4 ms·
Neither Google nor Apple rely on PGP for vulnerability disclosure handling. Lots of organizations publish a PGP key, but in practice rarely use them.
by tptacek 1y ago
Neither Google nor Apple rely on PGP for vulnerability disclosure handling. Lots of organizations publish a PGP key, but in practice rarely use them.
- lrvick 1y agoCitation needed. Both Apple and Google have updated these pages with security disclosure PGP keys in the last year. https://support.apple.com/en-us/101985 https://support.apple.com/en-us/101985 https://about.google/company-info/appsecurity/ https://about.google/company-info/appsecurity/ I design most corporate bug bounty programs the same way. Sure, people rarely use PGP, but the ones that do are usually serious and high quality, and we let them skip the tier 1 queue. Script kiddies never know how to encrypt things.
- tptacek 1y agoIt has not at all been my experience that PGP-encrypted bounty submissions are fast-tracked and most (almost all, in fact) good bounty submissions aren't encrypted. Google downplays PGP in the link you provided. Apple doesn't ask people to use theirs.
- lrvick 1y agoAre we looking at the same links? It is provided as an option, the ONLY option, for those that feel encryption is merited for a sensitive report. Google page: "If you feel the need, please use our PGP public key to encrypt your communications with us." Apple page: "Apple security advisories are signed with the Apple Product Security PGP key. Sensitive security information may be encrypted to this key when communicating with Apple Product Security."
- tptacek 1y agoI think you missed some subtext that I thought was pretty obvious which is that most people don't encrypt bug bounty submissions in 2025.
- lrvick 1y ago> Neither Google nor Apple rely on PGP for vulnerability disclosure handling. They support and rely on it exclusively for security disclosures sensitive enough to merit encryption.
- tptacek 1y ago"Sensitive enough" is smuggling in a presumption of yours that isn't supported by evidence. Whether or not submissions are PGP-encrypted (in my experience: they very rarely are) is uncorrelated with their severity.
- lrvick 1y agoIn my experience building bug bounty programs for many high risk orgs, PGP reports are rare, as you indicate. Maybe a couple a year. That does not make them any less critical or relied on. We always took them super seriously and read them offline because they were often highly sensitive real disclosures that merited being exposed only to a very small circle of people with security team decryption smartcards. It is a safe assumption skiddies do not know how to use PGP so low skill reports with PGP almost never happened. I would never run a bug bounty program without having an highly visible public key to encrypt highly sensitive reports to.
- tptacek 1y agoYou haven't responded to my point. I would happily run a bounty program without a PGP key; in fact, I'd recommend not publishing a PGP key, and instead making arrangements to communicate a Signal identity.
- lrvick 1y agoIf I as a security researcher want to send a super sensitive disclosure to an organization like "I have reason to believe your devices are compromised", I want to be damn sure it goes to a PGP key held on smartcards that decrypt reports on airgapped operating systems. I also may want to do this anonymously. Signal is the wrong tool on both counts. Fine to have as an option but I would never have that as the only option.