5 ms·
This has been discussed to death every time security.txt comes up, but in my experience it's been a great way to receive spam about bullshit "vulnerabilities" f
by oefrha 3y ago
This has been discussed to death every time security.txt comes up, but in my experience it's been a great way to receive spam about bullshit "vulnerabilities" from low effort scanners operated by "security researchers".
Much like how people publish email addresses online using human readable replacements (e.g. AT instead of @) to avoid spam, I'd rather put up a contact page that's easy for humans to find but nontrivial to automate.
- viraptor 3y agoMost of those are trivial to filter. Mentioning SPF or DKIM -> straight to the bin. Contains "critical" and "payment" -> straight to the bin. There's few patterns you'll find that will let you remove all the beg bounties.
- andersa 3y agoWhat if they're trying to report a critical issue with your payment processing?
- jagged-chisel 3y agoStraight to the bin. Obviously. >.<
- viraptor 3y agoHint for applying ideas from comments: read information and understand the main point behind it, consider how it applies to your situation, then if it's beneficial try to implement it in a way relevant to you. If you take comments like mine and try to implement them literally, that's stupid and it's on you.
- hypeatei 3y agoToo bad, it's not my financial info at risk anyways. ;)
- dns_snek 3y ago> Contains "critical" and "payment" -> straight to the bin. That sounds like an excellent way to accidentally filter out serious vulnerabilities. I'm glad you don't work for the vendor that received my urgent, critical (in all caps) unauthenticated remote code execution vulnerability report. They were very grateful that I reached out and resolved it under 72h.
- dools 3y agoYep I have received a genuine report completely unsolicited before, paid a modest bounty and fixed the problem immediately, then took some precautions to ensure any potential data leaks were rendered innocuous. I was very glad to have received the info and I think folks such as yourself are doing valuable work.
- viraptor 3y agoDid you write "I found critical vulnerability on your website, how much is your bounty, can you send PayPal payment?" If it wasn't something close to that, then no, it wouldn't be filtered. If it wasn't obvious, the patterns are trivial, but not "check those two words" level of trivial. You need to apply common sense and adjust for your environment.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- ryan-c 3y agoThere are, in fact, non-frivolous DKIM issues, such as DKIM selectors for which the private key is available or can be cracked. Historically, 512 bit RSA was somewhat common, and old selectors don't always get removed.
- burnished 3y agoWhy do SPF and DKIM go to the bin? I have just recently begun my initiation to the mysteries of email. Is it nonsense reports or something?
- warp 3y agoDepending on your application, setting up SPF and DKIM can be complicated. And typically not having it set up is not a security issue, it may affect deliverability of your outgoing email, but is not a vulnerability. (and indeed many beg bounties are about SPF or DKIM, because whatever automated tools they use to find the low hanging fruit didn't find anything more substantial).
- kirab 3y agoOf course it's a security issue, because having neither SPF nor DKIM means that malicious actors can all too easily impersonate your email addresses and phish users with an email that apparently came from your domain.
- megous 3y agoHaving SPF/DKIM in DNS records doesn't prevent that.
- jabroni_salad 3y agoI occasionally get what I'm sure are very well meaning SPF/DKIM-missing reports for a domain that has a null mx record. It can basically be assumed that anyone trying to report that didn't do even a basic cursory look at the results. I don't need your automated scan, I have my own nessus deployment and already know what it's going to say.