I wonder if anyone has written a successful exploit of the crawlers folks use to scan this?
Security.txt (2017)
31–40 of 56 posts
Re: Security.txt (2017)
#32I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…
What if it was required to encrypt the message? Do you think the number of spam would go down?
I haven't explicitly tried to enforce encryption, but probably the drive-by style reports would require extra steps that their automation might not handle. So probably a good first filter. But then I'm still no wiser since the ability to use pgp isn't a qualifier regarding knowledge of the engineer or quality of their report.
It seems that the underlying problem is that those that do good work in this space don't scan the web to find new customers/leads to pitch their service in shambolic ways. And the skiddies who want to make a quick buck will outnumber the good who might accidentally have ended up on your site (because they like your product etc).
the noise/quality ratio in the whole approach is just too big for this to work well in practice. I'm still waiting for the recruitment industry to catch up with the practice and use the security.txt as a sink for people who want to be added to a list of experts that will be contacted when "the company is ready to do a full security assessment post-MVP". I realize this would be fraudulent and I'm not advocating for it - just saying that fake-job offers aren't uncommon either so this will just be a question of time.
Re: Security.txt (2017)
#33Good idea but terrible URL. Web servers by default don’t server hidden folders. Why not just example.com/security.txt instead of example/.well-known/security.txt?
Re: Security.txt (2017)
#34Good idea but terrible URL. Web servers by default don’t server hidden folders. Why not just example.com/security.txt instead of example/.well-known/security.txt?
It's a .well-known way to serve additional metadata for a website.
https://en.wikipedia.org/wiki/List_of_/.well-known/_services...
Better link from stedaniels further in comments: https://ma.ttias.be/well-known-directory-webservers-aka-rfc-...
Re: Security.txt (2017)
#35I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…
If you don't mind sharing, what kind of ballpark amount of traffic were you getting for those domains that generated that many emails per week on the subject?
Re: Security.txt (2017)
#36I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…
Reminds me of the horrific metrics associated with public bug bounties. Thanks for sharing, that's pretty rough.
Re: Security.txt (2017)
#37I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…
This is a rather common tactic, they spam out automated security reports, and request a payment for their "services" from those who reply and engage further with them.
On a related note, I often feel uncomfortable reading about a responsible disclosure, and find coordinated disclosure to be a much more balanced term in the context of disclosing security vulnerabilities.
Re: Security.txt (2017)
#38I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…
Thanks for this post. Gives more than enough reasons not to use security.txt.
Having it in a place which requires human interaction to form a contract makes more sense. Cant automate that.
Re: Security.txt (2017)
#39I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…
If you don't mind sharing, what kind of ballpark amount of traffic were you getting for those domains that generated that many emails per week on the subject?
just north of 500K visitors/day (that's across all sites but they were anyway operated by the same org and in 1 specific industry niche).
I conjecture that with these drive-by style reports you won't see a huge fluctuation in reports and traffic might not have a huge effect. I got no proof for this but if my hunch is right then there is a limited number of bad-actors that operate in this market. And if they all operate by copying their model from one another then the traffic should be similar regardless of how your popular domains are. Would be cool to have some data on this.
Re: Security.txt (2017)
#40Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.
I was working on a shared hosting environment (EIG) and saw this newly created directory (well-known) and promptly freaked. I viewed that dir and inside was "acme-challenge" and I freaked even more, thinking my client had been hacked. Was very happy to see this was not a hack, but found the naming conventions very odd.