3 ms·

Also remember that the story we have here is a one sided narration from a bug bounty researcher. The story tells us his side of things but what specifically Fa

Also remember that the story we have here is a one sided narration from a bug bounty researcher. The story tells us his side of things but what specifically Facebook perceived as threat is still unknown ? Why would a CSO get involved unless they specifically think that the data has been accessed violating the goodwill of the bug bounty research in the first place.

Zikes 11y ago
That's true, there could be large portions of the story that are omitted or inaccurate. We may never even get the full story. Assuming the story as stated is truthful or even plausible, what options do whitehat hackers have to defend themselves in such a scenario? I mean the whole point seems to be to try to penetrate a secure system, and the consequences of that action seems to be fairly obvious from the start. If a whitehat hacker is successful, that carries with it the inherent potential that they will have some sort of access to some sort of sensitive data, right? Surely telling Facebook "I was able to access these exact things" means he expected Facebook to update passwords and change keys accordingly, making the possibility that he retained those keys moot.
- lettergram 11y ago
  It almost seems like Facebook wanted to know about the issue, but not have to update the keys.
yeukhon 11y ago
He claims he had access to so many credentials. That's a P1 security protocol. You can't just let a manager to handle it. Your executive boss, CSO, has to step in.
tvmalsv 11y ago
> Why would a CSO get involved unless they specifically think that the data has been accessed... The most likely reason I can think of is that he was getting some heat from some other C*O. Edit: Now that Alex's side of the story has been released, his actions don't seem out of line (assuming it's reasonably accurate, and I have no reason to suspect it isn't). While my explanation is still a valid answer, I agree with the parent. Sounds like he was just doing his job. Though it would be interesting to listen to the audio of the conference call....

Zikes 11y ago

That's true, there could be large portions of the story that are omitted or inaccurate. We may never even get the full story. Assuming the story as stated is truthful or even plausible, what options do whitehat hackers have to defend themselves in such a scenario? I mean the whole point seems to be to try to penetrate a secure system, and the consequences of that action seems to be fairly obvious from the start. If a whitehat hacker is successful, that carries with it the inherent potential that they will have some sort of access to some sort of sensitive data, right? Surely telling Facebook "I was able to access these exact things" means he expected Facebook to update passwords and change keys accordingly, making the possibility that he retained those keys moot.

lettergram 11y ago
It almost seems like Facebook wanted to know about the issue, but not have to update the keys.

yeukhon 11y ago

He claims he had access to so many credentials. That's a P1 security protocol. You can't just let a manager to handle it. Your executive boss, CSO, has to step in.

tvmalsv 11y ago

> Why would a CSO get involved unless they specifically think that the data has been accessed... The most likely reason I can think of is that he was getting some heat from some other C*O. Edit: Now that Alex's side of the story has been released, his actions don't seem out of line (assuming it's reasonably accurate, and I have no reason to suspect it isn't). While my explanation is still a valid answer, I agree with the parent. Sounds like he was just doing his job. Though it would be interesting to listen to the audio of the conference call....