PayPal Denies Teen Reward For Finding Bug
itwbennett writes "You have to be 18 to qualify for PayPal's bug bounty program, a minor detail that 17-year old Robert Kugler found out the hard way after being denied a reward for a website bug he reported. Curiously, the age guideline isn't in the terms and conditions posted on the PayPal website. Kugler was informed by email that he was disqualified because of his age."
^ That's all.
That's a REALLY good way to generate positive publicity for your company - act like a douche.
So, the next time a 17yo finds a bug, they don't report it, the exploit it.
Sounds like a plan.
Paypal, perhaps all future underage rewards be in the form of scholarships?
PayPal could have paid into his parent's account, and then froze it.
I'm pretty sure most shareholders would rather you part with tiny sum of money that you owe this kid than to take the tsunami of bad PR and bad faith that would result in you being dicks about it.
The cow says "Moo." The dog says "Woof." The Timothy says "Thanks, valued customer. We appreciate your input."
Way to piss off the community you asked to hack your system. I'm sure this will go well.
They're crooks.
If Paypal won't pay the kid for bugs in its system, I bet someone else will.
"Here's a few bucks in a bank account for next year when you go to school!" Oh, no. They didn't think of that. Creeps.
"Remember kids: If you find a bug in Paypal's system, you'll get paid more for selling it to the black hats."
And hold the money for him until he is 18? And then give it to him. That would satisfy their policies wouldnt it?
Welcome to the real world.
If he is too young to receive money for finding a bug, is he also too young to be criminally prosecuted for exploiting a bug ?
While I can appreciate where your skepticism is coming from, you have to realize that Paypal freezing people's accounts is actually not a typical thing. For every person that this sort of thing happens to, there are many hundreds or thousands of others that it does not. Not that I'm saying that it happens at all is acceptable, but it's not statistically valid to assume that something which happens a tiny fraction of 1% of the time might be sufficient reason to believe that one should actually be actively *expecting* it to happen at any particular time.
File under 'M' for 'Manic ranting'
I wonder when big companies will learn that douchery like this always comes back to bite. Are you unaware of the Internet? You can't get away with it!
Signature intentionally left blank.
FTFA:
PayPal requires that those reporting bugs have a verified PayPal account.
The kid didn't have one. Claim denied. What's the story here? (The age thing? That's irrelevant...)
Paypal is really stupid -- I would not be surprised if this actually results in the guy finding more bugs and simply just releasing the information without giving Paypal any heads up about it.
Welcome, Mr. Kugler, to the good ol' US-of-A, where you aren't a real person until you can cast a ballot. If you get a job, you must follow a different set of rules. If you break a law, you get a different justice system. If you win a contest, you have a different set of rules that forbid you from winning anything. That's right, in several states you can't actually own property until you're 18. I'm not sure what jurisdiction PayPal/eBay is playing ball in, but in general, don't expect the government to ever side with anyone who hasn't reached that magical moment where they are instantly freed from their childhood stupidity.
You see, despite biology saying that humans are mature at around 15 years, the Puritans who founded the United States were rather squeamish about things like youthful ambition, political activism, and worst of all, sex. The generally-accepted age of maturity moved back several years, finally settling at 18, and it's been stuck there. Of course, anyone under 18 who wants to have their full rights doesn't have the right to get them (except through a red-tape-filled emancipation process), and no parents ever want their darling little children to grow up so fast, and no politician would dare propose an affront to "traditional family values", so there are no realistic attempts to get more legal power for minors.
A few states allow certain adult rights to 16- and 17-year-olds, but those rights are usually restricted to things like "can work on a farm" and "can be prosecuted as an adult for heinous crimes". Practically all other rights are the domain of the parents, so there's a slim chance that your parents could ask for the reward as promised, but that's unlikely to work, because they didn't find the bug.
Welcome, sir, to America, where our child abuse is civilized!
You do not have a moral or legal right to do absolutely anything you want.
So, basically, they have secret conditions to their offer to pay for revealing of bugs, and they don't tell anybody what those secret conditions are.
So, uh, why would anybody expect to be paid? What other secret conditions do they have, which they can reveal at any time and say "oh, so sorry, but one of our terms is that we don't pay under (xx) conditions."
--I'm sorry, but we don't pay if you work for a competitor, or a company that we deem might be a competitor in the future
--I'm sorry, but we don't pay if it's a vulnerability that can be traced to a flaw in an Adobe product, or in a commercial database program we may use that was purchased from an commercial source.
--I'm sorry, but we don't pay if you're from a country that doesn't speak English.
--I'm sorry, but we don't pay if the vulnerability is discovered by somebody from states with names beginning with a vowel.
--I'm sorry, but we don't pay if the vulnerability is one that is only active on days of the week ending in "y".
http://www.geoffreylandis.com
Give the fucking kid a scholarship to college...or a paid internship at Paypal. Is it not possible for anyone to do any serious work until they are 18 yrs? wtf
My God can beat up your God. Just kidding...don't take offense. I know there's no God.
That's a foolish thing to do. Now that kid won't report the second bug he found and may just publish it in some innocuous place where it will get picked up by a ne'erdowell and be exploited - something that will no doubt cost more than if PayPal had just done right by the kids in the first place.
Probably, but your first instance of "in" was certainly redundant! ;)
The rules say that "Payment is paid out through a verified PayPal account, once the bug is fixed." It's not required to have a PayPal account to win. That's just the payment mechanism eBay prefers. Once someone has won, PayPal owes them money. PayPal is a debtor here.
Debtors do not. in general, get to require that their creditor jump through hoops to get paid. Whether eBay is entitled to require payment via their own system is a legal issue which eBay would probably lose. Any collection lawyer or collection agency should be able to take this case and win.
On top of that, this is a "contest", and in the US, contests are regulated by the FTC's Contest Rule. Federal law limits what a contest operator can require after they've told someone they've "won".
PayPal is a subsidiary of eBay. The CEO's name is John Donahue. I've written to him. If anyone else wants to:
John Donahue
CEO, eBay
2055 Hamilton Ave
San Jose, CA 95125
It's my belief that as of 2013, a personal letter, written in ink on physical paper in an envelope with a stamp, sent by USPS, has more impact than e-communication or online petitions.
"How to Do Nothing," kids activities, back in print!
The next time a teenager finds an exploit in PayPal, what are the odds they're going to report it, and not exploit it? After this dick move, the report odds go down and the exploit odds go up. Stupid, stupid, stupid.
Finding God in a Dog
There's others out there that will. And generally they are the ones looking to exploit those bugs. Factor that in next time PayPal.
I am Bennett Haselton! I am Bennett Haselton!