Ask HN: Should I report ESTA (esta.cbp.dhs.gov) security bug? How?

Posted by dandare on Tuesday May 21, 2019 @11:44AM
from the ask-hn dept.

While filling out the ESTA application at https://esta.cbp.dhs.gov/esta/application.html, after the form refreshed I was suddenly shown someone else's personal information.

I reported the security bug via https://help.cbp.gov/app/forms/complaint but I got a totally irrelevant response, no human probably read my message.

I would like to genuinely help the devs behind the site but I am also concerned about retributions from egotripping CBP officers. What are my options?

( 3 comments | 3 points | on HN )

Re:Ask HN: Should I report ESTA (esta.cbp.dhs.gov) security ... by dvtrn on Tuesday May 21, 2019 @11:46AM (#19971263)

First entity that comes to mind that might be in a position to at least get the right eyes and attention to it, if not outright resolve it would be 18F[1]; that's just a guess-though this seems right up their alley. I believe there are a couple of employees here on HN.

https://18f.gsa.gov/

[ Parent | on HN ]

Re:Ask HN: Should I report ESTA (esta.cbp.dhs.gov) security ... by ab on Tuesday May 21, 2019 @02:00PM (#19972819)

If there's not an obvious security contact at the agency, you can always report vulnerabilities to US-CERT, which has overall responsibility for connecting reporters to the right responders. https://www.us-cert.gov/

This links to the report form at https://www.kb.cert.org/vuls/govreport/

As with all vulnerability reporting, it's much more likely that someone will take action on your report if you can provide evidence or a reproducible proof of concept.

18F/TTS can sometimes direct reports to the right place, but it's really not their job to do so.

[ Parent | on HN ]

Re:Ask HN: Should I report ESTA (esta.cbp.dhs.gov) security ... by Matt_Cutts on Tuesday May 21, 2019 @03:02PM (#19973623)

Some US Digital Service folks know people at DHS CIO and passing this on.

[ Parent | on HN ]