7 ms·

> I'd demand Facebook pay out $75,000 minimum Wouldn't demanding money be blackmailing? A story from one of my startups: A student reached out to us regardin

> I'd demand Facebook pay out $75,000 minimum Wouldn't demanding money be blackmailing? A story from one of my startups: A student reached out to us regarding a security vulnerability on the website, demanding money for it. He refused to say what it was or provide evidence at first, so we couldn't assess it. He said he'd disclose it to others if we didn't. I definitely felt blackmailed. I am not a lawyer but it felt illegal. Maybe someone can chime in to say if it is?

rhexs 6y ago
Unless litigating students is something your startup is interested in, I’d recommend ignoring that line of thinking and just hiring a good pen tester for a few months.
- EGreg 6y ago
  It’s really hard to say what something is worth if you are only allowed to sell it to one buyer. No competition between buyers. The only leverage is releasing the info and screwing a lot of people. (Also sucks that you can release it anyway. But you do want to source these vulnerabilities from the world at large.) Yet another reason why open source and collaboration may be better than capitalism and competition. Many hands make light work, with enough eyes all bugs are shallow, and all that. (To be fair, open source lacks security by obscurity so a project becomes secure after many years and developers join it.)
ericjang 6y ago
Rather than the exploiter setting an arbitrary price (which would be closer to blackmail), I think parent comment was saying that the fair market value of disclosing such a bug was worth closer to $75k given the unique skill set required. Skilled engineers turn to cybercrime when white-hat bounties are insufficiently rewarding, so it is in everyone's interest to pay competitive rates for finding security vulnerabilities.
- singingfish 6y ago
  Which is essentially market driven blackmail as far as I can see. Once I meet my new neighbours (one of whom is a moral philosopher by trade) I might ask about how to assess if that's ok. Personally it feels somewhat ok to me, speaking as someone who's built industrial espionage for money.
  - phkahler 6y ago
    >> Which is essentially market driven blackmail as far as I can see. Modern medicine can also be like blackmail. Nobody has to actually threaten you, but nature will kill you unless you pay whatever the price of treatment. That's why we need competition, and why pharma companies like monopolies.
    - singingfish 6y ago
      Here in Australia the state funds most medical care. In this case the blackmail vector, if we use that interpretation is the taxation system.
      - sjwright 6y ago
        And we (Australia) blackmail drug makers: sell your drugs to us at a certain price and the Government will heavily subside it and you’ll get big sales. Refuse and it will get zero subsidy and nobody will buy it. https://en.m.wikipedia.org/wiki/Pharmaceutical_Benefits_Scheme https://en.m.wikipedia.org/wiki/Pharmaceutical_Benefits_Sche...
        webmaven 6y ago
        > And we (Australia) blackmail drug makers: sell your drugs to us at a certain price and the Government will heavily subside it and you’ll get big sales. Refuse and it will get zero subsidy and nobody will buy it. The blackmail version is actually "Refuse, and we'll produce a generic version locally and perhaps even export it to any country that wants it." https://www.wired.com/2006/12/indiadrug/ https://www.wired.com/2006/12/indiadrug/
pgayed 6y ago
It’s that second part. “I’m going to do x if you don’t y.” He’s under no obligation to disclose. But the second part is coercion. x itself might also constitute a crime.
- Rexxar 6y ago
  Using an "if" doesn't mean coercion if first action is legitimate - I'm going to refuse your offer if you don't propose something better. - I'm going to work on it if you don't want to - I'm going to eat the cake if don't like it
  - ineedasername 6y ago
    Not quite. Let's say I know you're cheating on your partner: I can tell the partner, and that's legally fine. But if I say "I'm going to tell the partner if you don't pay me $7500" then that is not fine, even though the first action is legitimate. Coercion really is quite a bit about the second part as well. I'm not sure if this rule would cover all coercion/blackmail, but a rule like the following is probably a good guideline: If the first part negatively impacts the "victim" while the second part positively impacts the other person, it's might be getting close to coercion territory. Let's take your cake example: The person with the cake isn't really negatively impacted. If they don't like the cake, they aren't materially harmed by someone else eating it. Although even there, context matters: Let's say you're a baker, and you sell cakes, even ones that you don't like yourself (maybe you hate buttercream icing). Taking your cake and eating it when you might otherwise have sold the cake and made money would be a problem.
  - pgayed 6y ago
    ? It is coercion. But not all coercion is criminal.
HomeDeLaPot 6y ago
I suppose the illegal part would be the student threatening to disclose the vulnerability to others if you didn't pay. That seems like crossing the line into blackmail and being an accomplice of whoever he discloses to. But the student wouldn't be legally obligated to inform you of a vulnerability, and it wouldn't make sense to if you weren't willing to pay. I can see the difficulty though, I guess you'd need to have his identity so you could legally pursue him if there was no vulnerability and he ran away with the money. Or maybe you could write up some sort of contract requiring an in-person demonstration...
- phkahler 6y ago
  >> student wouldn't be legally obligated to inform you of a vulnerability, and it wouldn't make sense to if you weren't willing to pay. Which leads to a very interesting situation in negotiating. It's not the first time someone tried to sell information or an idea without getting ripped off. But how can one agree the value of information without knowing it. Is there a standard word or phrase to describe that situation?
  - kortilla 6y ago
    Finder’s fee
  - flagrant 6y ago
    Sounds like a standard Catch-22.
  - unishark 6y ago
    perhaps a third party both sides trust is hired to appraise the value
    - foepys 6y ago
      Those things already exist but ultimately bugs and exploits are too niche. A trusted third party cannot rule by themselves but is always required to ask both sides about the bug's impact. Since both sides try to frame it as both high and low impact at the same time, you make both parties unhappy in the most cases and become untrusted.
ykevinator 6y ago
Right because Facebook would never exploit you.
throwitaway1235 6y ago
I don't think demanding a sum of money for a problem that you personally solved could be considered blackmail. I'm not an attorney though.
jahewson 6y ago
There’s no harm in making a demand. It’s adding “or else” that would get you in trouble. In this case that would be extortion.
lr4444lr 6y ago
IANAL, but it definitely sounds like he's painting a target on himself for civil damages if someone else hacks you by using an exploit he shared.
- kortilla 6y ago
  Good luck proving that.

rhexs 6y ago

Unless litigating students is something your startup is interested in, I’d recommend ignoring that line of thinking and just hiring a good pen tester for a few months.

EGreg 6y ago
It’s really hard to say what something is worth if you are only allowed to sell it to one buyer. No competition between buyers. The only leverage is releasing the info and screwing a lot of people. (Also sucks that you can release it anyway. But you do want to source these vulnerabilities from the world at large.) Yet another reason why open source and collaboration may be better than capitalism and competition. Many hands make light work, with enough eyes all bugs are shallow, and all that. (To be fair, open source lacks security by obscurity so a project becomes secure after many years and developers join it.)

ericjang 6y ago

Rather than the exploiter setting an arbitrary price (which would be closer to blackmail), I think parent comment was saying that the fair market value of disclosing such a bug was worth closer to $75k given the unique skill set required. Skilled engineers turn to cybercrime when white-hat bounties are insufficiently rewarding, so it is in everyone's interest to pay competitive rates for finding security vulnerabilities.

singingfish 6y ago
Which is essentially market driven blackmail as far as I can see. Once I meet my new neighbours (one of whom is a moral philosopher by trade) I might ask about how to assess if that's ok. Personally it feels somewhat ok to me, speaking as someone who's built industrial espionage for money.
- phkahler 6y ago
  >> Which is essentially market driven blackmail as far as I can see. Modern medicine can also be like blackmail. Nobody has to actually threaten you, but nature will kill you unless you pay whatever the price of treatment. That's why we need competition, and why pharma companies like monopolies.
  - singingfish 6y ago
    Here in Australia the state funds most medical care. In this case the blackmail vector, if we use that interpretation is the taxation system.
    - sjwright 6y ago
      And we (Australia) blackmail drug makers: sell your drugs to us at a certain price and the Government will heavily subside it and you’ll get big sales. Refuse and it will get zero subsidy and nobody will buy it. https://en.m.wikipedia.org/wiki/Pharmaceutical_Benefits_Scheme https://en.m.wikipedia.org/wiki/Pharmaceutical_Benefits_Sche...
      - webmaven 6y ago
        > And we (Australia) blackmail drug makers: sell your drugs to us at a certain price and the Government will heavily subside it and you’ll get big sales. Refuse and it will get zero subsidy and nobody will buy it. The blackmail version is actually "Refuse, and we'll produce a generic version locally and perhaps even export it to any country that wants it." https://www.wired.com/2006/12/indiadrug/ https://www.wired.com/2006/12/indiadrug/

pgayed 6y ago

It’s that second part. “I’m going to do x if you don’t y.” He’s under no obligation to disclose. But the second part is coercion. x itself might also constitute a crime.

Rexxar 6y ago
Using an "if" doesn't mean coercion if first action is legitimate - I'm going to refuse your offer if you don't propose something better. - I'm going to work on it if you don't want to - I'm going to eat the cake if don't like it
- ineedasername 6y ago
  Not quite. Let's say I know you're cheating on your partner: I can tell the partner, and that's legally fine. But if I say "I'm going to tell the partner if you don't pay me $7500" then that is not fine, even though the first action is legitimate. Coercion really is quite a bit about the second part as well. I'm not sure if this rule would cover all coercion/blackmail, but a rule like the following is probably a good guideline: If the first part negatively impacts the "victim" while the second part positively impacts the other person, it's might be getting close to coercion territory. Let's take your cake example: The person with the cake isn't really negatively impacted. If they don't like the cake, they aren't materially harmed by someone else eating it. Although even there, context matters: Let's say you're a baker, and you sell cakes, even ones that you don't like yourself (maybe you hate buttercream icing). Taking your cake and eating it when you might otherwise have sold the cake and made money would be a problem.
- pgayed 6y ago
  ? It is coercion. But not all coercion is criminal.

HomeDeLaPot 6y ago

I suppose the illegal part would be the student threatening to disclose the vulnerability to others if you didn't pay. That seems like crossing the line into blackmail and being an accomplice of whoever he discloses to. But the student wouldn't be legally obligated to inform you of a vulnerability, and it wouldn't make sense to if you weren't willing to pay. I can see the difficulty though, I guess you'd need to have his identity so you could legally pursue him if there was no vulnerability and he ran away with the money. Or maybe you could write up some sort of contract requiring an in-person demonstration...

phkahler 6y ago
>> student wouldn't be legally obligated to inform you of a vulnerability, and it wouldn't make sense to if you weren't willing to pay. Which leads to a very interesting situation in negotiating. It's not the first time someone tried to sell information or an idea without getting ripped off. But how can one agree the value of information without knowing it. Is there a standard word or phrase to describe that situation?
- kortilla 6y ago
  Finder’s fee
- flagrant 6y ago
  Sounds like a standard Catch-22.
- unishark 6y ago
  perhaps a third party both sides trust is hired to appraise the value
  - foepys 6y ago
    Those things already exist but ultimately bugs and exploits are too niche. A trusted third party cannot rule by themselves but is always required to ask both sides about the bug's impact. Since both sides try to frame it as both high and low impact at the same time, you make both parties unhappy in the most cases and become untrusted.

ykevinator 6y ago

Right because Facebook would never exploit you.

throwitaway1235 6y ago

I don't think demanding a sum of money for a problem that you personally solved could be considered blackmail. I'm not an attorney though.

jahewson 6y ago

There’s no harm in making a demand. It’s adding “or else” that would get you in trouble. In this case that would be extortion.

lr4444lr 6y ago

IANAL, but it definitely sounds like he's painting a target on himself for civil damages if someone else hacks you by using an exploit he shared.

kortilla 6y ago
Good luck proving that.