3 ms·
$5k seems embarrassingly low so something with such horrendous impact. Potentially allowing for doxing, and because phone numbers are the lynchpin for many 2FA
by Nexxxeh 4y ago
$5k seems embarrassingly low so something with such horrendous impact. Potentially allowing for doxing, and because phone numbers are the lynchpin for many 2FA and consumer-facing telco security is generally lax, total user hijacking across multiple platforms. What an absolute disaster.
- languageserver 4y agoif the disclosure and fix time is half a year, a blackhat is now able to both claim the bug bounty and sell the day zero exploit
- lrvick 4y agoI have found many far more serious bugs, even at larger companies, that have paid me under $500. No one feels security researchers time is even worth that of the internal engineers creating the bugs.
- kfichter 4y agoCrypto bounties pay quite well; https://immunefi.com/ https://immunefi.com/
- neilv 4y agoBesides impact, $5K also doesn't make sense when compared to employee compensation.