teenageSec

Even if you don't have the budget for a cash bounty, offering up some amount of free swag (e.g. t-shirts) is a cheap but effective way of attracting researchers. Great example of this is CloudFlare's bounty which is a pretty cool t-shirt and a 1 year subscription.

Start a bug bounty and you'll get some attention from white hats. Or post the link here and with your permission I'll give it a quick look through.

While I applaud the idea of this, I think it is ultimately just a question of how much a linux zero day is worth (aka is it worth more than 100 grand). When the code base for everything on there server is going to be huge (aka they use Linux and any common webserver), there is pretty much a gaurantee that there will be a vuln, the only question is if someone will drop a zero day for this.

In the kickstarter page, you say that "a private key is stored, which is encrypted using military-grade encryption methods with his fingerprint". How does this work? It seems to me that there is no way of encrypting data with a fingerprint (since it varies drastically depending on how it is placed on the scanner). So are you encrypting the RSA priv key with the fingerprint or just checking the fingerprint before using the key?

Also, how are you planning on getting websites to use jar for authentication?

Another question: "fully-encrypted cloud storage". But previously in the description you say "losing your JAR does not create a continuous lock-out for the user". How does this work?

How much storage is available on the jar?

Also, you say "The private key stored on your JAR is generated when setting JAR up for the first time, using your fingerprint as a random input". Do you have another source of entropy for the jar? Because a fingerprint does not have that much entropy (certainly not enough for a 2048 bit encryption key).

Anyone can get a list of every single tor exit node, so it is pretty much impossible to hide that you are using tor.

Email me ([email protected]) sometime if you want to chat about web security stuff. I'm 17 years old and I tend to spend my free time working on bug bounties etc. I can certainly give you some pointers on this sort of thing.