3 ms·
Google bug bounty program is a sham. When I tried to report critical vulnerability in their authentication system, they told it's a 'feature' and threatened to
by Svoka 4y ago
Google bug bounty program is a sham. When I tried to report critical vulnerability in their authentication system, they told it's a 'feature' and threatened to sue if I disclose.
Then fixed it in two and a half years, and wrote an article on how complicated bug they just found and how proud and secure they are with their pentesters.
- deepsun 4y agoDo you have a link?
- Svoka 4y agoIt was looong time ago (2011). You could use app specific password to change master password and disable 2FA, with a script. Funny thing. I had to discover this way myself when I lost my phone with Authenticator App. I took my mail client password and discovered that with some header magic I was able to hijack my own account. I couldn't believed it. So I created another account, protected with 2FA and did same thing. Got gaslighted by Google bug bounty team and decided it's not worth it.
- Spivak 4y agoYou have inadvertently discovered the value of pentesters which is making handling security issues a win for the the management.
- Lorin 4y agoOn what grounds could they sue you if it was truly considered a "feature", and they used that exact terminology in their response?