5 ms·

This is really a good example why it is so difficult for security experts to do research and experiments where real users are involved. What Mr. Petrovic did i

This is really a good example why it is so difficult for security experts to do research and experiments where real users are involved. What Mr. Petrovic did is illegal in most developed countries: copyright violation (copying web pages) and monitoring and storing user behavior without their consent (and, even worse, by phishing). It doesn't matter that he did it for a "very brief period of time (for ethical reasons)". LOL. If I tried this kind of stuff where I work, I would have a long unpleasant talk with our legal/ethics department afterwards. I cannot even do a network scan in the Internet without first notifying God and a couple of lesser gods. I am also wondering whether that's good publicity for the author's company. The author is basically saying: "We are doing things without being fully aware (or without caring) of the legal consequences. Are you sure you want to be our customer?".

dvfjsdhgfv 8y ago
When you do security work, that's an important part of your job. Sure, in many scenarios like traditional pentesting you can probably do fine within the legal boundaries in most jurisdictions, but as soon as you do serious security research when you actually test your ideas in practice, you're likely to cross the line sooner or later. It's a difference between "it should probably work" and "yes, it worked, I tried it." If you're afraid of the latter, don't get involved in security as you'll get burned sooner than later.
- tralarpa 8y ago
  > you're likely to cross the line sooner or later. That's basically the opposite of what security researchers working for companies and research institutes are doing. Document everything, get written consent of involved parties and sometimes even inform the police about a planned action. Make sure that you (a) don't cross the line or (b) move the line legally further away. Of course, there are security experts who don't care about that. But they usually don't publish their results on a website with their real name.
  - dvfjsdhgfv 8y ago
    I'd argue the most interesting and important research is done in this way. It's not that these security experts "don't care", it's just the very nature of certain problems that you need to test them against real users (as opposed to, say, testing an exploit against a system). Consider, for example, honeypot research the very nature of such scenarios is that you can't even hint that users are tracked, let alone asking their consent.
    - tralarpa 8y ago
      The legal aspects of honeypots were discussed a lot when they became popular. Just two examples: https://www.symantec.com/connect/articles/honeypots-are-they-illegal https://www.symantec.com/connect/articles/honeypots-are-they... https://www.researchgate.net/profile/William_Yurcik/publication/3955168_Internet_honeypots_protection_or_entrapment/links/0deec53b570e0f0b3e000000.pdf https://www.researchgate.net/profile/William_Yurcik/publicat... And they are still discussed, for example in the light of the new EU laws: https://jis-eurasipjournals.springeropen.com/articles/10.1186/s13635-017-0057-4 https://jis-eurasipjournals.springeropen.com/articles/10.118...
      - dvfjsdhgfv 8y ago
        And they show quite well you can't have the cake and eat it. For example, Spitzner suggests displaying a banner... With all due respect, it's ridiculous. The whole point of this game is to make the attacker believe they're attacking the real system, not to make sure they "waive their privacy rights." I don't think anyone serious about really analyzing the behavior of attackers would ever care about these things. What is more dangerous is if a honeypot is used to attack another resource and you're sued by the owner, for example. It's really hard to avoid breaking a couple of eggs, no matter how you try.
    - tralarpa 8y ago
      > I'd argue the most interesting and important research is done in this way Links please :)
- PeterisP 8y ago
  In this particular example there's absolutely nothing that required touching or duplicating the sites of others, the same PoC would work just as well without using a "competitor's website", it could be tested in practice simply by using multiple domains/sites that you fully own.
Quarrelsome 8y ago
he hasn't done it for a brief period of time, the article says he's run for five years on one of his disposable domains?

dvfjsdhgfv 8y ago

When you do security work, that's an important part of your job. Sure, in many scenarios like traditional pentesting you can probably do fine within the legal boundaries in most jurisdictions, but as soon as you do serious security research when you actually test your ideas in practice, you're likely to cross the line sooner or later. It's a difference between "it should probably work" and "yes, it worked, I tried it." If you're afraid of the latter, don't get involved in security as you'll get burned sooner than later.

tralarpa 8y ago
> you're likely to cross the line sooner or later. That's basically the opposite of what security researchers working for companies and research institutes are doing. Document everything, get written consent of involved parties and sometimes even inform the police about a planned action. Make sure that you (a) don't cross the line or (b) move the line legally further away. Of course, there are security experts who don't care about that. But they usually don't publish their results on a website with their real name.
- dvfjsdhgfv 8y ago
  I'd argue the most interesting and important research is done in this way. It's not that these security experts "don't care", it's just the very nature of certain problems that you need to test them against real users (as opposed to, say, testing an exploit against a system). Consider, for example, honeypot research the very nature of such scenarios is that you can't even hint that users are tracked, let alone asking their consent.
  - tralarpa 8y ago
    The legal aspects of honeypots were discussed a lot when they became popular. Just two examples: https://www.symantec.com/connect/articles/honeypots-are-they-illegal https://www.symantec.com/connect/articles/honeypots-are-they... https://www.researchgate.net/profile/William_Yurcik/publication/3955168_Internet_honeypots_protection_or_entrapment/links/0deec53b570e0f0b3e000000.pdf https://www.researchgate.net/profile/William_Yurcik/publicat... And they are still discussed, for example in the light of the new EU laws: https://jis-eurasipjournals.springeropen.com/articles/10.1186/s13635-017-0057-4 https://jis-eurasipjournals.springeropen.com/articles/10.118...
    - dvfjsdhgfv 8y ago
      And they show quite well you can't have the cake and eat it. For example, Spitzner suggests displaying a banner... With all due respect, it's ridiculous. The whole point of this game is to make the attacker believe they're attacking the real system, not to make sure they "waive their privacy rights." I don't think anyone serious about really analyzing the behavior of attackers would ever care about these things. What is more dangerous is if a honeypot is used to attack another resource and you're sued by the owner, for example. It's really hard to avoid breaking a couple of eggs, no matter how you try.
  - tralarpa 8y ago
    > I'd argue the most interesting and important research is done in this way Links please :)
PeterisP 8y ago
In this particular example there's absolutely nothing that required touching or duplicating the sites of others, the same PoC would work just as well without using a "competitor's website", it could be tested in practice simply by using multiple domains/sites that you fully own.

Quarrelsome 8y ago

he hasn't done it for a brief period of time, the article says he's run for five years on one of his disposable domains?