Just a quick and possible stupid question.

If I store my KeePass database key on my phone, would storing it in a system folder be more secure than storing it on the download folder?

Or is this too much hassle in a device that is by default, insecure and 0 privacy?

would kinda depend what kind of phone it is...

fair point, but I didnt want to assume

:)

(just to imply ;-) )

@Freedo not sure that would do much

system is normally available read-only

so I can't think of anything it would gain you

apart from security by obscurity, nothing really.

Best is to have the DB encrypted

@M'vy well if he's using keepass, then the DB is encrypted, sounds like he was trying to prevent other things from accessing it via file permissions

but forgot that system is only write protected, not read protected

@AJHenderson I could be wrong, but I assumed he meant the db key file (a "2nd factor" in addition to the master password), which is used for unlocking the db

(yes, I know its not a real 2nd factor, hence the quotes. lets consider it a pseudo-factor.)

Hi. A few weeks ago I found a very critical vulnerability on a (relatively) big Belgian IT-company, it was a very-design specific vulnerability; and really required insight in architecture to detect. When I reported it, I got paid for it (as bug-bounty, however they do not have a bug-bounty program).

But today, I found a vulnerability on another website, it's a whole opposite situation. The type of vulnerability (XSS) is still critical, but the way I found it was just a matter of looking what WordPress-plugins were used, looking what version, and then searching on the internet if that version would have a specific vulnerability.

. I still did write a PoC for them. But I wonder, finding a vulnerability on such a easy and basic way, does that even deserve a bug-bounty? I did found a critical vulnerability, but it only took me a few hours to find it and to write the PoC; plus they just have to update the plugin to fix it.

tl;dr: Does someone with more experience in bug-bounties know if you'd also deserve a bug-bounty if you find a vulnerability in a basic way? Which is easy to solve by just updating?

@O'Niel Whether you're deserving of a bug bounty or not is quite up to the company to whom the vulnerability belongs. Others can speculate what they may or may not think someone else should do in the situation, but such speculation is quite worthless. If the company feels your report is worthy of remuneration, then it is. If they do not, then it is not. The amount of work you put into it, and the amount of skill required is entirely beside the point.

@Xander Okay, thanks a lot!

@O'Niel They will only be interested in the potential damage to them - so if your bug provides them with improved security, and they have a bug bounty programme, then that is why they reward you.

@O'Niel Sure! Just remember that security vulnerabilities are not particularly special. Anytime you're doing unsolicited work, there is no guarantee of payment. Formal bug bounties mean that a company agrees to pay for some unsolicited work at their discretion...And all bets are off for a company with no bug bounty program, but they're generally going to be unlikely to pay.