Encrypted messaging startup Wickr offers $100K bug bounty

The company hopes to tap the security research community to find potential problems

Two-year-old startup Wickr is offering a reward of up to US$100,000 to anyone who can find a serious vulnerability in its mobile encrypted messaging application, which is designed to thwart spying by hackers and governments.

The reward puts the small company in the same league as Google, Facebook and Microsoft, all of which offer substantial payouts to security researchers for finding dangerous bugs that could compromise their users' data.

Wickr has already closely vetted its application so the challenge could be tough. Veracode, an application security testing company, and Stroz Friedberg, a computer forensics firm, have reviewed the software, in addition to independent security researchers.

In a statement, Wickr said "we expect finding critical vulnerabilities in Wickr to be difficult and are honored to work with those that do."

Companies benefit from these bug bounty programs because they create an incentive for a large number of engineers with various types and levels of expertise to test their applications. It can be a better investment than hiring full-time staff, according to one study.

Wickr said vulnerabilities that substantially affect the confidentiality or integrity of user data could qualify for the maximum reward. Less severe bugs could garner a researcher $10,000 or more. Researchers are required not to publicize their discoveries for three months without written permission, giving Wickr time to review and fix potential issues. Bug information should be sent to bugbounty@mywickr.com.

Messages sent through Wickr are encrypted on the mobile device. Although the scrambled data passes through Wickr's servers, Wickr does not have a key to decrypt the content. A message can be tagged with an expiry date that causes it to be erased on the recipient's phone after a specific time.

Wickr, based in San Francisco, promotes its application, which runs on iOS and Android, as a safe way to send messages, photos, files and video. Since it does not retain data on its servers, the company maintains it would be unable to turn over users' data to law enforcement.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Tags WickrsecurityencryptionExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?