4 ms·
I've always got the impression that it's more convenient and less risky to not tell anyone; when the flaw is eventually exploited, you don't want to be the one
by bonzoesc 15y ago
I've always got the impression that it's more convenient and less risky to not tell anyone; when the flaw is eventually exploited, you don't want to be the one on record as having known about it.
- mike-cardwell 15y agoOr report it anonymously using Tor or a remailer. If you do it anonymously, you also get the benefit of being able to safely threaten the bank that you will release the information publicly if they haven't fixed it within x days.
- stephen_g 15y agoOr you could just send them a real letter (I think an institution like a bank would respond better to that than an email). I'd just tell them that I'm a concerned customer who stumbled upon the flaw. I would never threaten them to release it publicly though - I'd tell them that I'd forward the letter to the relevant government organisation. Where I am in Australia this would be something like the BFSO (Banking and Financial Services Ombudsman) and/or ACCC (Australian Consumer and Competition Commission).