4 ms·
At least non-admin XSS is much harder to define as "hacking" by a judge. Otherwise, writing something like "Send your password to ha@ck.er plz!" would be consid
by homakov 11y ago
At least non-admin XSS is much harder to define as "hacking" by a judge. Otherwise, writing something like "Send your password to ha@ck.er plz!" would be considered severe hacking attempt too.
- tptacek 11y agoI don't know what country you're referring to, but in US criminal law, there is no such thing as "hacking". There is only unauthorized use. Cases will turn on whether you should have known that your use of the site while testing for security bugs was unauthorized (short answer: yes, you should have known), and whether it caused damage. But that's criminal law. That's a real concern, but the bigger concern is tort law. If you blow up someone's site by getting an XSS input cached and replayed to all its users (or, heck, even if you just cause an alarm that they have spend money responding to), you are going to be liable.
- homakov 11y agoThat's true. I myself would never poke around some corp. website w/o a bounty program
- jacquesm 11y agoThen please don't indirectly tell others it is ok to do so. You could cause a lot of trouble for someone who sees you as an authority figure. Of course 'homakov said it was ok' is not a very good defense, but still, better not to encourage dumb/bad behavior.