17 days is fast, relatively speaking.
Security questions are hardly really that great of 2FA protection anyways.
Re:PayPal 2FA Bypass
by ryanfreeborn on Sunday October 23, 2016 @02:36AM
(#12772318)
Good to know.
And ya, a security question to bypass a phone 2SV is a joke. Almost entirely defeats the purpose.
Just to be clear, it bypasses any of their 2FA codes, not just SMS-based codes. The security questions bypass "feature" also appears on my account for which I use a VeriSign 2FA dongle.
Re:PayPal 2FA Bypass
by noamyoungerm on Sunday October 23, 2016 @11:32AM
(#12773934)
Notice that 17 days is basically what is needed to add the issue to the next sprint, complete its development along with everything else for that sprint, and deploy to a live site. To me that sounds fair.
The "standardized guidelines" sometimes vary -- mostly dependent on the nature of the vulnerability -- but 90 days seems to be a pretty common timeframe. That's what Google gives others before they publicize the details, for example.
How much time would've had to pass (without PayPal doing anything) before the author is ethically obligated to post to HN/media/etc about the hack? I believe publicizing an (unpatched) exploit like this crosses into criminality, but it would be essential to demonstrate some kind of proof, for credence and gravity. I'm guessing the community has some standardized guidelines for this sort of thing, but I'm not aware of them.