Re:How the FBI tracked down the Twitter hackers
by SahAssar on Monday August 03, 2020 @03:02AM
(#24034890)
> Much better that this kid exposed these security holes.
That's why we have responsible disclosure. It does not make it okay to exploit security holes for profit.
> Spearphishing is a real problem and tech companies have no answer.
That does not make it okay to exploit it.
Re:How the FBI tracked down the Twitter hackers
by aeternum on Monday August 03, 2020 @03:44PM
(#24042417)
>That's why we have responsible disclosure. It does not make it okay to exploit security holes for profit.
I'm not aware of any bug-bounty or responsible disclosure method that allows spear-phishing as the attack requires impersonation/fraud. Is there one?
Re:How the FBI tracked down the Twitter hackers
by SahAssar on Tuesday August 04, 2020 @09:56AM
(#24049986)
Responsible disclosure does not equal bug bounty. Just because you found a security hole does not mean you are entitled to a payout.
The responsible way to do this would be to prove the access to twitters security team and not exploit it for personal gain. You can even just post it publicly, just don't try to scam people and profit based on the exploit.
Do you think that just because there isn't a bug bounty for a specific exploit that gives you a free pass to exploit it for personal gain?
Spearphishing is a real problem and tech companies have no answer. An annual employee training program isn't going to solve the problem. Simply making it illegal isn't going to solve the problem.