Timeline for How to report a vulnerability in a site that wants to call the FBI?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 17, 2018 at 18:56 | comment | added | Kat | Yeah, an issue with Tor is that at the very least, it's usually easy to check if you at least have used Tor directly. If you're already on the list of suspects (in the case in question, that was all Harvard students), the odds are good that you're one of the few or the flat out only person who used Tor, since it has a very tiny consistent user base. Using a VPN with Tor could avoid that, but if the Tor entry node is compromised, they could repeat the same process (checking who used that VPN). Mind you, the OP probably isn't on a narrow suspect list in the first place. | |
| Apr 13, 2018 at 8:29 | comment | added | ximaera | @user175564 you may send the initial e-mail from an anonymous account via Tor, signing the message with GPG. In case you'll get a positive feedback and the vulnerability would be fixed, you can later uncover your identity and prove that it was you who has initially reported the flaw. Besides that, personally I doubt that FBI is really going to go after a person who just happened to look at the HTML source of a Web page. | |
| Apr 12, 2018 at 21:46 | comment | added | AJAr | FWIW, I wouldn't interpret that article to mean that Guerrilla Mail is an unsafe solution. Just says the service likely helped identify the origin as Tor, authorities checked network logs and saw the student was on Tor, and he confessed when confronted. But I agree with ThoriumBR if you don't want to remain anonymous... | |
| Apr 12, 2018 at 21:21 | comment | added | user175564 | That's an interesting idea, but I'd prefer to not be anonymous if I can do so safely. Also, Guerrilla Mail has been traced. | |
| Apr 12, 2018 at 20:56 | comment | added | Alexander O'Mara | Of course, they may have already logged some information about the OP when they were testing for vulnerabilities. | |
| Apr 12, 2018 at 20:54 | history | answered | AJAr | CC BY-SA 3.0 |