4 ms·

A naive question here: Suppose I accidentally stumble upon a gaping security hole in my bank's online service (or any other online service for that matter). A

by yuvadam 15y ago

A naive question here: Suppose I accidentally stumble upon a gaping security hole in my bank's online service (or any other online service for that matter). Am I legally obliged to notify them of that security bug? Can I offer the bank my assistance, for hire, in solving the bug without it constituting blackmail? (i.e. I'd be happy to help you solve this at a $300/hr rate)

bonzoesc 15y ago
I've always got the impression that it's more convenient and less risky to not tell anyone; when the flaw is eventually exploited, you don't want to be the one on record as having known about it.
- mike-cardwell 15y ago
  Or report it anonymously using Tor or a remailer. If you do it anonymously, you also get the benefit of being able to safely threaten the bank that you will release the information publicly if they haven't fixed it within x days.
  - stephen_g 15y ago
    Or you could just send them a real letter (I think an institution like a bank would respond better to that than an email). I'd just tell them that I'm a concerned customer who stumbled upon the flaw. I would never threaten them to release it publicly though - I'd tell them that I'd forward the letter to the relevant government organisation. Where I am in Australia this would be something like the BFSO (Banking and Financial Services Ombudsman) and/or ACCC (Australian Consumer and Competition Commission).
ctdonath 15y ago
Legally obligated? no. It's not your system, it's not your problem in that sense. Sure you can offer to fix it, but since you don't know squat about the system (save for a small flaw at the surface) and they have teams of developers who do, they won't be interested in paying you to fix it. Offering to explain the bug for a fee won't be blackmail unless you threaten to reveal the bug to others if they don't pay up. Be a decent chap. Send 'em a nice letter explaining the problem. It's your bank, remember, and they're humans like you; work with your service providers to improve the service. Assume you're not the only one who knows about the problem, that someone who also knows isn't as nice as you, and it's YOUR bank balance that is at risk.
- clistctrl 15y ago
  Of course then there is the saying "No good deed goes unpunished."
- rapind 15y ago
  But it's a corporation, not humans like you. I'm sure they employ lots of decent people. I'm sure they employ lots of douchebags too. It's irrelevant. It's a corporation who's only motivation is to make money. It's not your neighbour. If you like their service and feel like telling them then go for it. If you want to try to charge them, then go for it (no it doesn't make you evil to charge for a service). If they don't want to pay you, feel free to say nothing. Now if it's a mom and pop shop down the street, then yes, please be a good neighbour and help them fix it (although you can still charge for it, but avoid douchebaggery like $300 / hour unless that's your usual rate).
  - billybob 15y ago
    Hmmm. How successful does the mom and pop have to be before you feel no obligation to tell them?
    - sixtofour 15y ago
      When Mom and Pop work in a corporate office.
    - rapind 15y ago
      As a general rule for me it's once a company goes public. At that point the company is subject to practically anonymous shareholders through many levels of abstraction. Voting is then done based purely on financials and often short term gains, which really puts a company at odds with their customers. So I have no customer loyalty to a company that's publicly traded. Many private companies can still maintain my loyalty though based purely on their actions if the owner(s) / investors aren't completely disconnected from their customers. That's more of a case by case. The smaller they are, the more likely they care about their customers (there are always exceptions though).

by yuvadam 15y ago

bonzoesc 15y ago

I've always got the impression that it's more convenient and less risky to not tell anyone; when the flaw is eventually exploited, you don't want to be the one on record as having known about it.

mike-cardwell 15y ago
Or report it anonymously using Tor or a remailer. If you do it anonymously, you also get the benefit of being able to safely threaten the bank that you will release the information publicly if they haven't fixed it within x days.
- stephen_g 15y ago
  Or you could just send them a real letter (I think an institution like a bank would respond better to that than an email). I'd just tell them that I'm a concerned customer who stumbled upon the flaw. I would never threaten them to release it publicly though - I'd tell them that I'd forward the letter to the relevant government organisation. Where I am in Australia this would be something like the BFSO (Banking and Financial Services Ombudsman) and/or ACCC (Australian Consumer and Competition Commission).

ctdonath 15y ago

Legally obligated? no. It's not your system, it's not your problem in that sense. Sure you can offer to fix it, but since you don't know squat about the system (save for a small flaw at the surface) and they have teams of developers who do, they won't be interested in paying you to fix it. Offering to explain the bug for a fee won't be blackmail unless you threaten to reveal the bug to others if they don't pay up. Be a decent chap. Send 'em a nice letter explaining the problem. It's your bank, remember, and they're humans like you; work with your service providers to improve the service. Assume you're not the only one who knows about the problem, that someone who also knows isn't as nice as you, and it's YOUR bank balance that is at risk.

clistctrl 15y ago
Of course then there is the saying "No good deed goes unpunished."
rapind 15y ago
But it's a corporation, not humans like you. I'm sure they employ lots of decent people. I'm sure they employ lots of douchebags too. It's irrelevant. It's a corporation who's only motivation is to make money. It's not your neighbour. If you like their service and feel like telling them then go for it. If you want to try to charge them, then go for it (no it doesn't make you evil to charge for a service). If they don't want to pay you, feel free to say nothing. Now if it's a mom and pop shop down the street, then yes, please be a good neighbour and help them fix it (although you can still charge for it, but avoid douchebaggery like $300 / hour unless that's your usual rate).
- billybob 15y ago
  Hmmm. How successful does the mom and pop have to be before you feel no obligation to tell them?
  - sixtofour 15y ago
    When Mom and Pop work in a corporate office.
  - rapind 15y ago
    As a general rule for me it's once a company goes public. At that point the company is subject to practically anonymous shareholders through many levels of abstraction. Voting is then done based purely on financials and often short term gains, which really puts a company at odds with their customers. So I have no customer loyalty to a company that's publicly traded. Many private companies can still maintain my loyalty though based purely on their actions if the owner(s) / investors aren't completely disconnected from their customers. That's more of a case by case. The smaller they are, the more likely they care about their customers (there are always exceptions though).