Is it just me or is the theme of these answers a bit paranoid if you use privacy software the government will spy on you)?

Fuzzing directories sometimes returns a weird `/logitech-quickcam_W0QQcatrefZC5QQfbdZ1QQfclZ3QQfposZ95112QQfromZR14QQfrppZ50QQfsclZ1QQfsooZ1QQfsopZ1QQfssZ0QQfstypeZ1QQftrtZ1QQftrvZ1QQftsZ2QQnojsprZyQQpfidZ0QQsaatcZ1QQsacatZQ2d1QQsacqyopZgeQQsacurZ0QQsadisZ200QQsaslopZ1QQsofocusZbsQQsorefinesearchZ1 with different extensions, usually with 403 forbidden. Any idea what that is?

/logitech-quickcam_W0QQcatrefZC5QQfbdZ1QQfclZ3QQfposZ95112QQfromZR14QQfrppZ50QQfsclZ1QQfsooZ1QQfsopZ1QQfssZ0QQfstypeZ1QQftrtZ1QQftrvZ1QQftsZ2QQnojsprZyQQpfidZ0QQsaatcZ1QQsacatZQ2d1QQsacqyopZgeQQsacurZ0QQsadisZ200QQsaslopZ1QQsofocusZbsQQsorefinesearchZ1

@MechMK1 How different is it pentesting pentesters compared to normal targets?

@J-- ProtonMail bills themselves as a privacy friendly email service, so that's not really too much of a surprise. In fact, all I know about protonmail is that it tries to be privacy friendly :)

Goodness gracious!!! The data protection office here reached out to me today about a "researcher" that has been harassing them with bug bounty submissions. The data protection office doesn't handle these, and so (everytime) directed the user to submit the results to our bug bounty email address

Naturally, the "researcher" never did that, and instead said that "since you haven't responded to my submission I'm sending them to a legal platform in 10 days". What's a legal platform??? lol!

The vulnerabilities were P5s: SSL ciphers, clickjacking, etc... Best part: the DPO office forwarded me the entire exchange, and never once did the researcher mention the actual vulnerable domains! One submission identified the vulnerable domain as "website.com", another mentioned a domain that we don't own and isn't associated with us at all, and then the screenshot from SSL Labs was cropped so you couldn't even see what domain was scanned!

A "legal" platform is just any platform that is not illegal. :D

Like twitter

If you demand a bug bounty with a threat of legal action after submitting a report, are you still a white hat?

like if it's not possible to serve a subpoena to them because who would dare climbing a mountain...

I wonder if they are actually just crypto ag

crypto ag was also swiss

@J-- Who wouldn't want access to the emails of a "privacy focused" email service? Especially shady characters who are in blackmailing mood! It has the potential to be all the fun of the data leak from ashleymadison.com, but you get to have all the fun to yourself. I mean, I'm sure there is plenty of innocuous stuff that goes through proton mail, but I bet there is plenty of blackmail material too!

@J-- Just speculating on why shady characters might want to invest in a business like this, that's all

@J-- Scary thing is it could just be the CIA. They did it before, they probably are doing it again. Using a company that's secretly run by the CIA is not really optimal for evading the five eyes...

@FireQuacker I'm gonna go with, "not really". I've threatened people with publicly publishing vulnerability details (and followed through on the threat!), but not to get a bug bounty - just to get them to actually take action to fix severe vulnerabilities

Yup

I never thought protonmail was useful for privacy, but I didn't know they were so shady. Thanks for telling me!

@J-- You need a paper to prove that?

Well, duh, you have to use ProtonVPN to access ProtonMail for true privacy.

Isn't it obvious to anybody in InfoSec

Oh nice, they're partially funded by the swiss government. I'm definitely gonna assume this is just CryptoAG 2.0 now

This site seems to have written a lot about ProtonMail: privacy-watchdog.io/truth-about-protonmail

WTF?

Are there any real privacy focused email providers though?

I think there was one that snowden used.

lavabit

its back I think

eh that is quite probable

Pretending he still owns it, how would they do that?

Hmmm... we pretty much can't trust anyone at this point

Don't use email for anything confidential, that's way easier

If your threat model is a "5 eyes agency" then your best remediation step is to not do anything to get on their radar.

And I don't mean that from the perspective of "if you have nothing to hide you have nothing to fear"

If your threat model is 5 eyes, aren't you already doing everything to get on their radar?

I mean that from the perspective of: very few people would be able to keep themselves hidden from 5 eyes if being actively targeted, for any reasonable amount of time

I am pro minimal wage to be a livable one. The argument against the minimal wage is that it puts a limit on the skills you are willing to employ. If the minimal wage is 5 dollars, you as an employer would only hire someone that can make you $5 or more. without mandated minimal wage, you could employ anyone that can make you 10 cents and pay them 5 cents.

morality and profit usually aren't on the same subset

if you look from the eyes of the employer, a 0 minimal wage is optimal

from the eyes of "the people", $100/h is better

usually is someone that lives on the good part of the planet

perhaps... and same people don't remember that without people receiving money, they cannot buy things, and there goes the market

I saw a study from a century ago (so society changed a little bit since that) from Alaska IIRC, and the government increased minimal wage to bar unskilled people from getting jobs, so even the most basic entry jobs were to be paid a high wage. the result was that immigrants couldn't get any jobs

so if you are on the absolute low end of the workforce (no skills, bad at language, no contacts, no experience), a high minimal wage forces you out of the workforce because nobody wants to hire you

on the other hand, without a decent minimal wage, even those who are more skilled will earn the bare minimum and slip into poverty

if you ask me, if a person cannot provide for his family with a minimal wage, the minimal wage is sub-minimal

Long email sent to developers, explaining the vulnerability for the second time and begging them to change it for goodness sake. Let's see if this one works...

My company sets up this application for customers, and it turns out that the database password is both hardcoded and simple. So if the TCP port is left open, game over. The developer is like, "Well, we can just have the installer turn on the firewall..."