3 ms·
I don't know, how much is the security bug bounty on LastPass? $1000 according to Bugcrowd [1]. But what would be the right value? That's the only way we ensur
by tajen 11y ago
I don't know, how much is the security bug bounty on LastPass? $1000 according to Bugcrowd [1]. But what would be the right value?
That's the only way we ensure it's economically more viable for hackers to resell their security leaks to LastPass than to pirates. An economic approach would claim that the total available bug bounty scheme must be worth the same as the potential stolen value of the contents, otherwise it's still valuable to exploit the leak rather than publish them. The only savings that LastPass can make is over the gap between insured value and their ability to not have leaks.
[1] https://bugcrowd.com/lastpass https://bugcrowd.com/lastpass
- josefresco 11y agoI doubt most small businesses could afford a bug bounty that would exceed potential illegal profits from selling an exploit to bad actors. I don't think the economics work at any scale. Could Google, Apple or Microsoft even outbid a nation state seeking to purchase an exploit?
- nhstanley 11y agoNo, but I think as long as the bug bounties pay enough to keep someone comfortable (along with added notoriety/resume padding with it), you'll have enough moral people choosing to reveal them to the companies rather than bad actors. Maybe that's naive. $1k bucks though probably isn't that number. More like $50k or $100k for 0-day level stuff.
- emodendroket 11y agoWell, maybe, but states don't just have more resources to buy exploits; they also have more resources to devote to finding them in the first place.
- cookiecaper 11y agoStates are not really the buyers to be concerned about. In many cases, the state already has tools that give them enhanced access to target data, all the way up to the authority to obtain and execute warrants. The people that are really worrisome are private malicious actors.