alt Hacker NewsOn one hand, this is valid. On the other hand, security researchers can be some uber-paranoid weirdos who prefer to be entirely anonymous, and this could have a chilling effect.
Net net it’s probably positive it’s just too easy to spam these otherwise.
Replies
When you see how shitty many companies are in going after legitimate folks reporting real security vulnerabilities. it frankly shocks me that anyone would ever use their real name.
The kind of security researchers who prefer to be entirely anonymous are not seeking monetary rewards from bug bounties. No company would pay such researchers anonymously (like using Monero). If they accept bitcoin well they aren’t really that into being anonymous.
They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm). No shit security researchers don't want to give ID scans and biometric data to them.
In all past bug bounty programs I started I made it clear we would only prioritize findings as serious if PGP encrypted to the security team PGP key to review offline.
The serious researchers all knew how to do this and complied and usually got paid, and the unencrypted stuff was basically always noise we never paid out on.
Probably not as much of a filter now that AI is in play though.