2 ms·

I'd argue the most interesting and important research is done in this way. It's not that these security experts "don't care", it's just the very nature of certa

I'd argue the most interesting and important research is done in this way. It's not that these security experts "don't care", it's just the very nature of certain problems that you need to test them against real users (as opposed to, say, testing an exploit against a system). Consider, for example, honeypot research the very nature of such scenarios is that you can't even hint that users are tracked, let alone asking their consent.

tralarpa 8y ago
The legal aspects of honeypots were discussed a lot when they became popular. Just two examples: https://www.symantec.com/connect/articles/honeypots-are-they-illegal https://www.symantec.com/connect/articles/honeypots-are-they... https://www.researchgate.net/profile/William_Yurcik/publication/3955168_Internet_honeypots_protection_or_entrapment/links/0deec53b570e0f0b3e000000.pdf https://www.researchgate.net/profile/William_Yurcik/publicat... And they are still discussed, for example in the light of the new EU laws: https://jis-eurasipjournals.springeropen.com/articles/10.1186/s13635-017-0057-4 https://jis-eurasipjournals.springeropen.com/articles/10.118...
- dvfjsdhgfv 8y ago
  And they show quite well you can't have the cake and eat it. For example, Spitzner suggests displaying a banner... With all due respect, it's ridiculous. The whole point of this game is to make the attacker believe they're attacking the real system, not to make sure they "waive their privacy rights." I don't think anyone serious about really analyzing the behavior of attackers would ever care about these things. What is more dangerous is if a honeypot is used to attack another resource and you're sued by the owner, for example. It's really hard to avoid breaking a couple of eggs, no matter how you try.
tralarpa 8y ago
> I'd argue the most interesting and important research is done in this way Links please :)
- dvfjsdhgfv 8y ago
  I'm sorry, I don't think I can provide any links. As an example, imagine you found out about Stuxnet much earlier before the general public.

tralarpa 8y ago

The legal aspects of honeypots were discussed a lot when they became popular. Just two examples: https://www.symantec.com/connect/articles/honeypots-are-they-illegal https://www.symantec.com/connect/articles/honeypots-are-they... https://www.researchgate.net/profile/William_Yurcik/publication/3955168_Internet_honeypots_protection_or_entrapment/links/0deec53b570e0f0b3e000000.pdf https://www.researchgate.net/profile/William_Yurcik/publicat... And they are still discussed, for example in the light of the new EU laws: https://jis-eurasipjournals.springeropen.com/articles/10.1186/s13635-017-0057-4 https://jis-eurasipjournals.springeropen.com/articles/10.118...

dvfjsdhgfv 8y ago
And they show quite well you can't have the cake and eat it. For example, Spitzner suggests displaying a banner... With all due respect, it's ridiculous. The whole point of this game is to make the attacker believe they're attacking the real system, not to make sure they "waive their privacy rights." I don't think anyone serious about really analyzing the behavior of attackers would ever care about these things. What is more dangerous is if a honeypot is used to attack another resource and you're sued by the owner, for example. It's really hard to avoid breaking a couple of eggs, no matter how you try.

tralarpa 8y ago

> I'd argue the most interesting and important research is done in this way Links please :)

dvfjsdhgfv 8y ago
I'm sorry, I don't think I can provide any links. As an example, imagine you found out about Stuxnet much earlier before the general public.