4 ms·
Even their newly developed responsible disclosure program doesn't have bounties. You would think out of all people a bank would have deep enough pockets to aff
by ic4l 6y ago
Even their newly developed responsible disclosure program doesn't have bounties.
You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.
- pnutjam 6y agoWhat? That's their bread and butter. You wouldn't expect a pizza place to give away pizza....
- whatl3y 6y agoUhh, I would expect them to do exactly that for someone who presented them valid proof and and an MVP for how someone could get away with stealing tens, hundreds, thousands? of pizzas undetected. Rewarding someone for helping them with their “bread and butter” is how I would expect to be compensated for helping.
- ic4l 6y agoOr maybe just be allowed to return to the pizza shop in the future, and keep ordering pizzas.
- wpietri 6y agoThe core skill of bankers is trading money and risk. They lend you money based on one risk calculation. They put aside more money against default if your loan gets riskier. They set budgets for whole departments of people based on how much they help mitigate risk. So yes, I absolutely expect them to be good at saying, "Well, if we pay $X this year for bugs, that's better than losing $Y directly and paying $Z in cleanup costs."
- pnutjam 6y agosarcasm seems to be unnoticed...
- bonestamp2 6y agoI suspect they know they have a lot of vulnerabilities and they don't want to encourage people to poke around. I mean, their passwords aren't even case sensitive. This is also probably why they fired you as a customer, to discourage anyone else from even trying.
- recursive 6y agoCase-sensitive password gets you <1 bit of entropy per password character. That doesn't sound like that big of a deal.
- tpxl 6y agoSo a password with 10 characters is 1000 times less secure if you don't use case sensitivity. That's a big deal in my eyes.
- recursive 6y ago" times less secure" isn't really well defined. Entropy is usually measured in log-space. And in practice, it's less than one bit, since not all characters are letters.