3 ms·
>Why would anyone ever exclude true mitm? Same reason security programs exclude social engineering, even though that's a pretty common way for companies to get
by gruez 5mo ago
>Why would anyone ever exclude true mitm?
Same reason security programs exclude social engineering, even though that's a pretty common way for companies to get pwned.
- zulln 5mo agoExcluding SE is to make sure people do not spam customer support and launch annoying phishing campaigns. None of that is applicable for local software running on your own computer.
- tptacek 5mo agoNo, excluding SE is to make sure the bounty program is incentivizing things that inform the product security team. Social engineering is a corpsec function; they're not even the same teams.
- joxdosba 5mo agoSure, but this is more akin to dismissing a 1click RCE as “social engineering” because an employee has to be convinced to click a link.