4 ms·

From the article: “We reported this in February 2019 to PayPal via HackerOne,” they say. “After an initial rejection and several discussions, PayPal paid a bug

From the article: “We reported this in February 2019 to PayPal via HackerOne,” they say. “After an initial rejection and several discussions, PayPal paid a bug bounty of $4,400.” The pair have not heard from PayPal, they say, since April 2019. But this week “tried and could still use the virtual credit card for online payments.” That means, they told me, “the bug has not been fixed.” To reiterate the OP, what is the point of a bug bounty program that ignores or fails to address reported issues? > The two stories are unrelated They are related in the sense that both stories show a failure to respond to reported issues. > Note that here, Paypal paid a substantial bounty a year ago. They paid but didn’t fix the issue? This is not taking account security serious at all. At best, PayPal has a critical flaw in their bug bounty program.

pvg 7y ago
At best, PayPal has a critical flaw [...] This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation.
- rasengan 7y ago
  > This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation. So you don’t think that sending a bug bounty reward a year ago to a security researcher who exposed a flaw, that is still being exploited to take money from people, is a critical flaw in the program?
  - pvg 7y ago
    Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Do I think your 'motivated googling' approach to analyzing either story is likely to produce worthwhile insight? Not really. We've already seen it be remarkably inaccurate.
    - rasengan 7y ago
      > Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Great! You’re in agreement!

pvg 7y ago

At best, PayPal has a critical flaw [...] This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation.

rasengan 7y ago
> This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation. So you don’t think that sending a bug bounty reward a year ago to a security researcher who exposed a flaw, that is still being exploited to take money from people, is a critical flaw in the program?
- pvg 7y ago
  Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Do I think your 'motivated googling' approach to analyzing either story is likely to produce worthwhile insight? Not really. We've already seen it be remarkably inaccurate.
  - rasengan 7y ago
    > Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Great! You’re in agreement!