- Jared Leto reportedly tried to stop ‘Joker’ from happening Sunday 4:12 PM
- People are grossed out by cow insemination-themed pregnancy announcement Sunday 3:13 PM
- Major protests in Lebanon triggered by plan to tax WhatsApp calls Sunday 1:38 PM
- Frank Ocean’s $60 HIV prevention drug-themed shirts called tone-deaf Sunday 12:49 PM
- ‘Joker’ stairs latest Instagram spot; locals joke about potential robberies Sunday 10:30 AM
- PewDiePie banned in China after reacting to Winnie the Pooh memes Sunday 8:46 AM
- How to stream Cowboys vs. Eagles on Sunday Night Football Sunday 7:00 AM
- How to stream Chargers vs. Titans in Week 7 Sunday 6:00 AM
- 13 spooky romance games for adults Sunday 6:00 AM
- How to stream ‘Power’ season 6, episode 9 Sunday 5:00 AM
- How to stream Impact Wrestling’s Bound For Glory Sunday 5:00 AM
- How to stream Bills vs. Dolphins in Week 7 Sunday 4:30 AM
- How to stream Jaguars vs. Bengals in Week 7 Sunday 4:00 AM
- How to stream Texans vs. Colts in Week 7 Sunday 3:00 AM
- How to stream Manchester United vs. Liverpool Saturday 10:00 PM
PayPal refuses to pay 17-year-old security researcher
When Robert Kugler reported a bug to PayPal, he was hoping to get paid as part of the company’s bounty program.
When Robert Kugler reported a bug to PayPal, he was hoping to get paid as part of the company’s bounty program. But the eBay-owned company rebuffed him. He was 17—underage.
On May 19, Kugler, a security researcher from Germany, notified PayPal of a cross-site scripting (XSS) flaw that would permit anyone who exploited it to steal sensitive information. For a site that deals in financial transactions, this is not an insignificant vulnerability.
According to PC World, eBay officials notified Kugler via email that because he was under 18, he was in violation of its guidelines for security researchers. It’s worth noting the company’s site doesn’t actually mention the age restriction.
For his part, Kugler believes PayPal’s actions are setting a bad precedent and that they’ll only discourage others from finding and reporting vulnerabilities.
“It’s not the best idea when you’re interested in motivated security researchers,” he wrote in his report on security researcher site Seclist.org.
UPDATE: PayPal denies that Kugler’s age was at issue. Actually, another researcher beat him to the punch. Here’s the company’s statement:
In this specific situation, the cross-site scripting vulnerability was already discovered by another security researcher, so [the bug] would not have been eligible for payment, regardless of age [of the researcher], as we must honor the original researcher that provided the vulnerability.
Photo via Liz Wise/Flickr
Fidel Martinez is a web culture and politics reporter. His work for the Daily Dot focused on Reddit and YouTube.