What should I do when I find a bug in someone else's IP?

Question

Information Security

Good afternoon,
I registered on the website of some foreign government organization. I tried to recover the password - and the password came to me in a letter in clear text. That is, the password is stored in the database in unencrypted form. This is an obvious gap in terms of information security!
What should I do next? Write to this organization with a request to change the data storage format? Is it such a terrible mess?

Answer 1

> That is, the password is stored in the database in unencrypted form
. Nobody prevented the server from decrypting the password from md5. So it is impossible to say how they are stored there.

Answer 2

Send them an email and tell them about the problem.

Answer 3

You don’t know how it is stored in the database until you see the database, maybe it’s encrypted there: they got it, decrypted it and sent it to you in a letter)) But the fact that they send it in clear form in a letter and don’t give a link to recovery is, of course, a little bit unsafe .

Answer 4

Option 1:
Write a letter. Most likely they will ignore, if they do not ignore, then they will not answer. If they do, they won't fix it.
Option 2:
Accept the imperfection of the world.
Alas and ah, millions and millions of services send an email with a password in clear text (although this, in itself, is much less secure than storing it in the database in clear text).
Some even come with the answer to a security question.
Why? The answer is simple: everyone, to put it mildly, is not particularly excited about this fact.
Option 3:
Exploit this vulnerability, obtain data not intended for you, contact Security Council and explain.
There is a high probability of getting lyuli.
I also note that in most cases, storing the password in clear text is not the most serious vulnerability.

Answer 5

Write a script that exploits this vulnerability. Unload a large database login-password + metadata. Further, the option is either to use it illegally and probably be punished, or to provide it to the Security Council, preferably to higher posts, or directly to go to leadership positions.
If you manage to exploit the vulnerability (which I strongly doubt) and the organization is not stupid, you will make the information security world a little better and (or) earn money, but not a fact.

Answer 6

It's not exactly a bug. Sending a password in clear text is not good, of course, but not fatal.
Encrypted data is stored in the database itself, not by a complicated method, but still, and before using it, I just decrypt it) ..
Although I don’t have passwords at all :D