5 ms·

HackerOne states they are a PCI-DSS auditor approved organization [1]. [1] https://www.hackerone.com/product/challenge https://www.hackerone.com/product/challe

HackerOne states they are a PCI-DSS auditor approved organization [1]. [1] https://www.hackerone.com/product/challenge https://www.hackerone.com/product/challenge

empath75 7y ago
Yeah but someone reporting a vulnerability to HackerOne is not the same as HackerOne reporting it. Otherwise you could just spam HackerOne with reports and remove someone’s compliance.
ailideex 7y ago
> HackerOne states they are a PCI-DSS auditor approved organization Not anywhere on the page you linked. And a "PCI-DSS auditor approved organization" is not a "PCI-DSS approved scanning vendor" which if they were you could just quote the certificate number instead of link to HackerOne. ---- EDIT: I guess you are referring to this: > Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report. This in no way is the same as claiming "we are a PCI-DSS auditor approved organization". Which again, would be irrelevant if it was the case. ---- Further, if you read the article, it is clear the "We" does not refer to "HackerOne". > When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level. As far as I can tell "We" refers to cybernews.com And again even if cybernews was a PCI-DSS approved scanning vendor it would still have to qualify as an official external scan within the PCI-DSS framework.
- rasengan 7y ago
  > Not anywhere on the page you linked. Read the page carefully - it specifically states they are an auditor approved org. Quote from page: “Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report.[1].” Secondly, PayPal works with HackerOne officially [2] and within the CVSS standards as they clearly state on their HackerOne page, which is complying with PCI DSS. [1] https://www.hackerone.com/product/challenge https://www.hackerone.com/product/challenge [2] https://hackerone.com/paypal https://hackerone.com/paypal Edit: Archived incase: http://archive.is/CvZqg http://archive.is/CvZqg http://archive.is/GGDs2 http://archive.is/GGDs2
  - ailideex 7y ago
    What is their certificate number?
    - hedora 7y ago
      > If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce. This comment chain has convinced me that PCI-DSS is a farce.
      - deadmetheny 7y ago
        Pretty much. All it really proves is that an org meets a bare minimum of security standards. As noted elsewhere in the thread, it's used more for marketing and to serve as a "hey look at us we're self-regulating within industry!" than anything else.
      - ailideex 7y ago
        I'm not sure that you being convinced by someone who doesn't even understand that it was not hackerone that found the vulnerabilities says much about PCI-DSS
  - singlow 7y ago
    Even if HackerOne were a company that is licensed to do PCI DSS scans, they were not contracted by PayPal to do it. A PCI DSS scanning company cannot just do independent audits for PCI compliance unless solicited by the target. The auditing process you are referencing is not related at all to reports by unsolicited scanners.
  - tomnipotent 7y ago
    > Read the page carefully Emphasis mine. "...satisfy the requirements for external penetration testing for audited PCI DSS and SOC2 Type II certifications." "Final Report Delivered. Ready for Auditors."
teilo 7y ago
Sorry, but you don't understand what you are looking at. All of HackerOne's information that you cite is about them being PCI-DSS-compliant or having undergone a SOC2 Type 2 audit. Nothing you link to identifies them as a PCI-DSS auditing company. They are not. And the "scans" the PCI-DSS standards refers to are standard pen-test and external vulnerability scans, usually conducted by an accounting company who will certify the scan results. They are for known vulnerabilities, things like the version of Apache you are on, etc. None of the reports sent via HackerOne would qualify as a "scan" under PCI-DSS.
- rasengan 7y ago
  > All of HackerOne's information that you cite is about them being PCI-DSS-compliant or having undergone a SOC2 Type 2 audit. Nothing you link to identifies them as a PCI-DSS auditing company. They are not. Please read the page again. They specifically say you can achieve compliance certification with HackerOne.
  - ailideex 7y ago
    We read the page, and even if your claim holds, it is still irrelevant because whatever you quoted is not the same as being a PCI-DSS approved scanning vendor. And even if it was, HackerOne did not perform any scans. HackerOne offering PCI-DSS approved auditor approved challenges gets you nowhere towards the claims you made in your first comment. To review: 1. HackerOne would have to be a PCI DSS Approved Scanning Vendor - they are not AFAICT, neither is the CyberNews research team that did the scan AFAICT. 2. HackerOne would have to have conducted the scan - they did not. The CyberNews research team did. 3. The scan that HackerOne did would have to qualify as a PCI-DSS external scan - which ... do you get the part that HackerOne did not do the scan here or not? And nowhere did the CyberNews research team claim they performed a PCI-DSS external scan. Please at least try to make an argument for your claims
    - rasengan 7y ago
      “SATISFY COMPLIANCE CERTIFICATION REQUIREMENTS Meet pentest requirements for PCI DSS, SOC2 Type II, and HITRUST compliance certifications.” [1] [1] https://www.hackerone.com/product/pentest https://www.hackerone.com/product/pentest

HackerOne states they are a PCI-DSS auditor approved organization [1]. [1] https://www.hackerone.com/product/challenge https://www.hackerone.com/product/challenge

empath75 7y ago

Yeah but someone reporting a vulnerability to HackerOne is not the same as HackerOne reporting it. Otherwise you could just spam HackerOne with reports and remove someone’s compliance.

ailideex 7y ago

> HackerOne states they are a PCI-DSS auditor approved organization Not anywhere on the page you linked. And a "PCI-DSS auditor approved organization" is not a "PCI-DSS approved scanning vendor" which if they were you could just quote the certificate number instead of link to HackerOne. ---- EDIT: I guess you are referring to this: > Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report. This in no way is the same as claiming "we are a PCI-DSS auditor approved organization". Which again, would be irrelevant if it was the case. ---- Further, if you read the article, it is clear the "We" does not refer to "HackerOne". > When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level. As far as I can tell "We" refers to cybernews.com And again even if cybernews was a PCI-DSS approved scanning vendor it would still have to qualify as an official external scan within the PCI-DSS framework.

rasengan 7y ago
> Not anywhere on the page you linked. Read the page carefully - it specifically states they are an auditor approved org. Quote from page: “Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report.[1].” Secondly, PayPal works with HackerOne officially [2] and within the CVSS standards as they clearly state on their HackerOne page, which is complying with PCI DSS. [1] https://www.hackerone.com/product/challenge https://www.hackerone.com/product/challenge [2] https://hackerone.com/paypal https://hackerone.com/paypal Edit: Archived incase: http://archive.is/CvZqg http://archive.is/CvZqg http://archive.is/GGDs2 http://archive.is/GGDs2
- ailideex 7y ago
  What is their certificate number?
  - hedora 7y ago
    > If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce. This comment chain has convinced me that PCI-DSS is a farce.
    - deadmetheny 7y ago
      Pretty much. All it really proves is that an org meets a bare minimum of security standards. As noted elsewhere in the thread, it's used more for marketing and to serve as a "hey look at us we're self-regulating within industry!" than anything else.
    - ailideex 7y ago
      I'm not sure that you being convinced by someone who doesn't even understand that it was not hackerone that found the vulnerabilities says much about PCI-DSS
- singlow 7y ago
  Even if HackerOne were a company that is licensed to do PCI DSS scans, they were not contracted by PayPal to do it. A PCI DSS scanning company cannot just do independent audits for PCI compliance unless solicited by the target. The auditing process you are referencing is not related at all to reports by unsolicited scanners.
- tomnipotent 7y ago
  > Read the page carefully Emphasis mine. "...satisfy the requirements for external penetration testing for audited PCI DSS and SOC2 Type II certifications." "Final Report Delivered. Ready for Auditors."

teilo 7y ago

Sorry, but you don't understand what you are looking at. All of HackerOne's information that you cite is about them being PCI-DSS-compliant or having undergone a SOC2 Type 2 audit. Nothing you link to identifies them as a PCI-DSS auditing company. They are not. And the "scans" the PCI-DSS standards refers to are standard pen-test and external vulnerability scans, usually conducted by an accounting company who will certify the scan results. They are for known vulnerabilities, things like the version of Apache you are on, etc. None of the reports sent via HackerOne would qualify as a "scan" under PCI-DSS.

rasengan 7y ago
> All of HackerOne's information that you cite is about them being PCI-DSS-compliant or having undergone a SOC2 Type 2 audit. Nothing you link to identifies them as a PCI-DSS auditing company. They are not. Please read the page again. They specifically say you can achieve compliance certification with HackerOne.
- ailideex 7y ago
  We read the page, and even if your claim holds, it is still irrelevant because whatever you quoted is not the same as being a PCI-DSS approved scanning vendor. And even if it was, HackerOne did not perform any scans. HackerOne offering PCI-DSS approved auditor approved challenges gets you nowhere towards the claims you made in your first comment. To review: 1. HackerOne would have to be a PCI DSS Approved Scanning Vendor - they are not AFAICT, neither is the CyberNews research team that did the scan AFAICT. 2. HackerOne would have to have conducted the scan - they did not. The CyberNews research team did. 3. The scan that HackerOne did would have to qualify as a PCI-DSS external scan - which ... do you get the part that HackerOne did not do the scan here or not? And nowhere did the CyberNews research team claim they performed a PCI-DSS external scan. Please at least try to make an argument for your claims
  - rasengan 7y ago
    “SATISFY COMPLIANCE CERTIFICATION REQUIREMENTS Meet pentest requirements for PCI DSS, SOC2 Type II, and HITRUST compliance certifications.” [1] [1] https://www.hackerone.com/product/pentest https://www.hackerone.com/product/pentest