4 ms·

These sites really bother me sometimes. I just registered on Dehashed and it requires me to pay for a subscription... to see my own stolen data. I reject that o

by geddy 7y ago

These sites really bother me sometimes. I just registered on Dehashed and it requires me to pay for a subscription... to see my own stolen data. I reject that on principle alone.

dijit 7y ago
Mostly so it’s not abused my script kiddies. If you want to see if you are in a breach it will tell you but just censor the password if it has been successfully reversed. Haveibeenpwned is the same but doesn’t reverse the passwords.
- goatsi 7y ago
  The only difference I can see between them and businesses that have gotten people sent to prison [0] is a slight change in the marketing materials. Dehashed even advertises taking Cryptocurrency payments for "unlimited searches". [0]https://www.zdnet.com/article/company-behind-leakedsource-pleads-guilty-in-canada/ https://www.zdnet.com/article/company-behind-leakedsource-pl...
  - ThrowAway99122 7y ago
    Guy mentioned in the article here using a throwaway (I'm active on this site). Never went to trial, never went to prison, charges were withdrawn. > An investigation by infosec journalist Brian Krebs claimed that a second suspect, a US man named Jeremy Wade, was also behind the service. He was never charged According to American prosecutors, freedom of speech prevents prosecution in America without intent to commit a crime.
    - goatsi 7y ago
      I wouldn't bet your freedom on it. The FBI was involved in taking down a similar website just last week [0]. I'm sure they have a solid legal basis for it. [0] https://nationalcrimeagency.gov.uk/news/weleakinfo-com-site-hosting-stolen-credentials-taken-down-after-international-operation https://nationalcrimeagency.gov.uk/news/weleakinfo-com-site-...
      - ThrowAway99122 7y ago
        I'm sure they did have a solid basis. The FBI statutes referenced are forfeiture related and don't describe the underlying crime they are accused of, and I'm not familiar with UK or NL law where the accused are located. USA is ironically the only country I would hypothetically bet freedom on to operate such a website not that I need/want to, if it's done without intent to defraud. I'll reply why to a lower comment but the fact that no Americans were able to be charged is a good start.
    - lazyasciiart 7y ago
      That doesn't sound accurate. After all, ignorance is no excuse and ignorance of the crime guarantees lack of intent to commit it.
      - ThrowAway99122 7y ago
        The most relevant section of US criminal law I'm told is 1030 6a which reads: >(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— >(A) such trafficking affects interstate or foreign commerce; or >(B) such computer is used by or for the Government of the United States; The key text here is with intent to defraud as an element of the offense. Prosecutors in the USA must prove beyond a reasonable doubt that you had intent to defraud. This language is very clear due to the first amendment and they cannot speculate nor can they say ignorance alone proves intent. Obviously my earlier post of "without intent to commit a crime" was wrong, but should have read "without intent to defraud".
        lazyasciiart 7y ago
        I don’t know why they would have told you this, this isn’t really anything to do with the first amendment. virtually identical laws exist in many countries. Edit: I just realized that you said prosecutors told you this. My guess is they lied so that you’d do it again when they were watching.

by geddy 7y ago

These sites really bother me sometimes. I just registered on Dehashed and it requires me to pay for a subscription... to see my own stolen data. I reject that on principle alone.

dijit 7y ago

Mostly so it’s not abused my script kiddies. If you want to see if you are in a breach it will tell you but just censor the password if it has been successfully reversed. Haveibeenpwned is the same but doesn’t reverse the passwords.

goatsi 7y ago
The only difference I can see between them and businesses that have gotten people sent to prison [0] is a slight change in the marketing materials. Dehashed even advertises taking Cryptocurrency payments for "unlimited searches". [0]https://www.zdnet.com/article/company-behind-leakedsource-pleads-guilty-in-canada/ https://www.zdnet.com/article/company-behind-leakedsource-pl...
- ThrowAway99122 7y ago
  Guy mentioned in the article here using a throwaway (I'm active on this site). Never went to trial, never went to prison, charges were withdrawn. > An investigation by infosec journalist Brian Krebs claimed that a second suspect, a US man named Jeremy Wade, was also behind the service. He was never charged According to American prosecutors, freedom of speech prevents prosecution in America without intent to commit a crime.
  - goatsi 7y ago
    I wouldn't bet your freedom on it. The FBI was involved in taking down a similar website just last week [0]. I'm sure they have a solid legal basis for it. [0] https://nationalcrimeagency.gov.uk/news/weleakinfo-com-site-hosting-stolen-credentials-taken-down-after-international-operation https://nationalcrimeagency.gov.uk/news/weleakinfo-com-site-...
    - ThrowAway99122 7y ago
      I'm sure they did have a solid basis. The FBI statutes referenced are forfeiture related and don't describe the underlying crime they are accused of, and I'm not familiar with UK or NL law where the accused are located. USA is ironically the only country I would hypothetically bet freedom on to operate such a website not that I need/want to, if it's done without intent to defraud. I'll reply why to a lower comment but the fact that no Americans were able to be charged is a good start.
  - lazyasciiart 7y ago
    That doesn't sound accurate. After all, ignorance is no excuse and ignorance of the crime guarantees lack of intent to commit it.
    - ThrowAway99122 7y ago
      The most relevant section of US criminal law I'm told is 1030 6a which reads: >(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— >(A) such trafficking affects interstate or foreign commerce; or >(B) such computer is used by or for the Government of the United States; The key text here is with intent to defraud as an element of the offense. Prosecutors in the USA must prove beyond a reasonable doubt that you had intent to defraud. This language is very clear due to the first amendment and they cannot speculate nor can they say ignorance alone proves intent. Obviously my earlier post of "without intent to commit a crime" was wrong, but should have read "without intent to defraud".
      - lazyasciiart 7y ago
        I don’t know why they would have told you this, this isn’t really anything to do with the first amendment. virtually identical laws exist in many countries. Edit: I just realized that you said prosecutors told you this. My guess is they lied so that you’d do it again when they were watching.