> I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around.

From Wes's blog post.

I don't know anything about security or about the people involved. But I read your quote, and I read the one above.

Unless Stamos explicitly disagrees with Wes's timeline of events, my interpretation of 'he has interacted with us using a synack.com email address' does not explicitly state that Wes used it in relation to the attack before the phone call to the CEO.

Happy for more evidence to be presented to show the contrary.

Assuming that's true (and I personally don't believe Stamos would flagrantly fabricate a detailed story like this publicly), this is a game changer. It's fully reasonable to escalate to an employer if they seem to be affiliated with the security researcher's report.

Also worth noting that this is frequently done in the security industry - folks will often credit not only themselves but also the companies they work with and are associated with in a security report.

No, Alex just assumed. Why didn't he just ask Wes if he was doing this for Synack?

He "assumed" because the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook.

He wasn't guessing. He didn't look the guy up on LinkedIn.

> He didn't look the guy up on LinkedIn.

I don't really see how else you can interpret the defense "he has written blog posts that are used by Synack for marketing purposes".

And it's pointed out all over the thread, but no part of "the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook" is uncontested, nor is it supported by the text of Alex Stamos' response. You've just read in what you want to see.

> At this point, it was reasonable to believe that Wes was operating on behalf of Synack

> He "assumed" because the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook. He wasn't guessing. He didn't look the guy up on LinkedIn

This is a load of bolony / ass-covering by Alex - Facebook's bounty program explicitly deals with individuals only, not companies and Alex knows this. From https://www.facebook.com/whitehat/

> We only pay individuals

edit: down-voters, please point out the faults in my logic.

From Wes' updated post:

> I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around.

Why not ask directly Wes if he is working on the behalf of his company? Seems shady at least to resort immediately to his employer.

I agree with what another guy said -- you should do the ethical thing and stay out of it. You're his buddy and have already rallied enough about how he's a Good Guy and was just confused. We get it.

> his account on our portal mentions Synack as his affiliation

Can someone clarify exactly what portal is referred to here? Is it something besides https://www.facebook.com/whitehat/report/ ?

If not, this is a totally bogus excuse.

My gathering from the researcher's post is that facebook requires you to use a personal account. I'm guessing he just had his employer listed on his fb account.

Seems that way, but I wanted to invite anyone who knows more to comment.

Alex's response uses extremely misleading language to justify the employer contact:

  - "account on our portal mentions Synack as his affiliation" amounts to nothing more than "he lists his job on his facebook profile"
  - "he has interacted with us using a synack.com email address" -- OP claims otherwise. Taking OP's word, the use of "has" perhaps prevents this from being an outright lie: yes, as of *right now* he "has" used a synack.com email. But did he before you reached out?
  - "he has written blog posts that are used by Synack for marketing purposes" -- ... and? What does that have to do with anything?

"He listed an employer on his fb profile" is literally their top justification for the supposed belief he was acting on their behalf. Yikes.