My Callsign Is My Passport Responsible Testing & Disclosure Of Amateur Radio Websites

Amateur radio websites / web applications are notorious for terrible / non-existence information security practices and there’s normally no budget to get professional help. Meanwhile, there’s a large overlap in the Venn Diagram circles of infosec talent and amateur radio licensees. Leveraging our callsigns as AuthN and establishing mutual trust, we’ve developed a loose framework for how the hacker community can provide infosec consulting as a volunteer service, helping the hobby level up their security practices (or at least clean up some of the low hanging fruit). This talk walks through an example where this concept was applied, what was learned in the process, and reflections on how this could be leveraged by the broader community.