11 ms·
When you purposefully leak private data, you no longer get to hide behind the title "Security Researcher".
by thomastjeffery 6y ago
When you purposefully leak private data, you no longer get to hide behind the title "Security Researcher".
- RoyTyrell 6y agoWould it be any better if it was sent to Wikileaks and published there?
- coldtea 6y agoOnly if it the data was government / private sector data, not citizen messages
- newacct583 6y agoWhat exactly the difference between "private sector data" and "citizen messages"? Wikileaks published a ton of data from personal sources. Famously, the Podesta leak was from a private account and absolutely contained personal communication (about, again famously, a favored pizza joint).
- coldtea 6y ago>What exactly the difference between "private sector data" and "citizen messages"? That "fuck businesses", while "leave actual people ok".
- Agaliarept21 6y agoI think where most people would reasonably draw the line is in the level of political power a person has over matters which impact the public interest. While I personally disagree with the leaking of Podesta's emails, the amount of political power and relevance he has makes him somewhat of a public figure. He is not in anyway comparable to your average person. I do see a public good in providing this data to law enforcement, so that they can obtain evidence to build a case against the people who were involved. I however can not see any public good in potentially exposing random people to identity theft and criminal harassment for simply registering an account on a website. While people could make the argument that the site has culpability for what happened so this data must be exposed, to hold that position in good faith you would then also have to say that a leak of Twitter, Facebook, and Youtube users is also justifiable. Seeing as those platforms have held worse calls for violence than any other platforms. Parler isn't a website where all the users who register are guilty of espousing harmful rhetoric. I would agree that there are some websites that exist like Stormfront where that would definitely be the case, but ultimately Parler is simply an alternative social media site with more lax moderation than Twitter. That lax moderation unfortunately will attract a large number of bad actors who have been banned from other sites. However this still doesn't change that this site isn't anything but a social media site with a different philosophical opinion on how moderated speech on their platform should be. Which means a lot of innocent people with no political power will be harmed.
- whatshisface 6y agoHuh? Wikileaks is where people go to publish evidence of government crimes, not Granddad's chats with his friends.
- QuesnayJr 6y agoWikileaks leaked John Podesta's emails, including such criminal activity as his recipe for risotto.
- whatshisface 6y agoIt's generally a good idea for leakers to be selective about their releases (Snowden did a better job than Manning in that area IMO). I guess Wikileaks is between a rock and a hard place, because if they started editorializing then that would lead to political bias.
- diegocg 6y agoPolitical bias? Like when Wikileaks supported researching the Pizzagate conspiracy during the 2016 US election and posted links to /r/The_Donald "investigation" threads?
- BlueTemplar 6y agoThey sided against the US government (and with Russia) years ago.
- whatshisface 6y agoHas anyone leaked something about Russia that was then denied by Wikileaks? It could be that the US has a more active community of investigative journalists.
- QuesnayJr 6y agoApparently, yes: https://foreignpolicy.com/2017/08/17/wikileaks-turned-down-leaks-on-russian-government-during-u-s-presidential-campaign/ https://foreignpolicy.com/2017/08/17/wikileaks-turned-down-l...
- valvar 6y agoYes, because WikiLeaks is very diligent in scrubbing sensitive private information from leaks.
- BlueTemplar 6y agoThey aren't, or did they get much better at it in recent years?
- tootie 6y agoDidn't WikiLeaks publish the decryption key for the Manning leaks and all the unredacted messages got into the wild?
- dleslie 6y agoIIRC, that was the Guardian, who was provided the key in trust in order to help publish the data.
- 9387367 6y ago> Didn't WikiLeaks publish the decryption key for the Manning leaks and all the unredacted messages got into the wild? No. > WikiLeaks founder Julian Assange phoned the White House to warn lives would be put at risk by the publication of cables online, a court has heard. > On 25 August, 2011, German news outlet Der Freitag revealed that it was possible to access the unredacted database of cables by using a mirror site and a 58-key password that had been published in a book by The Guardian earlier in the year. https://www.independent.co.uk/news/world/americas/wikileaks-julian-assange-white-house-hillary-clinton-chelsea-manning-a9359191.html https://www.independent.co.uk/news/world/americas/wikileaks-...
- mike00632 6y agohttps://wikileaks.org/Guardian-journalist-negligently.html https://wikileaks.org/Guardian-journalist-negligently.html No. Wikileaks did indeed accidentally give out the decryption key to the encrypted trove they published from the Manning leaks. There is probably still a torrent available of the full, unredacted scrape of Secret data from the SIPR network.
- bdefore 6y agoI can think of one benefit of going through Wikileaks (or WaPo): there would be a review by experts of what is legal/responsible to share, redacting for example driver's license uploads.
- hannasanarion 6y agoWikileaks doesn't vet anything, their policy is to publish whatever they're given. That's why Snowden specifically didn't take the NSA leaks to them.
- ravel-bar-foo 6y agoOne of the interesting things to come out in Dec 2020 is evidence that Wikileaks offered the State Department advance warning when the encryption keys for the Iraq War Logs were about to be published by their collaborators at the Guardian. Prior to that, publication of the Iraq War Logs had been piecemeal as they redacted PII. https://news.antiwar.com/2020/12/16/recording-proves-assange-warned-state-department-ahead-of-cable-dump/ https://news.antiwar.com/2020/12/16/recording-proves-assange...
- j16sdiz 6y agohttps://www.britannica.com/topic/WikiLeaks https://www.britannica.com/topic/WikiLeaks >> WikiLeaks had originally followed a policy of redacting personal or sensitive information from documents prior to release,...
- Udik 6y agoIf you hack a source and send it to Wikileaks, do you qualify as "security researcher"? This is what we're taking about.
- varjag 6y agoWikileaks would never publish anything that hurts authoritarian cause, so it's highly hypothetical.
- JumpCrisscross 6y ago> Would it be any better if it was sent to Wikileaks and published there? Not really. If they had sent it to a journalistic organisation à la the Panama Papers, where e.g. curious peoples’ government IDs could be stripped and criminal activity highlighted, that would have be been different.
- newacct583 6y agoParler was ground zero for the community that announced and executed the attack on the capitol. Thought leaders there were routinely evoking, imagining, and outright calling for violence, and the crowd was a feedback loop. Fundamentally the Parler community existed to provide a platform for people who had been already banned from Twitter. Frankly the peaceful use of the site was mostly incidental. I think there's a real argument that this data is in the public interest.
- swalsh 6y agoI generally agree that information from here related to the attack is in the public interest. But this is going to also reveal people who had no part of it. I don't think it's fair to justify revealing innocent peoples data.
- newacct583 6y agoHow many "innocent" people were actually on Parler? It was a brand new service. It really was "Twitter for conservatives who got banned from Twitter". Almost literally everyone there was one of: 1. Someone who got banned from Twitter 2. Someone who wants to follow someone who got banned from Twitter 3. Someone (e.g. journalists) who want to follow all those people At what point does an online community become a danger to everyone? I'll note we had similar questions about much simpler services back in the days after 9/11, and the consensus opinion was very different then.
- redflame8 6y agoYou sound like the kid that couldnt understand why no one hungout with them
- BlueTemplar 6y agoThis is because the situation is also very different from 9/11 ?
- throwaway3699 6y agoYou can't be serious. There were literally millions of users on the platform.
- ForHackernews 6y agoAFAIK, they have not publicly released any data dumps from this (yet? Maybe they're planing to). If I were sitting on a dataset like this, I'd probably try to share it with the authorities like the FBI and selected journalists who I feel would behave responsibly.
- prof-dr-ir 6y agoSorry but no 'security researcher' is supposed to be gathering such a massive dataset in the first place. The moment you use a vulnerability to download any private information, even as proof of concept, you are on very thin ice - both legally and (in my view) ethically. If I were twitter user @donk_enby I would be very worried about an imminent visit by law enforcement.
- surge 6y agoIt's also likely doing this as screwed up active investigations. Someone might have felt safe "deleting" messages on Parlor. Now that this is public, they're going to burn everything connected to it and it may ruin ongoing investigations. There's a reason Twitter keeps a lot of accounts active, they act as honey pots for law enforcement who can watch them. These hackers aren't the heroes they pretend to be.
- ForHackernews 6y agoApparently Parler collects phone numbers and scans of government-issued ID. I suspect most people in a Western country would find it difficult to "burn" their legal name and birthdate.
- mike00632 6y agoReally? Parler requires an image of an ID? I've heard this claim elsewhere but I just assumed it was misinformation. I can't imagine so many people sending in photos of their ID to have access to Parler. Even the ones who didn't know that openly planning murders is wrong there are many users who would know to hide their identity, right?
- scythe 6y agoA more obvious criterion would be that there's no implication the people who compromised Parler actually do any kind of research on computer security. The article indicates this was a script-kiddie level vulnerability. On the other hand if an actual researcher leaks data they're still a researcher; they might be a bad person, but that's orthogonal.
- jedimastert 6y ago> On the other hand if an actual researcher leaks data they're still a researcher; they might be a bad person, but that's orthogonal. I would disagree. To me at least, the difference between researcher and hacker is what you do with the knowledge you have.
- BlueTemplar 6y agoThose aren't exclusive, hacker doesn't necessarily have a bad connotation (see "white hat").
- scythe 6y agoIn my original post I didn't want to use the word "hacker" to mean "breaker-into of systems" while posting on a site called Hacker News. But my point wasn't that people can't have their credentials revoked for doing bad things, my point was that if actual security researchers -- say, a team from some university or prominent firm -- had done this, we would be having a very different conversation right now. We might stop calling them researchers next week, but history matters. As far as I can tell, the people who broke into Parler are not far beyond script kiddies, if at all.
- BlueTemplar 6y agoOk, sorry for being pedantic.
- chmod775 6y agoHacker and researcher are not mutually exclusive. A researcher seeks knowledge, a hacker seeks ways to apply knowledge to overcome obstacles, which includes seeking required knowledge and is knowledge itself. The more interesting question is in what capacity someone was acting, if it wasn't both. Anything else is like trying to find the difference between an employee and a pilot, as if they're mutually exclusive things.
- Miner49er 6y agoThe person who did this calls themselves a hacker. It's just whoever wrote this article that decided to call them a "security researcher".
- curiousllama 6y agoI research what's behind your security, ergo, I'm a security researcher
- jtbayly 6y agoIn other words, the media really is as liberal as is claimed by some? How does that change things? The article calls them security researchers. In the title! Isn't that an example of something that HN is tacitly acknowledging to be true by leaving the title alone?
- AnHonestComment 6y agoI’m shadowbanned for posting a video of the BLM founder calling herself a trained Marxist. HN is itself deeply biased towards certain ideological positions.
- TheAdamAndChe 6y agoThings have changed in the last few days. I think what we're seeing is a form of information warfare specifically designed to trigger a strong response in people, either positive or negative. Additional interesting things: the DOSing of Tor v3, suppression of all Trumpian sites, the blackout of Pakistan, the massive volatility of monero.
- objectivetruth 6y ago> In other words, the media really is as liberal as is claimed by some? This seems like flame-bait trolling, unless the conservative cries about "liberal media" were referring to... cybernews.com this whole time?
- 35fbe7d3d5b9 6y agoThe article is essentially a copy/paste of a chain of screenshotted messages that'd been going around for a while. This sentence specifically: > With this type of access, newly minted users were able to get behind the login box API used for content delivery. That allowed them to see which users had moderator rights and this in turn allowed them to reset passwords of existing users with simple “forgot password” function. Since Twilio no longer authenticated emails, hackers were able to access admin accounts with ease. Compare to this comment[1] (linked from MeFi) posted this morning: > Well, because of that access, it gave them access to the behind the login box API that is used to deliver content (...) Subsequent posts also seem to indicate that post is incredibly inaccurate[2]. So it looks like someone mixed up "scraping a public API" with some breathless tale of hackers doing hacker things, and HN ate it up. [1]https://m.alpha.facebook.com/groups/majordomo/permalink/10161497935914522/ https://m.alpha.facebook.com/groups/majordomo/permalink/1016... [2]https://www.reddit.com/r/ParlerWatch/comments/kv0jo6/psa_the_heavily_upvoted_description_of_the_parler/ https://www.reddit.com/r/ParlerWatch/comments/kv0jo6/psa_the...
- tedjdziuba 6y agoMostly peaceful security researcher?
- pratik661 6y agoI find this euphemistic renaming amusing. It’s like calling a state backed hitman a ‘termination consultant’
- Cullinet 6y agomore like a judicium Dei[0] verification specialist.. [0] trial by ordeal
- arbitrage 6y agoOK, call them hackers then. I'm sure they'll be okay with that appellation, and won't really care about your dithering over the distinction.
- Benjmhart 6y agoThe vast majority of this data was posted publicly. You have no reasonable expectation of privacy.
- jtbayly 6y agoVast majority? OK..... So what about the stuff that was from private posts? You're really going to justify this?
- teddyfrozevelt 6y agoIt wasn't from private posts, it was from deleted posts. Parler left them accessible and so they happened to be caught when scraping.
- AnHonestComment 6y agoYou have a copyright protection against other people posting your messages for their benefit. Anyone who wanted to claim their posts could DMCA them.
- wnevets 6y agowhat private data was leaked? From what I can see its just public content that was archived.
- binaryblitz 6y agoI read that photos of drivers licenses and other "official" cards were leaked. I believe these were used for proving who you were on the app. I'm not sure if these were publicly shared, or shared with admins who then verified the user.
- wnevets 6y agoThe source of the "leak" is claiming its ONLY publicly [1] available content. The fact it is being called a leak rather than an archive is just misleading. [1] https://twitter.com/donk_enby/status/1348666166978424832 https://twitter.com/donk_enby/status/1348666166978424832
- smegcicle 6y agoThe term is also being used in Wikipedia's reference to this event.
- brown9-2 6y agoIt sounds like Parler is responsible for the leaking, if they truly had no authentication requirements on their API endpoints.