Re:Stealing private documents through a bug in Google Docs
by clarkevans on Monday December 28, 2020 @09:15AM
(#25559290)
Perhaps it shouldn't be Google paying for the security reports, but the government... who then would need the statutory authority to fine Google for a very handsome profit?
Re:Stealing private documents through a bug in Google Docs
by sneak on Monday December 28, 2020 @09:24AM
(#25559374)
Yes, $100k is not a lot of money for an issue like this. It's also not a lot of money in Google's security budget.
Apple's payout seems rather low to me. If I had a vuln like that and knew they were only paying $100k, I would probably seek to monetize it elsewhere.
$3k is almost insulting for something like this, given Google's scale. $31,337 might be more appropriate to at least avoid insult.
Re:Stealing private documents through a bug in Google Docs
by ffpip on Monday December 28, 2020 @03:31PM
(#25562889)
> Yes, $100k is not a lot of money for an issue like this.
Requiring rare user action and document URL? Sure. Live in your bounty bubble.
> If I had a vuln like that and knew they were only paying $100k, I would probably seek to monetize it elsewhere.
But you don't. The person exploiting it knows how much it is worth.
> $3k is almost insulting for something like this
Not for you to decide. He accepted it, meaning it's not insulting.
In comparison, Apple paid 100k [0] for a full account takeover, using an bug so simple that it is unbelievable that it could have passed a code review and testing.
[0]- https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a...