4 ms·
Is encrypted email commonly used for reporting security vulnerabilities? It seems like increasingly, more reports occur via bug bounty programs, or are disclose
by akerl_ 3y ago
Is encrypted email commonly used for reporting security vulnerabilities? It seems like increasingly, more reports occur via bug bounty programs, or are disclosed publicly by the researchers, or are just sent as plaintext emails to security@ or whatever is publicly listed. When I've found security vulnerabilities in somebody's code, I can't think of a time I ever thought about GPG-signing my notice to them.
- 0xDEAFBEAD 3y ago>When I've found security vulnerabilities in somebody's code, I can't think of a time I ever thought about GPG-signing my notice to them. It's not authenticity that matters here, it's confidentiality.
- tptacek 3y agoBasically nobody cares. Vulnerability researchers don't use GPG either.
- deleted 3y ago[deleted]