However, I still stand behind that this corporation should have paid $100,000. There are so many opportunities to exploit this vulnerability. LastPass is seen as something "advanced" users use, so it's highly probable that you could PM link to this page to some computer celebrity, and you would have access to his inbox in no-time, because most people don't use annoying second-factor authorization. This could result in a huge amount of new leaks, etc, etc. $1000 basically screams - "fuck you, we don't care about our security, and we are not going to encourage future white hat future bug reporting".
You're right, it's usually in low-mid $10ks for this sort of thing.
>low-grade consumer password manager that no enterprise or governments uses
Can't speak to government, but multiple large companies I have worked for have mandated LastPass as the password manager.
> But even then your grey market for this is tiny and most likely not going to be some criminal overlord paying out $100k in bitcoin to kids on a darknet forum.
In fact that's almost exactly what it is, except you've underestimated the price. A really juicy iOS RCE or Privesc can fetch almost half a million.
These transactions aren't usually done on forums, though. Not enough trust. There are middlemen who buy exploits from researchers and sell to the big customers.
Oh no, not this type of comment again. Infosec people always make fun of HN for this exact type of comment. The total lack of understanding of the economics of bug hunting doesn't stop people from commenting here.
Noone is paying $100k in some imaginary black market for web exploits. I mean have you even considered who buys exploits and what type of attacks they conduct? There isn't an active market looking to noisily grab passwords from a low-grade consumer password manager that no enterprise or governments uses. Your XSS/SQLi are only worth a marginal amount of money to the corporation you're pen testing.
And supply/demand is always what drives prices, not the potential damage (or benefit) you can imagine a particular exploit doing. This is as true for vulnerabilities as it is for some business software or mobile app your create. Just because in a perfect situation it could generate x value for a customer doesn't mean there is either demand or an untapped market for it.
A browser-based iPhone zero-day on the other hand can fetch some money. But even then your grey market for this is tiny and most likely not going to be some criminal overlord paying out $100k in bitcoin to kids on a darknet forum.