5 ms·

> The aim is that, for example, ethical hackers can immediately contact the right person or department to tackle the vulnerability. We added such a file years

by mtmail 3y ago

> The aim is that, for example, ethical hackers can immediately contact the right person or department to tackle the vulnerability. We added such a file years ago. There's still some security researchers ("bug hunters") not aware of the standard and email other email addresses (info@, invoice@, data-protection@). Nobody has ever used the GPG key we list in the security.txt file. The email address we list (security@) hasn't received any significant spam.

londons_explore 3y ago
> and email other email addresses these are probably the people more interested in getting someone to sign off on a bug bounty than they are in getting hold of someone technical who might point out that the fact you can right click and edit the HTML to say "HACKED!!" isn't a bug...
- looping8 3y ago
  A lot of people just don't care about writing to the right address. I did work for a university and the most random people would get emails aimed at completely different departments, staff or even a different university. I don't mean old people or clueless young students, I mean some press contacts, some other academics and people like that.
  - ldoughty 3y ago
    I very recently had a 'dont care about the write address' story -- which I think is worth remember for those of us that monitor some of these less-common but known-to-technical-people mailboxes.... When I had an issue with LastPass, the ONLY contact method they listed for support required you to log in and use their help form... Since I used federated login, only the browser extension was supported -- not website login... So.. I can't log into their website for support, but I have to log into their website for support... I went through a series of help@ support@ helpdesk@ contact@ and got bounces / "use our web form" responses... I then escalated to the other technical addresses like webmaster@ hostmaster@ until I finally tried to reach out to sales@ for the support issue... So sometimes people do intentionally write to 'the wrong address' because there's no 'right address' (that's publicly known/available).
Aulig 3y ago
Interesting - I guess I didn't get "significant" spam either, but after a dozen or so beg bounties I had enough of it and removed it again. And now it's back to roughly zero beg bounties. Serious security researchers won't have a hard time clicking "Contact" in my website header & sending an e-mail to that address anyways.
- abirch 3y ago
  Once this goes mainstream I'm betting on massive spam. I'd only list the contact us url
- bombcar 3y ago
  Beg bounties are getting more and more common.
  - hsbauauvhabzb 3y ago
    What’s the best way to get things read? Prefix them with ‘I am NOT looking for payment, reward or bounty’?
    - bombcar 3y ago
      Honestly, I at least glance at the beg bounties, but they're all so formulaic and bullshit it's easy to see what's up. Once I was getting too many to glance at, hard to say. Probably mailing a physical letter to the address of record (if it's not a company and so has no address, not sure).
    - galleywest200 3y ago
      Putting that at the front of your email makes it sound even more sketchy to me.
    - masklinn 3y ago
      Just report the issue honestly, don’t try to obfuscate, and don’t send a message to a security@ with something like “I found a security issue” with no details of any kind. If it’s not a security@ and not specifically listed as a security point of contact it’s fair to ask if it’s the right location for a potentially security-sensitive issue and whether there’s a better one.
878654Tom 3y ago
I've reported some bugs and one thing that I always hate is the GPG Key. It is always a huge hassle to use for some reason and for half of the time it doesn't even seem correct or the other party isn't even using it themselves anymore. If you are an average person and you notice that changing the ID in the URL to another number gives you access to data you should not see; you aren't some elite hacker as many of the news articles try to portray you. So expecting from them to use a GPG Key while they only have their ISP provided webmail will be near impossible for them to do under half a days work. Especially as most GPG tools are very unfriendly to use.
- oneeyedpigeon 3y ago
  Even the dependency on email is looking a little outdated — at least that's not a requirement of security.txt though.
  - GTP 3y ago
    I think email is a good standard that you can safely assume will be there for the forseeable future. Many communication platforms come and go, email staied thare from Internet's beginning to today and shows no sign of disappearing. Plus you can safely assume that a person on the Internet has at least one email account (exeptions are extremely rare, often is even your ISP that gives you an email account), the same doesn't hold true for other plarforms like Discord.
- mattpallissard 3y ago
  > If you are an average person This isn't for the average person.
  - 878654Tom 3y ago
    Why not? Many security issues are detected by people who just happened to do a series of actions in a way nobody expected them to do.
    - 3y ago
michaelmior 3y ago
I'm skeptical that GPG encryption is really useful for such reports anyway. Any attacker with access to important email addresses that would receive such reports probably already has a higher level of access than whatever is being reported. And in the case of bug reports, I don't think being able to verify the sender is all that important.
- jagged-chisel 3y ago
  The purpose of publishing your [company’s] public key is not only to verify the sender. It gives the sender a way to send an encrypted email that only the recipient can read (as long as they still have the key pair.)
  - ZeroSolstice 3y ago
    Based on the limited public PGP key infrastructure, OpenSSL would seem to be the better solution for this. You already have the companies public key from the site certificate and it provides the same confidentiality and integrity since only their private key would be able to decrypt the message. Being as certificates have to be renewed frequently and verified people would most likely have up-to-date keys. Level of effort is roughly a one line openssl command for both encryption and decryption. * I suppose though one thing I didn't consider is follow up messages or correspondence which using PGP would be easier, if everything is already working in your email client. Although it wouldn't be that difficult to include your public key in the initial message, which could be used for responding.
    - planede 3y ago
      What you propose is basically a form that can be served over https.
      - ZeroSolstice 3y ago
        Is there a bit more you can expand on this? A contact form only serves one-way communication and if its sending an email anyway what is the workflow improvement or additional confidentiality/integrity with regards to the message? The workflow i'm thinking of would be encrypting text with the public key of the website/company you are reaching out to, including your public key in the message or if you have a website as a researcher you can provide the instructions of using your public key for them to send you a response. You then send them an email and attached your encrypted correspondence. When they respond back they use whatever public key you provided in your initial message and you can decrypt their response. This doesn't require your email client to support PGP or have a keyring setup just simple openssl command(s) that work right from the terminal.

by mtmail 3y ago

londons_explore 3y ago

> and email other email addresses these are probably the people more interested in getting someone to sign off on a bug bounty than they are in getting hold of someone technical who might point out that the fact you can right click and edit the HTML to say "HACKED!!" isn't a bug...

looping8 3y ago
A lot of people just don't care about writing to the right address. I did work for a university and the most random people would get emails aimed at completely different departments, staff or even a different university. I don't mean old people or clueless young students, I mean some press contacts, some other academics and people like that.
- ldoughty 3y ago
  I very recently had a 'dont care about the write address' story -- which I think is worth remember for those of us that monitor some of these less-common but known-to-technical-people mailboxes.... When I had an issue with LastPass, the ONLY contact method they listed for support required you to log in and use their help form... Since I used federated login, only the browser extension was supported -- not website login... So.. I can't log into their website for support, but I have to log into their website for support... I went through a series of help@ support@ helpdesk@ contact@ and got bounces / "use our web form" responses... I then escalated to the other technical addresses like webmaster@ hostmaster@ until I finally tried to reach out to sales@ for the support issue... So sometimes people do intentionally write to 'the wrong address' because there's no 'right address' (that's publicly known/available).

Aulig 3y ago

Interesting - I guess I didn't get "significant" spam either, but after a dozen or so beg bounties I had enough of it and removed it again. And now it's back to roughly zero beg bounties. Serious security researchers won't have a hard time clicking "Contact" in my website header & sending an e-mail to that address anyways.

abirch 3y ago
Once this goes mainstream I'm betting on massive spam. I'd only list the contact us url
bombcar 3y ago
Beg bounties are getting more and more common.
- hsbauauvhabzb 3y ago
  What’s the best way to get things read? Prefix them with ‘I am NOT looking for payment, reward or bounty’?
  - bombcar 3y ago
    Honestly, I at least glance at the beg bounties, but they're all so formulaic and bullshit it's easy to see what's up. Once I was getting too many to glance at, hard to say. Probably mailing a physical letter to the address of record (if it's not a company and so has no address, not sure).
  - galleywest200 3y ago
    Putting that at the front of your email makes it sound even more sketchy to me.
  - masklinn 3y ago
    Just report the issue honestly, don’t try to obfuscate, and don’t send a message to a security@ with something like “I found a security issue” with no details of any kind. If it’s not a security@ and not specifically listed as a security point of contact it’s fair to ask if it’s the right location for a potentially security-sensitive issue and whether there’s a better one.

878654Tom 3y ago

I've reported some bugs and one thing that I always hate is the GPG Key. It is always a huge hassle to use for some reason and for half of the time it doesn't even seem correct or the other party isn't even using it themselves anymore. If you are an average person and you notice that changing the ID in the URL to another number gives you access to data you should not see; you aren't some elite hacker as many of the news articles try to portray you. So expecting from them to use a GPG Key while they only have their ISP provided webmail will be near impossible for them to do under half a days work. Especially as most GPG tools are very unfriendly to use.

oneeyedpigeon 3y ago
Even the dependency on email is looking a little outdated — at least that's not a requirement of security.txt though.
- GTP 3y ago
  I think email is a good standard that you can safely assume will be there for the forseeable future. Many communication platforms come and go, email staied thare from Internet's beginning to today and shows no sign of disappearing. Plus you can safely assume that a person on the Internet has at least one email account (exeptions are extremely rare, often is even your ISP that gives you an email account), the same doesn't hold true for other plarforms like Discord.
mattpallissard 3y ago
> If you are an average person This isn't for the average person.
- 878654Tom 3y ago
  Why not? Many security issues are detected by people who just happened to do a series of actions in a way nobody expected them to do.
  - 3y ago

michaelmior 3y ago

I'm skeptical that GPG encryption is really useful for such reports anyway. Any attacker with access to important email addresses that would receive such reports probably already has a higher level of access than whatever is being reported. And in the case of bug reports, I don't think being able to verify the sender is all that important.

jagged-chisel 3y ago
The purpose of publishing your [company’s] public key is not only to verify the sender. It gives the sender a way to send an encrypted email that only the recipient can read (as long as they still have the key pair.)
- ZeroSolstice 3y ago
  Based on the limited public PGP key infrastructure, OpenSSL would seem to be the better solution for this. You already have the companies public key from the site certificate and it provides the same confidentiality and integrity since only their private key would be able to decrypt the message. Being as certificates have to be renewed frequently and verified people would most likely have up-to-date keys. Level of effort is roughly a one line openssl command for both encryption and decryption. * I suppose though one thing I didn't consider is follow up messages or correspondence which using PGP would be easier, if everything is already working in your email client. Although it wouldn't be that difficult to include your public key in the initial message, which could be used for responding.
  - planede 3y ago
    What you propose is basically a form that can be served over https.
    - ZeroSolstice 3y ago
      Is there a bit more you can expand on this? A contact form only serves one-way communication and if its sending an email anyway what is the workflow improvement or additional confidentiality/integrity with regards to the message? The workflow i'm thinking of would be encrypting text with the public key of the website/company you are reaching out to, including your public key in the message or if you have a website as a researcher you can provide the instructions of using your public key for them to send you a response. You then send them an email and attached your encrypted correspondence. When they respond back they use whatever public key you provided in your initial message and you can decrypt their response. This doesn't require your email client to support PGP or have a keyring setup just simple openssl command(s) that work right from the terminal.