171–180 of 239 posts
Earlier quoted context omitted.
> wasn’t a reward I'm pretty sure someone was willing to pay for this, but at least the researches acted responsibly.
Unlikely. If a company does not have a formal BBP, they won't pay 99.99% of the time. Brokers are also not interested in vulnerabilities in companies. They usually only buy vulnerabilities for standard software (components).
Earlier quoted context omitted.
I would say that it is responsible disclosure. Or anyways, not doing that is irresponsible disclosure. The corporation may be hurt by early disclosure, and that’s whatever, but very often, there are a ton of ordinary people that are collateral damage, and the only thing they did wrong was exist in a society where handing over hoards of personal data to a huge corporation is unavoidable. So yes, anyone who discloses b…
This seems to presume the company is ready and willing to take feedback. Maybe things are better now. Years ago the only contact for many companies was through customer service. "What do you mean you're in our computer? You're obviously on the phone!"
Near the bottom of the blog post it says:
> When | What Happened
> Day 1, same day | RBI fixes everything faster than you can say "code red"
> Credit where it's due – RBI's response time was impressive.
The voice recordings at the drive thru without disclaimers of recording seem like maybe a two party state lawyer's wet dream? I guess they could argue shouting into a machine in public carries no expectation of privacy, but it seems like a liability to me.
There’s no liability or exposure for recording non-consensually. It’s a public space. There’s not even an edge case. If a random member if the public could walk into the drive-thru (which they can) then anything can be recorded without notification or consent. Edit: Another commenter has made me aware that some states do ban non-consensual audio recordings in public: https://www.dmlp.org/legal-guide/massachusetts-rec…
That is not how wiretapping laws work in every state.
You need to stop targeting companies without established bug bounties that allow penetration testing, or you’re going to go to jail.
genuinely interested in the last known story of someone going to prison for this type of pen testing without an established bug bounty.
You need to stop targeting companies without established bug bounties that allow penetration testing, or you’re going to go to jail.
Why and what gives you the right to tell them off? Hacking is hacking. If they wish to risk it, what's your problem? They know the risks. Everyone knows hacking is illegal. Same with selling drugs; illegal yet folk do. Same premise. Get caught; no sympathy given. "People may get hurt"? $country throw folk in to war; it's a harsh world we live in. Bug bounty's are only the new norm because the younger audience want va…
The US Constitution? (lot of assumptions of locations here, insert your charter of freedoms/other guarantor of rights here if parent comment OP is not in the US)
Earlier quoted context omitted.
You don’t get to secretly record voices in public spaces.
Yes, You can in America. Video recording is permitted without consent in the public places. Example CCTVs.
This was well know amongst the sort of people who regularly got harassed by police (in my circle of friends, riders of sportsbikes). There was well known legal advice saying to record every interaction you had with police, and if it turned out badly in any way, as soon as you got home write down the transcript of the conversation as "contemporaneous notes" and email them to your gmail account to establish a timestamp. But the only time you ever even mentioned your recording would be to your lawyer, so that if the cop challenged or contradicted your notes in court, your lawyer could then offer the recording as evidence.
These days, dashcams are pretty ubiquitous, and demonstrate that whatever the legal technicalities are, video recording in public without consent is not only widespread, but bashcam footage is also something police regularly request from the public.
Not to nitpick but being emailed a temporary password in cleartext doesn't seem like an issue to me, assuming you're required to change it as soon as you log in.
But it is at least the equivalent of a code smell. perhaps a "UX smell"?
A couple of obvious ways it can go bad: An attacker could potentially have access your email (perhaps from a data breach elsewhere or a password stuffing attach) and use the temp password before you do. If the temp password is the one entered by the user during signup, a naive user could sign up using their commonly-reused-password which then sits in cleartext foreven in their email archive.
Earlier quoted context omitted.
Some companies will keep systems vulnerable indefinitely. If a company hasn’t fixed the issue in a year, public disclosure is likely a better option than doing nothing.
Yes, that is why responsible disclosure almost always comes with deadlines. You give the chance for the company to resolve the issue and mitigate user impact. But if they are taking so long that the user impact will be higher than you just disclose.
Earlier quoted context omitted.
What about users who are affected by the vulnerability in the time it takes between reporting to the vendor and remediation?
That's the tradeoff. If you disclose it broadly without a grace period, someone who didn't even know about the vulnerability before will exploit it faster than even the best postured companies can fix it.
I'm not suggesting in this thread that coordinating with vendors is bad. I'm suggesting that to frame any non-coordinated disclosure as inherently irresponsible is bad, and that is what is implied when we use the label "responsible disclosure" for "coordinated disclosure".