6 ms·

Well at the bottom of the article, they mention that Microsoft first closed the issue as invalid, and on the second attempt they closed it as "cannot be reprodu

Well at the bottom of the article, they mention that Microsoft first closed the issue as invalid, and on the second attempt they closed it as "cannot be reproduced" (after fixing it). So from that I can imply there was no payment.

eitland 2y ago
I've reported a trivial way to infer details about passwords in Windows. (Ctrl-arrow in password fields in Windows 8 jumped by character group even when hidden so if a prefilled password was 123 abc.de it would stop after 3, after space (I think), after c, after dot and finally after e.) All I got was an email: that is interesting bye bye. But it was fixed in the next patch or the next after I think. So I didn't care to report the two bigger problems I found with Azure Information Protection [1][2] I thought about reporting them but decided against it. And I will continue to tell people that I don't care to do free work for MS when they won't even give me a t-shirt, a mug or even acknowledge it. Maybe if one is a security researcher it can be worth it but if you just find something interesting you'll probably be better rewarded by reddit or HN, yes, the upvotes are worthless but less so than a dismissive email. [1] one in the downloadable AIP tooling where you can easily smuggle clear text information with rock solid plausible deniability - I found it by accident after having implemented a part of a pipeline in the most obvious way I could think of. [2]: the second had to do with how one can configure SharePoint to automatically protect files with AIP on download, the only problem being if you logged in using another login sequence (sorry for the lack of details, this was before the pandemic and it was just a small part of what I was working on at the time) SharePoint would conveniently forget all about it despite all efforts by me, the security admin at the company and the expert that Microsoft sent to fix it.
- franktankbank 2y ago
  > the expert that Microsoft sent to fix it. Ha ... ha ... ha ... ha ... did they give you the run around for several months until you dropped the issue? It's actually pretty astounding that they don't get sued for this practice. If a company is paying for support and are given illiterate noobs then that is breach of contract I would think. I would never recommend entering a contract with MSFT, they produce trash products they can't support and are more invested in their Legal team than actual product.
  - RajT88 2y ago
    I thought the same when a friend of mine reported something to Apple. I would guess it's SOP at this point across big tech, unless something is too big to ignore.
    - cryptonector 2y ago
      You might have no idea how expensive providing great support to customers is when you're an vendor like Apple or a Microsoft. It's like backports, which are even more unbelievably expensive still, and those are gone industry-wide for that reason. Think of the cost of opportunity in having smart, capable, experienced staff doing support or backports instead of actual dev work. (Especially backports, which when they were done frequently they were done precisely because customers are risk-averse, so a great deal more review and testing (with a much larger test matrix) was required for backports, with attendant huge increase in cost.) That cost is enormous. But of course they do need to provide some support, and at some point some really good support for the really serious bugs, and the vendor will in time do it, but first the customer demand and pressure has to build.
      - dfxm12 2y ago
        I can't speak to Apple, but wrt Microsoft, you're not appreciating just how bad support is (or even the documentation is) and you're not appreciating how much people pay for support on top of the product. I feel like I know more about M365 than anyone I talk to at MS. That's bad.
        cryptonector 2y ago
        Oh trust me, I know how bad it can be. I wouldn't say that I 'appreciate' it though!
        RajT88 2y ago
        Everyone hates support. Especially the execs who have to pay for their support department. Azure basic support is pretty bad. I am even surprised at how bad some of the higher tiers of support are. I have no frame of reference for other cloud providers but anecdotally they are not so great either (some CSP's I am told are worse). All in all - wrt documentation - software docs have gone downhill across the industry since the 90's. And back then people were still loudly grumbling about how bad the docs were!
- go-nil-why 2y ago
  The intention of the password entry dots isn’t to prevent folks with unrestricted physical access to the machine from exfiltrating information, it’s to stop it from appearing in screenshares and casual “over the shoulder” observations. Honestly I’m surprised they even acknowledged that as a bug, given there are many ways to get a whole lot more info than what you demonstrated, for instance the builtin “eye” button that is purpose built to reveal the full password to anyone with physical access to the machine wishing to see it.
  - eitland 2y ago
    If the eye button is available it is clearly the intention. This wasn't such a case. That said, I didn't expect it to get rich, it was just that the experience didn't give me anything back for the effort I put in.

eitland 2y ago

I've reported a trivial way to infer details about passwords in Windows. (Ctrl-arrow in password fields in Windows 8 jumped by character group even when hidden so if a prefilled password was 123 abc.de it would stop after 3, after space (I think), after c, after dot and finally after e.) All I got was an email: that is interesting bye bye. But it was fixed in the next patch or the next after I think. So I didn't care to report the two bigger problems I found with Azure Information Protection [1][2] I thought about reporting them but decided against it. And I will continue to tell people that I don't care to do free work for MS when they won't even give me a t-shirt, a mug or even acknowledge it. Maybe if one is a security researcher it can be worth it but if you just find something interesting you'll probably be better rewarded by reddit or HN, yes, the upvotes are worthless but less so than a dismissive email. [1] one in the downloadable AIP tooling where you can easily smuggle clear text information with rock solid plausible deniability - I found it by accident after having implemented a part of a pipeline in the most obvious way I could think of. [2]: the second had to do with how one can configure SharePoint to automatically protect files with AIP on download, the only problem being if you logged in using another login sequence (sorry for the lack of details, this was before the pandemic and it was just a small part of what I was working on at the time) SharePoint would conveniently forget all about it despite all efforts by me, the security admin at the company and the expert that Microsoft sent to fix it.

franktankbank 2y ago
> the expert that Microsoft sent to fix it. Ha ... ha ... ha ... ha ... did they give you the run around for several months until you dropped the issue? It's actually pretty astounding that they don't get sued for this practice. If a company is paying for support and are given illiterate noobs then that is breach of contract I would think. I would never recommend entering a contract with MSFT, they produce trash products they can't support and are more invested in their Legal team than actual product.
- RajT88 2y ago
  I thought the same when a friend of mine reported something to Apple. I would guess it's SOP at this point across big tech, unless something is too big to ignore.
  - cryptonector 2y ago
    You might have no idea how expensive providing great support to customers is when you're an vendor like Apple or a Microsoft. It's like backports, which are even more unbelievably expensive still, and those are gone industry-wide for that reason. Think of the cost of opportunity in having smart, capable, experienced staff doing support or backports instead of actual dev work. (Especially backports, which when they were done frequently they were done precisely because customers are risk-averse, so a great deal more review and testing (with a much larger test matrix) was required for backports, with attendant huge increase in cost.) That cost is enormous. But of course they do need to provide some support, and at some point some really good support for the really serious bugs, and the vendor will in time do it, but first the customer demand and pressure has to build.
    - dfxm12 2y ago
      I can't speak to Apple, but wrt Microsoft, you're not appreciating just how bad support is (or even the documentation is) and you're not appreciating how much people pay for support on top of the product. I feel like I know more about M365 than anyone I talk to at MS. That's bad.
      - cryptonector 2y ago
        Oh trust me, I know how bad it can be. I wouldn't say that I 'appreciate' it though!
      - RajT88 2y ago
        Everyone hates support. Especially the execs who have to pay for their support department. Azure basic support is pretty bad. I am even surprised at how bad some of the higher tiers of support are. I have no frame of reference for other cloud providers but anecdotally they are not so great either (some CSP's I am told are worse). All in all - wrt documentation - software docs have gone downhill across the industry since the 90's. And back then people were still loudly grumbling about how bad the docs were!
go-nil-why 2y ago
The intention of the password entry dots isn’t to prevent folks with unrestricted physical access to the machine from exfiltrating information, it’s to stop it from appearing in screenshares and casual “over the shoulder” observations. Honestly I’m surprised they even acknowledged that as a bug, given there are many ways to get a whole lot more info than what you demonstrated, for instance the builtin “eye” button that is purpose built to reveal the full password to anyone with physical access to the machine wishing to see it.
- eitland 2y ago
  If the eye button is available it is clearly the intention. This wasn't such a case. That said, I didn't expect it to get rich, it was just that the experience didn't give me anything back for the effort I put in.