American standard https://en.wikipedia.org/wiki/List_of_date_formats_by_countr... I have no idea why America settled on MM/DD/YY, which seems like absolutely the least intuitive permutation of D, M, and Y. Except perhaps MYD.

To me its sounds better and more correct to say:

February 12th, 2025

Rather than:

12 February 2025

And is easier to say than:

The 12th of February 2025

So it's always been natural to write the numeric form the same way, but I am American. I can appreciate day first being easier to sort by machines and having an agreed upon international standard.

Re: Leaking the email of any YouTube user for $10k

#68

Post by Frieren »

fnordian_slip wrote: post #13

Very nice breakdown. But while 10,000 dollars seems like a decent sum, I expected more for a bug of this severity, if I'm being honest. Especially as they initially only awarded 3100. But I'm not sure how much is usual for such cases. Almost 150 days also seems kind of a long time for fixing it imho.

Bounties make sense for open source projects where the main reward is to contribute to the community.

For private corporations/closed code, it is a way to get a thousand engineers looking at their code and APIs and only pay a small amount to however is the first one to find something. Everybody else gets nothing even if they put a lot of time and effort.

Underpaid is an understatement.

Re: Leaking the email of any YouTube user for $10k

#69

Post by ajross »

55555 wrote: post #6

This is a puny payout IMO. If they poked around a bit more they may have found a better GAIA->Email vulnerability or perhaps could just use the one they found. A database of emails for every major youtube channel would be worth an awful lot.

What would an appropriate payout be? I mean, the classification ("high exploit probability, abuse-related impact") seems about right to me. Are you saying that abuse bugs should be more valuable? That all bugs should pay more? That this is a rich company so they should pay more?

> If they poked around a bit more they may have found a better GAIA->Email vulnerability

They still can! Report more bugs, get more bounties. I don't see how this is related to how much they paid for this one.

> A database of emails for every major youtube channel would be worth an awful lot.

It's pretty clear from the article that you can't use this API to scrape at that kind of volume. This kind of thing was never in the offering. As the title says, you can leak "any" email, not "every" email.

Re: Leaking the email of any YouTube user for $10k

#70

Post by TheDong »

zwnow wrote: post #61
nullderef wrote: post #4

Breaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.

The point is: security is fake. No app is truly secure. You can spend millions on app security and all it takes to breach that is one slip up of a human user.

I'd take away "security is complicated and multi-faceted", not "fake".

It's not a black and white of "an app is truly secure" or "an app is truly insecure", but rather a continuum from "secure enough in practice for this threat model and purpose" to "an insecure mess".

Like, plenty of websites and apps have launched, existed for years, and then shutdown without a single security incident. In those cases, surely the app was secure, right? At least secure enough? Signal so far has been "secure enough in practice" for most people, while iMessage has in practice been "secure enough if you're a normal person, but with serious security issues for anyone who might be subject to serious targeted attacks"

Say more about what you mean by "no app is truly secure"? Especially in the context of signal?

Post reply on HN