Hacker News Reader

Comment by nullc | Hacker News Reader

As I was reading your story and got the the part where they said they didn't have a bounty -- for some reason I anticipated that the next line would be them telling you that you could keep the $5,000.

I was extremely disappointed. :(

Thank you for sharing.

View on HN

Even their newly developed responsible disclosure program doesn't have bounties.

You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.

What? That's their bread and butter. You wouldn't expect a pizza place to give away pizza....

Uhh, I would expect them to do exactly that for someone who presented them valid proof and and an MVP for how someone could get away with stealing tens, hundreds, thousands? of pizzas undetected. Rewarding someone for helping them with their “bread and butter” is how I would expect to be compensated for helping.

Or maybe just be allowed to return to the pizza shop in the future, and keep ordering pizzas.

The core skill of bankers is trading money and risk. They lend you money based on one risk calculation. They put aside more money against default if your loan gets riskier. They set budgets for whole departments of people based on how much they help mitigate risk.

So yes, I absolutely expect them to be good at saying, "Well, if we pay $X this year for bugs, that's better than losing $Y directly and paying $Z in cleanup costs."

sarcasm seems to be unnoticed...

I suspect they know they have a lot of vulnerabilities and they don't want to encourage people to poke around. I mean, their passwords aren't even case sensitive. This is also probably why they fired you as a customer, to discourage anyone else from even trying.

Case-sensitive password gets you <1 bit of entropy per password character. That doesn't sound like that big of a deal.

So a password with 10 characters is 1000 times less secure if you don't use case sensitivity. That's a big deal in my eyes.

" times less secure" isn't really well defined. Entropy is usually measured in log-space.

And in practice, it's less than one bit, since not all characters are letters.

Reply on news.ycombinator.com