3 ms·
A full month of notification is plenty. If the vendor acknowledges you and tells you they're working on it and asks you to hold off then that's one thing, but
by mason55 13y ago
A full month of notification is plenty. If the vendor acknowledges you and tells you they're working on it and asks you to hold off then that's one thing, but if they basically ignore you for a month then you've done your part. Especially with an exploit like this, you're not opening up access to PII, although it sounds like you are opening the window to possible fraudulent charges.
- lawnchair_larry 13y agoNo, disclosure timelines only make sense if the public is at risk. There is nothing like that here. The outcome is gogo not getting paid. This is just grandstanding a fairly unsophisticated bug in their service. The end result is that gogo will end up with more money.
- mason55 13y ago> disclosure timelines only make sense if the public is at risk The post says that fraudulent charges can be made without a password or credit card number by using this exploit. I would bet that you can access account info as well which means there is some PII leaking. I would consider PII + fraudulent transactions to be a step above gogo losing oney.