4 ms·
For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault. https://bugcrowd.com/agilebits
by TimTheTinker 5y ago
For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault.
https://bugcrowd.com/agilebits https://bugcrowd.com/agilebits
- SkyMarshal 5y agoI suspect that’s not nearly enough, given that their breached database would probably sell for multiple orders of magnitude more on the darknet. Should probably be $1M at least.
- jolux 5y ago1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. A successful hack of 1Password would probably require pushing bad client updates. Besides which bug bounties are not really intended to disincentivize people from committing crimes, they're intended to incentivize researchers to report findings and reward them for their efforts.
- deleted 5y ago[deleted]
- TimTheTinker 5y agoParent comment is right about the value of a successful vault exploit. Given the number of people and companies using 1Password now, $100k would likely pale in comparison to an exploit's value on the black market.
- coldtea 5y ago>1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. Doesn't matter for our case, since it already assumes the database potentially compromisable. The parent's comment concerned whether the "bounty for capturing a flag inside a publicly available encrypted vault" is enough. So the question is not whether the bounty is enough given it's impossible to win, but whether it's enough given it might be possible to win. In other words, whether someone who finds an exploit to decrypt the vaults contents would get a better value by (a) revealing it to 1Password company and taking the $100K bounty, or (b) selling the exploit to people who would give millions to be able to decrypt other's vaults...
- jolux 5y agoThe value of such an exploit likely exceeds their valuation.
- junon 5y agoI think you misunderstand how 1password vaults works.
- steelstraw 5y agoThat is terribly low for such a critical issue. There are Ethereum L2s that pay out $2M bounties. https://twitter.com/saurik/status/1491821215924690950 https://twitter.com/saurik/status/1491821215924690950
- dogman144 5y agoThat's a bad analogy, although you point out a possibly good thing for L2/crypto - the bug bounties are massive because the projects have a silly amount of funds. Password managers don't operate with those economic models though.
- steelstraw 5y ago1Password has raised almost $1B. Surely they could put at least $1M toward a critical bounty?
- dogman144 5y agoDepends on the cost/benefit. 3x security engineers to detect/respond vulns and attacks is less expensive but gets similar coverage plus a lot of other work capacity, for instance.
- andrecarini 5y ago1M allocated to this bug bounty is 1M not spent if their security is strong enough.
- gunapologist99 5y agoWhat cost? There is literally zero cost. Unless a successful attack actually occurs, in which case it's literally almost priceless in terms of their reputational damage, unless they can get their hands on it before someone else.
- dogman144 5y ago