4 ms·
That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM f
by chias 3y ago
That is, to a T, almost identical to my experience reporting a vulnerability to Google too.
Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate
Google: "Won't fix (Intended Behavior)"
Me: Really? Google intends to allow spoofed email to appear legitimate in its interface?
Google: Actually, it's a known issue
- LeonM 3y agoThat is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather serious. We took our time to create a detailed report, with steps to reproduce, etc. For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix". Last time I checked, both vulnerabilities still exist.
- kurthr 3y agoProvide a 90 day timeline for the release of exploit.
- planede 3y agoI wonder if you can string it further. You: We are OK to publish a blog post about it then, right? Google: ...
- kstrauser 3y agoAlteration: I've written the blog, and I'm going to publish it on...
- ukuina 3y agoWell, it IS a known issue after you reported it to them in the first place! :-)
- butterNaN 3y agoI mean, technically it is a known issue now that they know about it ¯\_(ツ)_/¯
- actionfromafar 3y agoBut it was known, the second time.