4 ms·
> They also classified the issue as a “Fraud and abuse” issue, rather than an Oauth/login issue. I can _kinda_ see that, I agree they should mitigate it as bes
by mcflubbins 2y ago
> They also classified the issue as a “Fraud and abuse” issue, rather than an Oauth/login issue.
I can _kinda_ see that, I agree they should mitigate it as best as possible too though, especially since they're Google after all.
> I thought this would be the end of the story, but 3 months later, they re-opened my ticket (after my Shmoocon talk was accepted), paid a $1337 bounty, and said they were working on a fix.
Sad how the only way to get Google's attention to make enough noise about something...
- dylan604 2y ago$1337 is a very curious amount. Surely, someone was being clever???
- chasemiller 2y agoyeah, google likes to have fun with the Bug Bounty program. See: https://bughunters.google.com/about/rules/google-friends/6625378258649088/google-and-alphabet-vulnerability-reward-program-vrp-rules#reward-amounts-for-security-vulnerabilities https://bughunters.google.com/about/rules/google-friends/662...
- dylan604 2y agoit's funny that all of the soul has not been sucked out of the entire company
- mega_dingus 2y agoIt's leetspeak It spells "leet" - see https://en.wikipedia.org/wiki/Leet https://en.wikipedia.org/wiki/Leet You're too young to have used BBSes :)