ic4l

Actually the score already crashed at that point.

It was around 620 by the time I got around to opening new cards.

I think the crash was mainly due to the length of my average active credit history going from 10 years to 0 years, as I really did only use Chase credit cards.

I have to always do this to pass those hotel wifi login portals.

What I will do is spoof my mac address to match my laptop, and then pass the login wall to create a session. Then restore the original mac address, and then I can finally use my apple tv on the hotel wifi...

I wish they had a web browser on the apple tv.

very odd, here is the original when it was published

https://web.archive.org/web/20200103170008/https://tjcx.me/p...

It is great to see them giving out real rewards.

It is a big change from when I reported issues back in 2012[1] with them on the starbucks.com domains.

They were very nice though, and did let me keep a $200 credit which was quite rare at that time.

Also after they fixed it the SAME bug got reintroduced for some reason in 2015[2], and @homakov had the pleasure of reporting it again.

At the time I do NOT think they had any actual bounty programs like they do now.

I can only hope they now do proper regression testing for these types of issues.

[1] https://chadscira.com/post/556999d91cb00914380006ee/Re-Starb...

[2] http://sakurity.com/blog/2015/05/21/starbucks.html

Before I proceeded to confirm that this was indeed a massive issue they said this to me:

"Can you also confirm if this allows additional points to become available for use?"

This was why I had to remove the negative points, and make a transfer to prove that they indeed could be used.

Many things could have happened but they didn't.

The entire experience with Chase while I was assisting them was very positive, and they even mentioned something about putting me on their upcoming researcher leaderboard.

Since chase is a very big organization I would have to assume that another department took over the situation after, and decided to terminate my accounts to avoid any risk.

I will never know for certain as they have been very close lipped about the whole event.

Or maybe just be allowed to return to the pizza shop in the future, and keep ordering pizzas.

This could be possible as well, because they never gave me any information.

This is very hard because the actual research required you to use real accounts, and you would need to contact them to correct your account after you proved it was indeed an issue.

This was the original reason why I wanted to report it, also the fact that I really liked chase at the time.

They were one of the first companies to have solid mobile banking.

This termination did not happen instantly.

The account was brought back to normal well before the termination of all of our accounts.

I also expected them to have automatic triggers, but at the time they did not.

They said it was intentional but did not state why, and said that they could not tell me why.

From what I understand they can close your accounts for any reason.

They had one a few months after

https://responsibledisclosure.jpmorganchase.com/hc/en-us

Even their newly developed responsible disclosure program doesn't have bounties.

You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.

I'm sure they would send a Debt Collector after me if I had any balances on my credit cards.

Back when this originally happened they gave me 60 days for the credit cards, and 30 days for the checking/savings account.

I agree, especially with risky parties like banks, or government institutions.

It's always a scary experience.

The funny thing is according to them I was the only contributor from 2016 to the end of 2017. So they must not get many reports.

Since then they did develop a disclosure program, but it would be great to hear from anyone else that reported things to them after the end of 2017.

I gave them a detailed report of everything, and the $5,000 USD, and the remaining 4,500,000 rewards points were returned.

The only compensation I received with this whole situation was the termination of my accounts, and a family members account being terminated as well.

It's very hard to know the reasoning behind the termination as they never gave me any information.

Due to fear of retaliation I decided initially not to share this story, but enough time has passed, and I feel the security community should know how one of the largest banks treats security researchers.

As they say

"ignorance is bliss"

I have been confused about this 2-3% figure since they started using it... I mean they are not factoring in the lag-time.

It seems like they just are taking all the new patients, and not calculating it correctly. I expect this number to grow.

But the truth is you should always treat your environment as untrustworthy. I don't think you should deduct him points for blocking his webcam.

It is an ADDITIONAL privacy step. He runs a company with thousands of employees, and with any company like that you never know if someone may decide to become a bad actor, and physically compromise him.

But yeah lets continue to hate on facebook.

Not sure who downvoted you. But I agree 100% with this, he is a high value target.

It's still a mobile website, so they can just use a VPN to access it.

Are they including the billionaires in their statistics, and dividing the total sum by the population!?

Maybe mtgox?

This is how Task.js functions

https://github.com/icodeforlove/task.js

Which works on Node.js, and the browser. (Supports fork, worker_threads, and WebWorkers)

The advantage of this is that the workers become generic enough to run anything. Instead of having to have many "specialized" workers.

Performance-wise eval is not slow, and it is encapsulated inside of the actual worker. Obviously you don't want a user to be able to control any input. But for most cases we are talking about code related to processing, which involves hard coded functions, and the "external-data" being ArrayBuffers.

Back in 2012 I found an exploit [1] that let you fabricate card balances. They fixed it 2012, but in 2015 another person found the same issue [2].

I have no idea why they would not be using transactions, and make the same mistake twice. It really does make me wonder how much FAKE money is inside of that BILLION DOLLAR pot.

I also found similar issues in 2017 for their Thailand division. But this is at least understandable as Thailand operates its own Gift Card system.

[1] https://chadscira.com/post/556999d91cb00914380006ee/Re-Starb... [2] https://sakurity.com/blog/2015/05/21/starbucks.html

Ah, this explains why in this post they linked to an actual file in the repo instead of the repos homepage.

This is lacking context, the main reason for this repo is to provide alternatives due to the actual size of moment.js.

https://github.com/you-dont-need/You-Dont-Need-Momentjs/raw/... https://github.com/you-dont-need/You-Dont-Need-Momentjs

There are still many situations where these alternative solutions will not work. For example timezones.

But in general pulling moment.js in for one method call is pretty ridiculous if it can be replaced and needs to be ran on the clientside.

Or maybe just the resolution of the satellite images have just improved resulting in what appears to be a more greener earth.