3 ms·

It could be a standing offer with a hole found every other month and they'd be paying far less than the going rate for a quality, full-time security consultant.

• eridius 14y ago
  This is precisely why this is nothing more than a PR stunt meant to combat the people criticizing Mega's security. Mega is probably secure enough that anyone who is capable of breaking it doesn't need to do so publicly for a 10k Euro bounty, but would either be working for a government, or doing black hat work.
  • nikcub 14y ago
    and "they" don't need to break the encryption, they just need to steal a users password
• dpeck 14y ago
  It doesn't really work that way in practice. I believe bounty programs are good, but they aren't a replacement for an actual security team. Its one of those things that doesn't scale all that well, one really talented tester can gain a deep understanding of an app and find loads and loads of opportunities for attack. Most bounty bug hunters on the other hand are hard to distinguish from usual internet background noise. Veracode recently put up an infograpic on bounty programs that was kind of interesting, http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-the-internet-safe-infographic/ http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-th...
  • incision 14y ago
    >I believe bounty programs are good, but they aren't a replacement for an actual security team. Of course not, I don't mean to suggest that it is. I'm suggesting that this is marketing with potential for cheap labor more than a real commitment to security.