Without researchers like that, someone else would figure it out and use it maliciously without telling anyone. This researcher got Google to close the loophole that the exploit requires before publicly disclosing it.

I think the method of researching and then informing the affected companies confidentially is a good way to do it but companies often ignore these findings. It has to be publicized somehow to pressure them into fixing the problem.

I think it's important for users to know how vulnerable they really are and for providers to have a fire lit under their ass to patch holes. I think it's standard practice to alert providers to these finds early, but I'm guessing a lot of them already knew about the vulnerabilities and often don't give a shit.

Compared to airing this dirty laundry I think the alternatives are potentially worse.

$5,000

This is like 1/10th of what a good blackhat hacker would have gotten out of it.

Damn that's interesting. I like how they walked through step by step how they got the exploit to work. This is what actual real hacking is like, but much less glamorous than what you see in the movies.

I always wonder what's stopping security researchers from selling these exploits to Blackhat marketplaces, getting the money, waiting a bit, then telling the original company, so they end up patching it.

Probably break some contractual agreements, but if you're doing this as a career surely you'd know how to hide your identity properly.

Chances that such an old exploit get found at the same time by a whitehat and a blackhat are very small. It would be hard not to be suspicious.

Google, Apple, and rest of big tech are pregnable despite their access to vast amounts of capital, and labor resources.

I used to be a big supporter of using their "social sign on" (or more generally speaking, single sign on) as a federated authentication mechanism. They have access to brilliant engineers thus naively thought - "well these companies are well funded, and security focused. What could go wrong having them handle a critical entry point for services?”

Well as this position continues to age poorly, many fucking aspects can go wrong!

1. These authentication services owned by big tech are much more attractive to attack. Finding that one vulnerability in their massive attack vector is difficult but not impossible.
2. If you use big tech to authenticate to services, you are now subject to the vague terms of service of big tech. Oh you forgot to pay Google store bill because card on file expired? Now your Google account is locked out and now lose access to hundreds of services that have no direct relation to Google/Apple
3. Using third party auth mechanisms like Google often complicate the relationship between service provider and consumer. Support costs increase because when a 80 yr old forgot password or 2FA method to Google account. They will go to the service provider instead of Google to fix it. Then you spend inordinate amounts of time/resources trying to fix issue. These costs eventually passed on to customer in some form or another

Which is why my new position is for federated authentication protocols. Similar to how Lemmy and the fediverse work but for authentication and authorization.

Having your own IdP won’t fix the 3rd issue, but at least it will alleviate 1st and 2nd concerns

Yes, but I was saying the Blackhat marketplaces wouldn't really have much recourse if the person selling the exploit knew how to cover their tracks. i.e. they wouldn't have anyone to sue or go after.

If you know how to hurt others, you can learn how to prevent that way of hurting others.

I always wonder what's stopping security researchers from selling these exploits to Blackhat marketplaces, getting the money, waiting a bit, then telling the original company, so they end up patching it.

Probably break some contractual agreements, but if you're doing this as a career surely you'd know how to hide your identity properly.

is that how guns work ?

is that how guns work ?

I think you missed the part at the very end of the page that showed the timeline of them reporting the vulnerability back in April, being rewarded for finding the vulnerability, the vulnerability being patched in May, and being allowed to publicize the vulnerability as of today.

Proton estimates the average Americans data is worth $700 per year.

Sign me up for $1000/year privacy fee and you will make more money by doing absolutely nothing.