4 ms·

Did this guy seriously try to reach the security team through the normal customer support channel that's probably automated with bots, and then judged the compa

Did this guy seriously try to reach the security team through the normal customer support channel that's probably automated with bots, and then judged the company according to that? And that's after they do have a bug bounty program, and instead of speaking with bugcrowd who denied him, he decided to go through a channel that's clearly not meant to handle these kinds of issues. This is just such a poor understanding of how companies work. If he just emailed a real person in the company he'd have a real chance of getting a real response. Imagine judging a pizza company by how the pizza ordering hotline didn't take your vulnerability disclose. This sounds ridiculous. Now customer support is just like pizza ordering line. If you want to contact a company on something they usually don't have a normal channel, you need to speak to the right people. Need to write a nice email, even if they don't have "security.txt", to some manager or someone else you could contact, and ask nicely who to contact further about it. And try more than one person. If you're not a customer, do not go through customer support. It's the worst channel in every company because they need to serve bulk communication. And they see an incredible amount of shit from confused customers, so don't expect them to realize that there's something important going on. And be nice. If you're acting like an asshole, you could have a million dollar issue and you won't get past customer support. They are asshole filter. They are meant to filter out all the assholes trying to reach the corporation. Their number 1 instinct is to block assholes. If you sound like trouble, it's literally their job to filter you.

plaguepilled 4y ago
Wat? If the "ordering hotline" in this instance didn't know what to do, surely they should tell their manager? That's how it works in most businesses. Why is it suddenly different for hackable pizza stores?
- machina_ex_deus 4y ago
  At most they would refer you elsewhere, but most probably they would kindly ask you contact someone else so they can serve people looking to order pizzas. They get prank calls and all sorts of nonsense. They get customers asking all kinds of weird questions constantly, and they can't distinguish them from Mr important security researcher here that's not even a customer. They will just get confused, return an automated reply and move on to next request because they are paying them to handle bulk requests. They are not meant to escalate to manager, it's literally their job not to do it. And their manager is just another customer support person.
  - some_furry 4y ago
    > and they can't distinguish them from Mr important security researcher here that's not even a customer Bold of you to assume that I wasn't a customer. (I was, at one point. Not that it's relevant today.)
    - machina_ex_deus 4y ago
      It's interesting that after all my points, you decide to nitpick that one sentence where I didn't assume you weren't a customer, I stated the fact that you didn't contact them as a customer. It's interesting because it's similar to how you decided to base your entire judgement of this company on encounter with customer support. You can't just throw everything into bad or good bucket because of how it triggers you emotionally. I bet I quite annoyed you. Doesn't mean the best thing to do is just find that one sentence where I'm slightly wrong and judge me on that. Try to emotionally detach. When a bug is pissing you off, do you throw the whole program with it? Or do you understand what's going on and what is there to learn, despite the annoying bug? Do I have something to learn from this incredibly annoying person that embarrassed me on HN? Or should I just find something to nitpick? I'm not your enemy. Customer support isn't your enemy. And the security researcher coming to your company with some anoying bug bounty isn't an enemy either. There's that saying, Homo homini lupus. Don't be like that.
      - plaguepilled 4y ago
        Sorry dude but your argument here is extremely weak. You need to establish why the customer support couldn't refer the call. "Crank calls are a thing" really doesn't cut it.
detaro 4y ago
You should read the linked blogposts about the "speaking with bugcrowd". (TL;DR: it took a few months and a minor social media shitstorm after they banned him for them to notice that their processes suck) Attempting alternative contact paths in parallel is entirely valid. > Need to write a nice email, even if they don't have "security.txt", to some manager or someone else you could contact That's clearly what he did: contact those who he could contact. If the only contact info you publish is your support team, then your support them has to be able to handle everything people try to contact you about. So yes, it's an entirely valid expectation that the publicly provided contact for a security company can handle requests to please be directed to the security team. It's your choice as a company to not make your security team directly available, and your problem if people thus can't reach it.
- machina_ex_deus 4y ago
  You would probably have a better chance of escalating any issue with a mail to anyone that isn't customer support. If you're a security researcher, imagine customer support as this big human firewall to communicating with this corporation, meant to be extremely strict so the communication with the rest of the cooperation won't be flooded with all the things customers want. If you're not understanding this properly and wasting time trying to contact someone through customer support, that's on you. Which company doesn't even matter.
  - arp242 4y ago
    > If you're not understanding this properly and wasting time trying to contact someone through customer support, that's on you. Which company doesn't even matter. There really are plenty of companies where this would have worked fine; I'm reasonably confident contacting support@ for something like this at all places I've ever worked would have been escalated. Maybe with some back-and-forth for 1 or 2 messages, but not outright refusal. One reason why I always try to have a good relationship with the support staff (including talking to them at company parties and the like) is so they're not afraid to "bother" me if they're not sure about something. Of course support shouldn't be bothering me with basic inane stuff, but as an organisation you can certainly foster different kind of cultures and attitudes. That said, your chances of this working are usually proportional to the size of the organisation: the larger the organisation, the less chance you have. Still, LastPass isn't that large, and the support person does seem rather obtuse. I suspect that Soatok's style of communication didn't help with that, as it may have caused the bozo bit to flip for the support person. This in turn seemed to have caused Soatok's bozo bit to flip for the support person as well. However, at the end of the day, it's primarily the company's responsibility they're contactable in a reasonable manner, and it's not "on you" if they're not. Having to e-stalk and contact random people who happen to work for LastPass is not reasonable.

plaguepilled 4y ago

Wat? If the "ordering hotline" in this instance didn't know what to do, surely they should tell their manager? That's how it works in most businesses. Why is it suddenly different for hackable pizza stores?

machina_ex_deus 4y ago
At most they would refer you elsewhere, but most probably they would kindly ask you contact someone else so they can serve people looking to order pizzas. They get prank calls and all sorts of nonsense. They get customers asking all kinds of weird questions constantly, and they can't distinguish them from Mr important security researcher here that's not even a customer. They will just get confused, return an automated reply and move on to next request because they are paying them to handle bulk requests. They are not meant to escalate to manager, it's literally their job not to do it. And their manager is just another customer support person.
- some_furry 4y ago
  > and they can't distinguish them from Mr important security researcher here that's not even a customer Bold of you to assume that I wasn't a customer. (I was, at one point. Not that it's relevant today.)
  - machina_ex_deus 4y ago
    It's interesting that after all my points, you decide to nitpick that one sentence where I didn't assume you weren't a customer, I stated the fact that you didn't contact them as a customer. It's interesting because it's similar to how you decided to base your entire judgement of this company on encounter with customer support. You can't just throw everything into bad or good bucket because of how it triggers you emotionally. I bet I quite annoyed you. Doesn't mean the best thing to do is just find that one sentence where I'm slightly wrong and judge me on that. Try to emotionally detach. When a bug is pissing you off, do you throw the whole program with it? Or do you understand what's going on and what is there to learn, despite the annoying bug? Do I have something to learn from this incredibly annoying person that embarrassed me on HN? Or should I just find something to nitpick? I'm not your enemy. Customer support isn't your enemy. And the security researcher coming to your company with some anoying bug bounty isn't an enemy either. There's that saying, Homo homini lupus. Don't be like that.
    - plaguepilled 4y ago
      Sorry dude but your argument here is extremely weak. You need to establish why the customer support couldn't refer the call. "Crank calls are a thing" really doesn't cut it.

detaro 4y ago

You should read the linked blogposts about the "speaking with bugcrowd". (TL;DR: it took a few months and a minor social media shitstorm after they banned him for them to notice that their processes suck) Attempting alternative contact paths in parallel is entirely valid. > Need to write a nice email, even if they don't have "security.txt", to some manager or someone else you could contact That's clearly what he did: contact those who he could contact. If the only contact info you publish is your support team, then your support them has to be able to handle everything people try to contact you about. So yes, it's an entirely valid expectation that the publicly provided contact for a security company can handle requests to please be directed to the security team. It's your choice as a company to not make your security team directly available, and your problem if people thus can't reach it.

machina_ex_deus 4y ago
You would probably have a better chance of escalating any issue with a mail to anyone that isn't customer support. If you're a security researcher, imagine customer support as this big human firewall to communicating with this corporation, meant to be extremely strict so the communication with the rest of the cooperation won't be flooded with all the things customers want. If you're not understanding this properly and wasting time trying to contact someone through customer support, that's on you. Which company doesn't even matter.
- arp242 4y ago
  > If you're not understanding this properly and wasting time trying to contact someone through customer support, that's on you. Which company doesn't even matter. There really are plenty of companies where this would have worked fine; I'm reasonably confident contacting support@ for something like this at all places I've ever worked would have been escalated. Maybe with some back-and-forth for 1 or 2 messages, but not outright refusal. One reason why I always try to have a good relationship with the support staff (including talking to them at company parties and the like) is so they're not afraid to "bother" me if they're not sure about something. Of course support shouldn't be bothering me with basic inane stuff, but as an organisation you can certainly foster different kind of cultures and attitudes. That said, your chances of this working are usually proportional to the size of the organisation: the larger the organisation, the less chance you have. Still, LastPass isn't that large, and the support person does seem rather obtuse. I suspect that Soatok's style of communication didn't help with that, as it may have caused the bozo bit to flip for the support person. This in turn seemed to have caused Soatok's bozo bit to flip for the support person as well. However, at the end of the day, it's primarily the company's responsibility they're contactable in a reasonable manner, and it's not "on you" if they're not. Having to e-stalk and contact random people who happen to work for LastPass is not reasonable.