4 ms·

wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?

ihsw 10y ago
> binding exception Two words -- honor code. Rock the boat and you will find yourself in an unpleasant situation, so instead everybody does good work and nobody asks too many questions.
- AYBABTME 10y ago
  Honor codes for stuff that traditionally involve corporations going after individuals for criminal charges. I feel that's a bit of a crazy proposition.
  - jessaustin 10y ago
    Most people would probably expect Pornhub to be more honorable than e.g. AT&T...
  - mdholloway 10y ago
    Crazy indeed, but it happens to be the case. http://blog.erratasec.com/2015/05/how-to-fix-cfaa.html http://blog.erratasec.com/2015/05/how-to-fix-cfaa.html
  - smt88 10y ago
    When people say "honor code" around me, it usually means, "Do something honorable, even though it's against your self interest." For both white hats and Pornhub, the legal/authorized bounty system is in their interest. White hats are making less money than some black hats, but they're not constantly terrified of being prosecuted under intense anti-hacking laws. Pornhub is spending a lot less than they would if they were hacked by black hats. Both parties win.
celticninja 10y ago
Pornhub have active bug bounties. In general you have to sign up to abide by the rules, which generally say how far you can take an exploit, ie prove it works but don't fuck with the actual data just to show you can. Your exploit would show that you could and that's what they want you to do.
deleted 10y ago
[deleted]
Buge 10y ago
In the US the law is against unauthorized access. If a company agrees to let people try to hack their stuff, then the access is authorized and legal.
- seanp2k2 10y ago
  To what extent? What if you do something on accident that ends up messing up their stuff? Just the first example I can think of: you figure out a way to reboot an instance which lets you exploit a race condition in some auth code, and don't realize that the instance you're killing is critical for some other function (let's say billing) and you end up causing some real monetary damage, even though you had no idea. Are there any legal precedents for this?
  - hueving 10y ago
    It's in the agreement with you and the company. Usually it says if you cause a side effect like that you are at fault.
corobo 10y ago
If they prosecute a white hat there will only be black hats left. It's not a legal perspective but it keeps the honour code working.
- cloudjacker 10y ago
  ehhhhh, a real answer here dictates whether I sign up to hackerone on TOR and request bitcoin payouts, or if I do it on clearnet, fill out 1099s with my real/entity name, and link my bank accounts

ihsw 10y ago

> binding exception Two words -- honor code. Rock the boat and you will find yourself in an unpleasant situation, so instead everybody does good work and nobody asks too many questions.

AYBABTME 10y ago
Honor codes for stuff that traditionally involve corporations going after individuals for criminal charges. I feel that's a bit of a crazy proposition.
- jessaustin 10y ago
  Most people would probably expect Pornhub to be more honorable than e.g. AT&T...
- mdholloway 10y ago
  Crazy indeed, but it happens to be the case. http://blog.erratasec.com/2015/05/how-to-fix-cfaa.html http://blog.erratasec.com/2015/05/how-to-fix-cfaa.html
- smt88 10y ago
  When people say "honor code" around me, it usually means, "Do something honorable, even though it's against your self interest." For both white hats and Pornhub, the legal/authorized bounty system is in their interest. White hats are making less money than some black hats, but they're not constantly terrified of being prosecuted under intense anti-hacking laws. Pornhub is spending a lot less than they would if they were hacked by black hats. Both parties win.

celticninja 10y ago

Pornhub have active bug bounties. In general you have to sign up to abide by the rules, which generally say how far you can take an exploit, ie prove it works but don't fuck with the actual data just to show you can. Your exploit would show that you could and that's what they want you to do.

deleted 10y ago

[deleted]

Buge 10y ago

In the US the law is against unauthorized access. If a company agrees to let people try to hack their stuff, then the access is authorized and legal.

seanp2k2 10y ago
To what extent? What if you do something on accident that ends up messing up their stuff? Just the first example I can think of: you figure out a way to reboot an instance which lets you exploit a race condition in some auth code, and don't realize that the instance you're killing is critical for some other function (let's say billing) and you end up causing some real monetary damage, even though you had no idea. Are there any legal precedents for this?
- hueving 10y ago
  It's in the agreement with you and the company. Usually it says if you cause a side effect like that you are at fault.

corobo 10y ago

If they prosecute a white hat there will only be black hats left. It's not a legal perspective but it keeps the honour code working.

cloudjacker 10y ago
ehhhhh, a real answer here dictates whether I sign up to hackerone on TOR and request bitcoin payouts, or if I do it on clearnet, fill out 1099s with my real/entity name, and link my bank accounts