5 ms·
I believe this is the vulnerability reported to Twitter which awarded $5000 from its bug bounty program. https://hackerone.com/reports/1439026 https://hackeron
by hnburnsy 4y ago
I believe this is the vulnerability reported to Twitter which awarded $5000 from its bug bounty program.
https://hackerone.com/reports/1439026 https://hackerone.com/reports/1439026
- Nexxxeh 4y ago$5k seems embarrassingly low so something with such horrendous impact. Potentially allowing for doxing, and because phone numbers are the lynchpin for many 2FA and consumer-facing telco security is generally lax, total user hijacking across multiple platforms. What an absolute disaster.
- languageserver 4y agoif the disclosure and fix time is half a year, a blackhat is now able to both claim the bug bounty and sell the day zero exploit
- lrvick 4y agoI have found many far more serious bugs, even at larger companies, that have paid me under $500. No one feels security researchers time is even worth that of the internal engineers creating the bugs.
- kfichter 4y agoCrypto bounties pay quite well; https://immunefi.com/ https://immunefi.com/
- neilv 4y agoBesides impact, $5K also doesn't make sense when compared to employee compensation.
- oars 4y agoThanks for sharing this link. Twitter should've shared it in their post...
- thenoblesunfish 4y agoAnyone have any idea how many of these bounties are collected by people who actively look (seems like a hard way to make a living) vs. say people with some knowledge who stumble across the issue and wouldn't take the time to properly report, otherwise (might convince me to take a couple of hours)?