3 ms·
Assuming the poster is telling the truth, and they only accessed a couple other download IDs to prove their point, then they will likely be ok. But if the post
by Stefan-H 9y ago
Assuming the poster is telling the truth, and they only accessed a couple other download IDs to prove their point, then they will likely be ok. But if the poster instead wrote a quick script to wget incrementally to see how high they could go, then they have gone beyond simply verifying the vulnerability.
I recall a similar case where the person who found a vulnerability in a banking site was shocked that legal recourse was threatened. They were later shown to have enumerated all possible account details.
- flukus 9y ago> I recall a similar case where the person who found a vulnerability in a banking site was shocked that legal recourse was threatened. They were later shown to have enumerated all possible account details. That still leaves us in the position where they were better off stealing the details but keeping quite about the vulnerability. We really need to move to a point where there are zero disincentives to disclosure. That bank deserves everything they get next time there is a problem.
- Stefan-H 9y agoA metaphor for you: If an individual finds that a door is unlocked, they should feel the right to search the whole house and catalog all the person's belongings? I fully agree that there should be zero disincentives to RESPONSIBLE disclosure. Fully copying down a database, for example, to prove that there is weak authentication would not be responsible disclosure and opens the data to significantly more risk than the vulnerability alone did.