News for hackers. Stuff that matters.

A comment on Stealing private keys from a secure file sharing service. Parent comment

Re:Stealing private keys from a secure file sharing service by bresj on Monday October 28, 2019 @06:17AM (#21375658)
(disclaimer: I'm one of the creators of this very unnamed service)

The XSS-issue that was found by Tim was indeed a very fundamental problem which shouldn't have been in there. We are very happy he disclosed the information with us so we could fix it directly.

We hired a couple of professional hackers to audit our service but launched simultaneously. Biggest lesson for us: finish the audit first, launch afterwards :-)

[ Parent | on HN ]
Re:Stealing private keys from a secure file sharing service by say_it_as_it_is on Monday October 28, 2019 @07:02AM (#21375860)
I'm going to give your tech team the benefit of the doubt that it would have responded to information quickly if it had that information.

Lessons learned here: pay your pen testers quickly because their findings can affect the reputation of your company, don't launch without responding to audit results, don't bullshit people working in high tech industries about what was happening simultaneously, don't blame tech staff for business decisions

[ Parent | on HN ]