Live data from Hacker News

What Happens When You Send a Zero-Day to a Bank?

privacylog.blogspot.com

101–110 of 454 posts

Re: What Happens When You Send a Zero-Day to a Bank?

#101
post #29

Earlier quoted context omitted.

Consideration doesn't have to be denominated in dollars.

Consideration can be as minimal as "your continued employment with this company." It does not have to be any sort of additional dollar amount.

"We won't sue you", however, is not consideration.

Re: What Happens When You Send a Zero-Day to a Bank?

#102
post #49

Earlier quoted context omitted.

Consideration is a common law concept as far as I can tell. As someone unfamiliar with how it came to be: Why was consideration introduced? What's the rationale, the goal behind it?

IANAL A contract is what lets you sue someone over a private transaction. That's what it does, that's all it does. If for whatever reason you're not willing to bring a contract dispute to court, then your contract doesn't do anything and you wasted your time writing it. Contract = right to sue for breach of contract. In order to sue someone, you need to be able to describe what damages have been done to you. The goal…

"the 'damages' of breaking the contract is equal to the 'consideration' of fulfilling the contract"

This is categorically incorrect.

Damages for breach of contract are supposed to put you back in the position you'd have been in had the contract been performed. It's not related to the value of the consideration.

Consideration is one of the things needed to make a contract binding in English law (along with offer & acceptance, and "intention to create legal relations").

Jurists still debate the rationale for consideration, but the best answer I've found is that contract in English law is seen as an exchange or a “bargain”. There is no gratuitous contract, donations are not contractual right.

By comparison, a contract under French law is based on "consent of the parties" and the theory of individual autonomy. There's no requirement for consideration.

In a "mutual NDA", consideration is easy to find; each party agrees not to disclose confidential information disclosed by the counterparty.

Another way to make an agreement binding without consideration is to sign it as a deed.

https://blogs.warwick.ac.uk/anneprudhomme/entry/consequences...

Re: What Happens When You Send a Zero-Day to a Bank?

#103
post #49

Earlier quoted context omitted.

Consideration is a common law concept as far as I can tell. As someone unfamiliar with how it came to be: Why was consideration introduced? What's the rationale, the goal behind it?

IANAL A contract is what lets you sue someone over a private transaction. That's what it does, that's all it does. If for whatever reason you're not willing to bring a contract dispute to court, then your contract doesn't do anything and you wasted your time writing it. Contract = right to sue for breach of contract. In order to sue someone, you need to be able to describe what damages have been done to you. The goal…

So how do trolls sue for lost revenue?

Re: What Happens When You Send a Zero-Day to a Bank?

#104
post #48

Earlier quoted context omitted.

> a chance at getting a job Yes, that is exactly right. > doesn't seem like a gain Why not? If you don't think that's a gain, why are you wasting your time doing the interview in the first place?

OTOH, I've heard that you can't be forced into an NDA with the consideration of only continued employment.

Consideration is a necessary but not sufficient condition to have a valid contract. There are a lot of other requirements as well. This is why it is best to have a lawyer review any contract you sign, especially when the stakes are high.

Re: What Happens When You Send a Zero-Day to a Bank?

#105

Earlier quoted context omitted.

I'm guessing if you used a popular web-based email service, or any browser email client, then this would be possible.

Possibly, but you'd still have to (try to) "render" it in your browser by opening the mail. On a similar note, your web mail could fetch images in emails ahead of time, but that would still be out of your browser's context

Remember...... 2008. Many people still had "auto download pictures" enabled in their email.

Re: What Happens When You Send a Zero-Day to a Bank?

#106
post #46

Earlier quoted context omitted.

No. But I can read.

Are you a heart surgeon? No but I can read. I'll stick to advice from subject matter experts, not self appointed experts.

There's a helicopter crashed in a house. I don't need to be a pilot to know it's not supposed to do that.

Re: What Happens When You Send a Zero-Day to a Bank?

#107
post #55

Earlier quoted context omitted.

The bank may be able to demonstrate that the vulnerability was not exploited by, e.g., showing that the order preview page was first loaded with the same parameters, or showing a same domain referer.

Maybe the bank should've used this method to prevent the problem in the first place by just checking that the referer request header was from their domain.

Is it proven anywhere that it wasn't?

Re: What Happens When You Send a Zero-Day to a Bank?

#108
post #90

Earlier quoted context omitted.

Not at all. You're making bets based on public information only you have realized is meaningful before informing the rest of the public to make money off that discovery. Quite a few folks make a lot of money this way and (nearly) everyone benefits: https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-...

Maybe but I, personally, would not want to take the risk that I might need to defend that proposition in court.

IANAL but there is no risk that you may have to defend that proposition in court as long as you don't actually exploit the vulnerability and simply point it out.

It's public information.

Now if someone who works at the bank had told you about it, you'd be in a lot of trouble.

Re: What Happens When You Send a Zero-Day to a Bank?

#109

Earlier quoted context omitted.

I don't think it's HSBC, but they do similarly horrific stuff. Almost all banks have a truly terrible online service. I'm a happy user of N26. I very, very highly recommend it to all european customers. I'm never dealing with shitty bank service again. https://n26.com/ (Email me if you want a referral invite).

Wells Fargo and Schwab seem ok in my experience. Wells Fargo even updated their site with slick new UI and menu options are actually findable. Amazing!

I sent feedback about the WF interface and it was actually addressed with 2 weeks. I was floored.

Re: What Happens When You Send a Zero-Day to a Bank?

#110

Earlier quoted context omitted.

I don't think it's HSBC, but they do similarly horrific stuff. Almost all banks have a truly terrible online service. I'm a happy user of N26. I very, very highly recommend it to all european customers. I'm never dealing with shitty bank service again. https://n26.com/ (Email me if you want a referral invite).

Wells Fargo and Schwab seem ok in my experience. Wells Fargo even updated their site with slick new UI and menu options are actually findable. Amazing!

Wells Fargo seems ok in your experience??!! Is that a joke? Your account is wide open to any of thousands of employees who conspire against you. You're ok with that?

It's people like you who keep companies like that in business and encourage such atrocious activity.

Post reply on HN