4 ms·
> which allows an attacker to confirm whether a visitor to a web page is logged in to any one of a list of specific Google accounts I actually reported a simil
by patorjk 9y ago
> which allows an attacker to confirm whether a visitor to a web page is logged in to any one of a list of specific Google accounts
I actually reported a similar problem to Google that would allow you to do the same thing back in 2013 (and like you, I used the load and onerror methods for detection). I didn't get a reward either :/.
However, Facebook paid me $1,000 for finding this problem for a particular area of their website (http://patorjk.com/blog/2013/03/01/facebook-user-identification-bug/ http://patorjk.com/blog/2013/03/01/facebook-user-identificat...). So I wouldn't write off this kind of security issue. It seems to depend on who's giving out the bounty.
- TomAnthony 9y agoNice catch! Interesting that they considered it a bug. I thought mine would qualify, but appreciate it is a pretty specific issue.
- Merovius 9y agoGiven that I regularly see my Facebook account name and photo on third party websites, without giving them any permission to see those, I find it hard to believe that Facebook cares about this…
- theGimp 9y agoIt's probably in a Facebook iframe, which is a different story.
- patorjk 9y agoI agree with theGimp. From my experience they do seem to care about this. I actually still carry the debt card they sent me in my wallet (http://imgur.com/TuVKm5k http://imgur.com/TuVKm5k). Facebook also seems to be the most generous in terms of giving out a reward. I ended up submitting a few more issues after this and always got something reasonable (usually 1k to 1.5k).