5

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so?

Assume we have a responsible disclosure policy page that's secured under a properly configured SSL/TLS connection:

  1. Offer a security@ email address to contact with a PGP with an established Web of Trust consisting of developers and open source community. The PGP fingerprint is published on the page and the key is available on one of the many key servers.
  2. Offer a HTTPS submission form that, under the hood, dispatches an email from the webserver to the office's internal mail system. STARTTLS would be used so the email is encrypted in-transit
  3. Offer both, letting the researcher decide.

It would seem to me that Option 3 is the best, but I've heard researchers complain about all 3 options both for & against.

Improve this question
4
  • 2
    Whom are you afraid of? How much effort will they put into getting wind of your 0-days?
    – Deer Hunter
    Mar 27, 2014 at 14:15
  • 3
    @DeerHunter The threat model is roughly competent industry competitors, your basic script kiddy, and random do-evilers. Not concerned about protecting against governments, NSA, or any other sort of top-level threat.
    – JustinBull
    Mar 27, 2014 at 14:18
  • 3
    Justin, in case of server compromise logs may be trawled (data in rest compromise!) etc. Thus, a PGP-encrypted e-mail to the response team looks like the best option as long as the WoT is long enough to spot fakes. It may be prudent to advise posters to check the fingerprint against Web-Archived versions of the page before encrypting.
    – Deer Hunter
    Mar 27, 2014 at 14:25
  • 1
    @JustinBull You probably don't need the answer anymore, but this can be useful for others.
    – Lucas NN
    Dec 3, 2014 at 6:35

1 Answer 1

Reset to default
2

When we are working with Responsible Disclosure Communication, we need balance security and convenience.

Convenience for whom?

For security researchers.

You need to think a few things before choose:

  • Do you need the reports so safe that you can wait to receive them?

Sometimes the security researcher finds a security bug, but he is not with his PGP keys. And if he is traveling? You will wait a few days (or more) to receive the reports. Is it expected? Sometimes it is not.

  • What is best, address a bug quickly, even receiving the report through insecure channels, or take slightly longer to address the bugs but be sure that the reports are send and stored in the safest way?

Just you can answer this question.

I worked managing a Bug Bounty Program recently, and I can say to you that a few researchers will choose send the bug through the HTTPS form (fast), others will e-mail you in plain-text (faster) and others will never talk with you without exchanging PGP keys.

And you never can say that one type of security researcher will send better reports than others (the PGP guy, the HTTPS form guy or the plain-text e-mail guy).

So be careful with your choice, I would choose the option 3.

In my opinion is better receive a report than not receive it, independent of how I received it.

Improve this answer
1
  • Lucas, I wonder how many of the PGP & TLS guys did their due diligence and checked the WoT/Certificates.
    – Deer Hunter
    Feb 7, 2016 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .