Tom Anthony, an SEO and security researcher, writes up vulnerabilities in Google, Facebook, and Zoom.
HN commenters discuss his Google sitemap bug and bug bounties, with some calling the $5000 payout low and Google's fix slow.
I think this might have been true in the past, but I don't think it is true any longer. Zoom grew at a wild pace during the early days of the pandemic, and with that came security issues. However, they recognised that and invested into security.
I have previously reported bugs to Google, including one where they simply didn't put any auth on an API endpoint for a new feature, allowing access to any account's data. That is a massive oversight, but at Google scale we realise these things happen, and the more important consideration is how companies respond.
Zoom have a private bug bounty program, but I previously disclosed Zoom bugs publicly [1] as I didn't think their bug bounty program was worthwhile engaging with.
However, they overhauled it, and now of the dozens of private programs I am part of, Zoom's is one of the absolute best. The payouts are great, the team actively engages with the researchers, and seem to legitimately care about getting things right.
Are they perfect? Of course not. But I would feel safer on a Zoom call that call with many competitors who simply don't get as much scrutiny.
[1] https://www.tomanthony.co.uk/blog/zoom-security-exploit-crack-private-meeting-passwords/
Denying the deadline extension to May 8th [1] is quite a dick move by Google, considering that it took them 6 months to fix the extremely harmful sitemap ranking bug in their search engine[2]. And after they fixed the bug, they only paid peanuts to the researcher for a bug that could've cost Google's customers tens of millions in misplaced ad campaigns.
1: https://bugs.chromium.org/p/project-zero/issues/detail?id=1514#c3
2: http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty/
A bug by the same author (referenced in the article) that allowed anyone to undetectably upload a sitemap to any other person's website (and appear at the top of search results by claiming to be associated with the website) only got $5000, when it could have easily been sold for tens of thousands to blackhat SEO companies. So the answer is probably "way less than street value but still nonzero"
http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty/
http://www.tomanthony.co.uk/blog/facebook-bug-confirm-user-identities/
Mentions how inconsistent usage of the XSSI prevention caused a information leak that could detect which user was logged into Facebook - received a bug bounty of $1000 from Facebook.
Previous discussion: https://news.ycombinator.com/item?id=19306309
Are you referring to the image on that page? If so, go here:
http://www.tomanthony.co.uk/tools/detect-social-network-logins/
It's accurate for me.
More technical details here: http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty/
(Tom works at my company)