Timeline for How to deal with a company that doesn't fix (potential) security vulnerabilities in their web app?
Current License: CC BY-SA 4.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 28, 2019 at 9:46 | comment | added | user171968 | @averell it is still kind of a legal gray area, where ethics and business interests may collide - and as of the Keeper example, this had not been researched on a remote host. The topic here is still some gym and not a major tech company, which may have whole different business interests - if even interested at all. Their web-site service provider might rather care, than them - since this also is a matter of liabilities. | |
| Dec 28, 2019 at 8:47 | comment | added | averell | You seem to be under the mistaken impression that responsible disclosure is something that a company „allows“ somehow. The whole idea is about disclosing regardless of consent - I have already linked the Wikipedia page above. | |
| Dec 28, 2019 at 5:47 | comment | added | user171968 | @averell Well, I don't share the view, that the customers of a gym would represent the "general public". This would be something else, when it would be a government website or the website of a bank, which the mere of the general public uses. It is the question, which "responsible disclosure policy" applies, when that gym not published any such policy on their own; for example (in this case, they also ask for it). While nothing could be proven, that's almost alike "I don't like the color of that button". | |
| Dec 27, 2019 at 7:22 | comment | added | averell | Um, no. You do not need to „proof“ anything for the authority to do something. They can investigate mere suspicions if they want (they don‘t have to, but they can). Moreover, the OP never accessed _any_confidential information. They made quite clear that they are not concerned about their own information but want to do a public a service. I‘m not sure what you have with Google, there are plenty of individual infosec contributors who do responsible disclosure. I just mentioned the Google Team because they are well-known enough to set certain standards. I‘ll amend my answer when I have time. | |
| Dec 26, 2019 at 21:11 | comment | added | user171968 | The legal wording begins like this :`Whoever — having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information ...and depending which computer that was, this can results in a warrant, for the confiscation of whatever computer one owns. When this is not the own computer, lets say to research into a security system installed on it, this can be applied. And it is probably well-known, where the seed money for founding Google came from ...a direct comparison of an individual with them, that is megalomaniac. | |
| Dec 26, 2019 at 20:57 | history | edited | user171968 | CC BY-SA 4.0 |
deleted 246 characters in body
|
| Dec 26, 2019 at 20:30 | comment | added | user171968 | @averell it is impossible to proof the possibility of a breach - without accessing sensitive information. This equals "unauthorized computer access" (otherwise known as hacking) (unless this is by accident). The intent does not justify the means - and comparing corporations to individuals, that is questionable. Canceling the contract is the most easy way to secure the own information. | |
| Dec 25, 2019 at 21:19 | comment | added | averell | Additionally, the notification policy does not apply here at all. Art. 33 is a requirement for the controller (that is, the company handling the data) to inform the authorities in case of a breach. However, Article 25 specifically requires that data is properly protected. The supervisory authority has the power to investigate and take steps to rectify such problems. Even if you don't have a customer database (which you should never have), the authority can take action if they know data is not properly secured. | |
| Dec 25, 2019 at 21:09 | comment | added | averell | Google's Project Zero and other infosec professionals regularly perform security audits of third parties without "being asked for it". This is standard practice. Of course you have to stay within legal limits, and must not actually access data or maninpulate the system. | |
| Dec 25, 2019 at 20:21 | comment | added | Moritz W. | Like already said, I didn't dig too deep for exactly that reason ("hacking attempt"). But inspecting the JSON response from the server or the data that is saved in the browser should not be a problem at all. Also I am not too worried about myself here (my own customer record is not present in this app), but more about the privacy of other customers etc. | |
| Dec 25, 2019 at 19:16 | history | edited | user171968 | CC BY-SA 4.0 |
added 83 characters in body
|
| Dec 25, 2019 at 19:07 | history | edited | user171968 | CC BY-SA 4.0 |
deleted 437 characters in body
|
| Dec 25, 2019 at 18:59 | history | edited | user171968 | CC BY-SA 4.0 |
added 191 characters in body
|
| Dec 25, 2019 at 18:52 | history | edited | user171968 | CC BY-SA 4.0 |
added 191 characters in body
|
| Dec 25, 2019 at 18:46 | history | edited | user171968 | CC BY-SA 4.0 |
added 191 characters in body
|
| Dec 25, 2019 at 18:41 | history | edited | user171968 | CC BY-SA 4.0 |
added 191 characters in body
|
| Dec 25, 2019 at 18:36 | history | edited | user171968 | CC BY-SA 4.0 |
added 191 characters in body
|
| Dec 25, 2019 at 18:29 | history | answered | user171968 | CC BY-SA 4.0 |