3 ms·

I wish this was the top level post. OP, this is exactly what you should be doing. If I could add my own top level post - just don't do any penetration testing

by dsacco 11y ago

I wish this was the top level post. OP, this is exactly what you should be doing. If I could add my own top level post - just don't do any penetration testing on applications you have not received explicit permission to test on. Would you like it if someone did you a favor by breaking into your house, explaining to you that your security is crap, and then justifying it by saying that they should be thanked because they didn't steal anything and they're doing you a favor? No. You'd be annoyed. Don't look for security vulnerabilities when you haven't been explicitly tasked with doing so (unless there is a bug bounty or explicit responsible disclosure policy). Also, seriously, don't offer your services after you find a vulnerability. Even if you don't think it's extortion, a jury would probably disagree with you. Imagine how it would feel to receive an email explaining you have a serious security flaw, and "oh by the way hire me because I'm great at this."

nstart 11y ago
So here's a question on a metaphor that seems closer to the current scenario. Imagine a bank that's promising to deliver a secure service but leaving the safes unlocked and account holders' files lying around. The current issue I discovered actually falls under that with user data being publicly exposed with no extra steps required to get it. No hacks over here. Going back to the metaphor, assume everyone else believes their money is safely locked away and their account information secure. At this point, you tell the bank that they have this problem. Don't you also have a moral obligation to tell the public they are not as safe as they thought they were? Doesn't that moral obligation increase the longer the problem remains unresolved? I'm really not looking for any thank yous here (and not suggesting that that was insinuated). I just want to help people and I would like to do my part to ensure society is safe. This information being pulled by a more malicious source could be incredibly damaging. As for the services offering. Wouldn't dream of it. Totally onboard with everyone on that :).

by dsacco 11y ago

nstart 11y ago

So here's a question on a metaphor that seems closer to the current scenario. Imagine a bank that's promising to deliver a secure service but leaving the safes unlocked and account holders' files lying around. The current issue I discovered actually falls under that with user data being publicly exposed with no extra steps required to get it. No hacks over here. Going back to the metaphor, assume everyone else believes their money is safely locked away and their account information secure. At this point, you tell the bank that they have this problem. Don't you also have a moral obligation to tell the public they are not as safe as they thought they were? Doesn't that moral obligation increase the longer the problem remains unresolved? I'm really not looking for any thank yous here (and not suggesting that that was insinuated). I just want to help people and I would like to do my part to ensure society is safe. This information being pulled by a more malicious source could be incredibly damaging. As for the services offering. Wouldn't dream of it. Totally onboard with everyone on that :).