Hacker News Reader

Comment by MrBruh | Hacker News Reader

> Good Samaritan

The web is insecure enough as it is, I just want to do my part to make it that little bit safer :)

Everybody has that goal until they get a knock on their door at 6am: https://github.com/disclose/research-threats

From one Paul to another, best of luck! For the goal of improving overall web security, widespread shame doesn't work. My hunch is that we need to be more prideful about having verifiably robust security practices. Kind of like getting corporations to realize that the data is more valuable if you can prove that nobody can breach it.

Thank you, the kindness goes a long way!

Either way it is a fascinating write-up. It will hopefully be a cautionary tale for other businesses and companies out there, and will inspire them to lockdown this credentialing issue. I've noticed a similar blasé attitude when implementing SSO; the devil is in the details as they say.

Does this bug work across all applications that use Firebase? Or just those that didn't push the update with security?

I salute you for it. Take caution though.

The bad guys don't play by the rules so the rules only hinder the good guys from helping. I think Internet security would be in a better position if we had legislation to protect good samaritan pentesters. Even moreso if they were appropriately rewarded.

Why, you’d never catch a black hat hacker again. The authorities would ust reeling in one Good Samaritan after another!

There is a big difference between discovering a vulnerability that allows you to forge tokens and immediately reporting it versus dumping terabytes of data on the darknet for sale.

Unfortunately, door 1 is maybe $200 bounty and weeks or months of back and forth (if the corp doesn't have a clear bounty program) whereas door 2 has infinite upside. Honestly, it might make sense for a gov group to run a standardized bounty program for exploits with notable financial / privacy impact.

Giving corps even more excuse not to run proper bug bounties,

or care even less about shipping secure code?

Pass.

I don't know. I think you could perhaps align incentives such that any bounty claimed via the government program is competitive, public, and companies are ranked by the number and severity of bounties. Then the company would have an incentive to run a bounty program where they had a chance of controlling the narrative a bit.

There are two entities that constantly and consistently stomp all over human rights and sovereignty - governments and corporations. It also seems that most people are comfortable with asking them to increase the amount of control they have over our collective affairs.

It's quite the thing.

The solution is to have fines in place for insecurities and award them to discoverers.

What a wonderful idea. Im sure our nobel politicians will ignore their donors this time and craft legislation that puts large companies at constant threat of more fines. This could never be weaponized against small businesses that pose competition to the bigger fish.

This is an awesome idea. The next time a glibc CVE comes out every company in the world pays a fine, if they are impacted or not! Hey - you could even file 1000s of frivolous CVEs (which is already common) you know would affect your competition! (which is how that would pan out)

It is a shame that ideas never progress any farther than super basic principles before they are implemented so that totally predicable outcomes that cynical people on internet forums mention become inevitable.

How do you propose such a law would work?

  1. White hat submits a "Notice of Vulnerability Testing" document to target company (copy also sent to government body) including their information, what systems will be tested, and in what time window
  2. Company is required to acknowledge the notice within X hours and grant permission or respond with a reason that the test cannot take place
  3. White hat performs testing according to the plan
  4. White hat discloses any findings to the company (keeping government body in the loop)
  5. Company patches systems and may reward white hat at their discretion
  6. Government body determines if fines should be applied and may also reward white hat at their discretion

Something like that. The white hat would have legal immunity as long as they submit the document, stick to the plan, and don't cause damage.

Nothing in your proposed law provides a way to distinguish between white hats and black hats, and instead it just presupposes that the person undertaking the conduct in question is a white hat.

Reply on news.ycombinator.com