3 ms·
I gave them a detailed report of everything, and the $5,000 USD, and the remaining 4,500,000 rewards points were returned. The only compensation I received wit
by ic4l 6y ago
I gave them a detailed report of everything, and the $5,000 USD, and the remaining 4,500,000 rewards points were returned.
The only compensation I received with this whole situation was the termination of my accounts, and a family members account being terminated as well.
It's very hard to know the reasoning behind the termination as they never gave me any information.
- nullc 6y agoAs I was reading your story and got the the part where they said they didn't have a bounty -- for some reason I anticipated that the next line would be them telling you that you could keep the $5,000. I was extremely disappointed. :( Thank you for sharing.
- ic4l 6y agoEven their newly developed responsible disclosure program doesn't have bounties. You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.
- pnutjam 6y agoWhat? That's their bread and butter. You wouldn't expect a pizza place to give away pizza....
- whatl3y 6y agoUhh, I would expect them to do exactly that for someone who presented them valid proof and and an MVP for how someone could get away with stealing tens, hundreds, thousands? of pizzas undetected. Rewarding someone for helping them with their “bread and butter” is how I would expect to be compensated for helping.
- ic4l 6y agoOr maybe just be allowed to return to the pizza shop in the future, and keep ordering pizzas.
- wpietri 6y agoThe core skill of bankers is trading money and risk. They lend you money based on one risk calculation. They put aside more money against default if your loan gets riskier. They set budgets for whole departments of people based on how much they help mitigate risk. So yes, I absolutely expect them to be good at saying, "Well, if we pay $X this year for bugs, that's better than losing $Y directly and paying $Z in cleanup costs."
- pnutjam 6y agosarcasm seems to be unnoticed...
- bonestamp2 6y agoI suspect they know they have a lot of vulnerabilities and they don't want to encourage people to poke around. I mean, their passwords aren't even case sensitive. This is also probably why they fired you as a customer, to discourage anyone else from even trying.
- recursive 6y agoCase-sensitive password gets you <1 bit of entropy per password character. That doesn't sound like that big of a deal.
- tpxl 6y agoSo a password with 10 characters is 1000 times less secure if you don't use case sensitivity. That's a big deal in my eyes.
- recursive 6y ago" times less secure" isn't really well defined. Entropy is usually measured in log-space. And in practice, it's less than one bit, since not all characters are letters.
- etothepii 6y agoThis sounds like the closure was due to Anti Money Laundering. I suspect this sort of activity triggers the banks AML procedures and it's standard operating procedure (sometimes mandated by law) that you can't disclose if an account was closed due to AML breaches. Obviously agree that you weren't money laundering but that's what this closure sounds like.
- gpapilion 6y agoSame thought, and I don’t think they get a lot of choices of this is triggered.
- csharptwdec19 6y agoYou don't. My gut agrees with this statement. Technically, if a SAR was filed, even the engineer he spoke to would not have known. Every training I've ever taken in that field basically says you don't tell anyone but your company's team that you filed such a report. Not a coworker, not even a Manager.
- ic4l 6y agoThis could be possible as well, because they never gave me any information.