3 ms·
Could someone explain how this person is allowed to do that type of testing (sending 200,000 requests)? How would Facebook know he is a white hat and not a blac
by tuna-piano 7y ago
Could someone explain how this person is allowed to do that type of testing (sending 200,000 requests)? How would Facebook know he is a white hat and not a black hat?
I would be interested in starting to try some of these programs, but a bit scared I'd be doing something illegal... Where is the line?
- jakecraige 7y agoThey have a bug bounty program that gives you permission to do certain kinds of things and it not be illegal since you’re planning to report anything you find (and get paid for it)
- stibba 7y agoIf you want to test a company look at their 'Responsible disclosure'. For example: https://www.facebook.com/whitehat https://www.facebook.com/whitehat
- btown 7y agoThe actual "bug" is that Facebook did not have sufficient controls in place to even detect this type of brute-force attack, much less make it impossible to attempt in the first place. Facebook seems (IN THIS INSTANCE) to have appreciated the white-hat nature of this and awarded the bug bounty, but it very well might not have. And certainly other organizations don't take nearly as friendly stances. Generally, I wouldn't bet on most organizations seeing brute-force attacks as in-scope for bug bounties - this is by no means legal advice though.