Slashdot Mirror
PayPal Reviewing Qualifying Age For Vulnerability Rewards
itwbennett writes "In follow-up to 17-year old Robert Kugler's claim that PayPal denied him a bug bounty because he was under 18, the company now says that it is 'investigating whether it can lower the qualifying age for vulnerability rewards for those who responsibly report security problems.' The company also said that the vulnerability had already been reported by another researcher — although they didn't mention that in the email to Kugler telling him he wouldn't be receiving payment."
That should sidestep all the legal complications.
Sphinx of black quartz, judge my vow.
It's a voluntary process, why would they need to restrict it? It's not like it's forced child labor. If anything, it's a learning experience.
Twinstiq, game news
Why don't they just admit they don't want to pay him - or anyone.
Their poor policy and the public's perception of that company. The more people hear about PayPal's poor internal decision making the better off everyone is about avoiding their biggest vulnerabilities.
Paypal pulling out their tinfoil hat. They could have told that to the researcher and this all would have been avoided.
I smell bullshit.
It seems obvious to me, but if Robert Kugler is too young to receive the award, then arrange to make the payment to a parent or guardian. If somebody else discovered the vulnerability first, then again, obviously, that should have been stated in the initial contact.
Let's say that we're reviewing the qualifying age so that we can get these internet assholes off our case.
Oh, but we don't want to actually pay anything, so let's also say someone else already submitted the bug.
Sure sure, we know
Can we dedicate this thread to finding alternatives to PayPal so people don't have to interact with this horrible company and its practices.
To be fair I can see where paypal is coming from, trying to cover their rears in case of some problems with the law when it comes to paying minors a lump sum, however if Kugler had found the bug he should've been awarded the money. If it wasn't stated in their fine print they have no choice, in my opinion. (That being said, you need to be eighteen in order to even have a paypal account, so it should render the point null).
That is all
Pure, unfiltered bullshit.
Evidence: 16-year-olds who work at McDonald's.
C'mon, PayPal; Fuckin' a kid around is bad enough, but then having the balls to lie to his face about why? That's uber-dickish.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
If there is an age issue, couldn't they just toss the funds into escrow, maybe an interest earning money market, and cut him a check on his 18th B-Day?
Sure it was. Does anyone actually buy this?
Well done guys.
Clear message here kids; next time sell the exploit in a black hat forum.
Paypal, proudly fucking you over since 1998.
When you're young, don't report the bug to the company in question or the authorities, report it to those that can make "good use" of them. Not only do they not have any problem with you being underage, you being underage also means you most likely won't be doing time if you get caught.
It's just so win-win...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
PayPal has account eligibility requirement that you must be 18 to open an account. And yes I checked it applies in Germany.
Also you aren't supposed to let others use your account.
So how did he avoid these terms of service?
At first, I didn't feel sorry at all. Usually, the guidelines specifically point out you must be 18+, and you agree to this upon submission. But then, I couldn't find anything about age restrictions. However, it does say "The bug bounty program is subject to change or to cancellation at any point without notice." and a bunch of other "Hey, we can screw you over if we want, and you agree to this upon submission." Therefore, I feel a little sorry for the guy because there is NO indication of an age restriction, but it's clear that Paypal can screw you over if they want (just like any legal Terms and Conditions that we all agree to everyday). If you don't want to be screwed over, just don't submit bugs. Submit bug reports for FOSS projects instead... or, call up Paypal and scream, "Show me the money!"
The G
Why not offer this kid an internship?
The problem with Bitcoin is the difficulty of exchanging it for offline money. The governments of major countries have been cracking down on BTC exchanges, claiming that their potential for money laundering outweighs any lawful benefit they might offer. PayPal is big enough to be able to afford compliance with money laundering regulations.
But one alternative to PayPal is Dwolla, the payment processor that people used to use to get their money in and out of Mt. Gox.
....PayPal, it just makes you look worse. If you had that vulnerability found already, there should have been something posted somewhere.
At this point, the only way for PayPal to save face is to dole out the reward and create a new policy stating all of the rules and when the bug is reported and verified, it should be posted immediately.
Life takes interesting turns, but the most interest is when you're off the beaten path.
They should ban minors from hacking their site for personal gain and entertainment as well. That would probably cut down on the majority of the script kiddie attacks, and of course would be 100% effective.
Or even better, arbitrarily RAISE the age at which people are legally allowed to hack their site - that could eliminate ALL security issues, and they'd have no need for bug bounties at all... this security stuff is so damn easy!
They received something of value and didn't pay up. I see this as a problem. They should have to give the money to the charity of the kids choice or something like that.
Competition Good, Monopoly Bad.
Two security issues, one serious, I've known about for several weeks are still unknown. I'm thoroughly enjoying myself, while I just watch and wait; the resulting Karma will be a bitch. (Hint: viewing account data.)