Executive Summary (TL;DR): HackerOne requires SMS, documentation is bad, and support doesn't.
"Please let us know your HackerOne email address", I was asked. Everyone (who matters) knows HackerOne ( @Hacker0x01 ?), so I rush to https://hackerone.com/ to sign up.
Signup was typical, with praiseworthy indication that passwords are limited to the BCrypt hash limit of 72 characters. With email confirmed, the next step was of course to set up 2FA because if we Hackers™ know one thing, it's "2FA good. TOTP good. SMS bad.". On the Account Security page,
Two-factor authentication [ Turn on ]
but that [ Turn on ] button is greyed out. Above is
Account recovery: Disabled [ Set up ]
A bit odd to get recovery codes before setting up TOTP, but seems harmless. I clicked [ Set up ].
Add your phone number
We need to set up a way for you to recover your account in case you lose access to your two-factor
authentication device. We do this by confirming your phone number. We'll send you a numeric code
to this number to verify your account. Message and data rates may apply.
In this year of our Lord twenty twenty-five, that is the only option.
Before bothering anyone, I know to RTFM, so I do. The "Two-Factor Authentication" page described the setup process in full detail with no mention of telephones or short message services. The other (almost identical) "Two-Factor Authentication" page described the same process, but mentions the telephone.
HackerOne uses a (something)Desk platform for support, so I signed up there and opened an issue explaining that I want to use TOTP and don't use SMS, and that there are two pages with instructions of which half are wrong. The automated email acknowledgement arrived promptly.
Early the next day email arrived from H1 Support <[email protected]> with a response I can accurately paraphrase as, "We are sorry to hear that you are incompetent. Please RTFM." with a link to the more accurate of the two pages. Replying to this email, I politely explained that I appreciated the response, but that they seem to have missed both the issue I reported and the documentation problem, then clearly identified each in a more structured fashion.
The reply to my email was almost instant.
#HackerOne #Hacker1 #BugBounty #ResponsibleDisclosure #Authentication #2FA #MFA #TOTP #SMS #InfoSec #InformationSecurity #CyberSecurity #TogetherWeHitHarder
