About the Author

Chris Shiflett

Hi, I’m Chris: entrepreneur, community leader, husband, and father. I live and work in Boulder, CO.

PayPal Groks Security?

Via Jeremiah, I see that PayPal's new vulnerability disclosure policy includes an amnesty clause for well-intentioned security researchers:

To encourage responsible disclosure, we commit that - if we conclude that a disclosure respects and meets all the guidelines outlined below - we will not bring a private action or refer a matter for public inquiry.

Their guidelines include some subjective language, so I'm not sure how much protection this policy actually offers. (Any lawyers want to clarify?) Here they are:

  • Share the security issue with us before making it public on message boards, mailing lists, and other forums.

  • Allow us reasonable time to respond to the issue before disclosing it publicly.

  • Provide full details of the security issue.

PayPal also describes what not to do:

  • Potential or actual denial of service of PayPal applications and systems.

  • Use of an exploit to view data without authorization, or corruption of data.

  • Requests for direct compensation for the reporting of security issues either to PayPal, or through any external marketplace for vulnerabilities, whether black-market or otherwise.

If you're like me, some questions come to mind. How much time is reasonable? Since data can be anything, how do we know if we view data without authorization? Don't most people assume they're authorized to view something if they're allowed to view it? Does intent matter?

Questions aside, here's hoping this is a genuine attempt to do the right thing. Thanks, PayPal.

To my fellow Americans, have a wonderful Thanksgiving holiday! To everyone else, have a nice rest of the week. :-)

About this post

PayPal Groks Security? was posted on Wed, 21 Nov 2007. If you liked it, follow me on Twitter or share:


1.Peter said:

Unfortunately as Paypal are owned by eBay I highly doubt that their intentions are good.

A couple of years ago I had my eBay account hacked and I managed to find an eBay phone number, they were more concerned about how I got their number than I was about the account being hacked. Whats more they told me account being hacked was not a security issue.

Wed, 21 Nov 2007 at 23:37:44 GMT Link

2.Andy Steingruebl said:

I have posted some commentary on the policy here:


I helped write the policy so hopefully my post will be useful.

Wed, 28 Nov 2007 at 19:05:52 GMT Link

Hello! What’s your name?

Want to comment? Please connect with Twitter to join the discussion.