In security, there's often no choice but to rely on leaked data. There is generally no other source of things like password hashes reflecting real-world user pa

In security, there's often no choice but to rely on leaked data. There is generally no other source of things like password hashes reflecting real-world user passwords. So the question then becomes "Is it ethically appropriate to perform security research that requires realistic data at all?". With the caveat that blackhats can and will do research and use the results privately no matter what the rest of us do. What do you think?