4 ms·

Can you elaborate on the Krebs doxxing innocent people thing?

by mig39 4y ago

password4321 4y ago
https://news.ycombinator.com/item?id=27440675#27448881 https://news.ycombinator.com/item?id=27440675#27448881 > https://itwire.com/business-it-news/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://itwire.com/business-it-news/security/infosec-researc... (2019) > https://itwire.com/business-it-news/security/krebs-accused-of-doxxing-man-based-on-single-source-in-twitter-scam-yarn.html https://itwire.com/business-it-news/security/krebs-accused-o... (2020) https://hn.algolia.com/?query=krebs%20doxx&sort=byDate&type=comment https://hn.algolia.com/?query=krebs%20doxx&sort=byDate&type=...
ziddoap 4y ago
The short of it is during one of his investigative blog posts, he released the real life names of two security researchers who he believed (based on a single source from Twitter) ran a scam. Sean Hollister, a reporter for The Verge (among others) rightfully called out Krebs' actions as extremely misguided and potentially harmful [1]. In another case, he released the names and details of the people he believed were running the Coinhive cryptomining scam. He also compiled and released information on three people who he thought were connected to the Shadow Brokers group, although he has since unpublished that post (some analysis at [2]). There's even an urban dictionary term: 'krebbed' [3]. There's been discussion here, and elsewhere, although it's mainly back-and-forths on Twitter. The issue I take with it is separate from whether or not he was correct, but that he is taking it upon himself to act as the judge, jury and executioner of potentially innocent people by releasing names and personal details of people on his blog and on Twitter. Edit to add: He's even posted someone's passport before, which is kind of wild to think about [4]. [1] https://twitter.com/StarFire2258/status/1283892893539635200 https://twitter.com/StarFire2258/status/1283892893539635200 [2] https://www.emptywheel.net/2017/11/28/the-russian-metadata-in-the-shadow-brokers-dump/ https://www.emptywheel.net/2017/11/28/the-russian-metadata-i... [3] https://www.urbandictionary.com/define.php?term=krebbed https://www.urbandictionary.com/define.php?term=krebbed [4] See his blog post "Meet the World’s Biggest ‘Bulletproof’ Hoster", where he still has the dudes passport picture (with all info, no redactions) up.
- vorpalhex 4y ago
  It should be noted that posting someones identity is distinctly not the same as executing them.
  - ziddoap 4y ago
    If you need that noted, I'm worried. It's an expression that I thought most people would understand, but to make it abundantly clear: I do not think that Krebs is executing people. Nor do I think he has the legal training to be a judge. He might have been on a jury before, I'm not sure. I am using it as an expression to state that he is taking upon himself the task that is normally reserved for either LEA and/or the court system, which is ascribing guilt.
    - chipsa 4y ago
      He appears to be acting as an investigative reporter. Such acts have a long history of naming and shaming people, even ones that were not previously public figures. That he writes for his own publication is not really material to the fact that he is acting as a reporter.
      - ziddoap 4y ago
        Funny enough to some, I disagree with any reporter who names private citizens with little proof and no avenue for recourse. Especially when they post things like a persons non-redacted passport, for example, which has plenty of personal information that is not material to the story in any which way. If you have enough information to release a bunch of personal information on someone and tell thousands of people that they are guilty of something, you should go to the appropriate LEA and either take some care writing your story or wait until an actual investigation has happened, reporting on those results. Edit to add: At least in this case, regarding Krebs, it would seem that at least one senior editor and journalist agrees with me that Krebs acted unethically (see the first comment for a link to a tweet by a senior editor at The Verge). Other major news organizations (e.g. CBC) have policies not to named those only accused of a crime, except in extenuating circumstances or after a charge is laid/legal proceedings have begun. They must also report on the outcome of the criminal investigation.

Can you elaborate on the Krebs doxxing innocent people thing?

by mig39 4y ago

Can you elaborate on the Krebs doxxing innocent people thing?

https://news.ycombinator.com/item?id=27440675#27448881 https://news.ycombinator.com/item?id=27440675#27448881 > https://itwire.com/business-it-news/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://itwire.com/business-it-news/security/infosec-researc... (2019) > https://itwire.com/business-it-news/security/krebs-accused-of-doxxing-man-based-on-single-source-in-twitter-scam-yarn.html https://itwire.com/business-it-news/security/krebs-accused-o... (2020) https://hn.algolia.com/?query=krebs%20doxx&sort=byDate&type=comment https://hn.algolia.com/?query=krebs%20doxx&sort=byDate&type=...

ziddoap 4y ago

The short of it is during one of his investigative blog posts, he released the real life names of two security researchers who he believed (based on a single source from Twitter) ran a scam. Sean Hollister, a reporter for The Verge (among others) rightfully called out Krebs' actions as extremely misguided and potentially harmful [1]. In another case, he released the names and details of the people he believed were running the Coinhive cryptomining scam. He also compiled and released information on three people who he thought were connected to the Shadow Brokers group, although he has since unpublished that post (some analysis at [2]). There's even an urban dictionary term: 'krebbed' [3]. There's been discussion here, and elsewhere, although it's mainly back-and-forths on Twitter. The issue I take with it is separate from whether or not he was correct, but that he is taking it upon himself to act as the judge, jury and executioner of potentially innocent people by releasing names and personal details of people on his blog and on Twitter. Edit to add: He's even posted someone's passport before, which is kind of wild to think about [4]. [1] https://twitter.com/StarFire2258/status/1283892893539635200 https://twitter.com/StarFire2258/status/1283892893539635200 [2] https://www.emptywheel.net/2017/11/28/the-russian-metadata-in-the-shadow-brokers-dump/ https://www.emptywheel.net/2017/11/28/the-russian-metadata-i... [3] https://www.urbandictionary.com/define.php?term=krebbed https://www.urbandictionary.com/define.php?term=krebbed [4] See his blog post "Meet the World’s Biggest ‘Bulletproof’ Hoster", where he still has the dudes passport picture (with all info, no redactions) up.

vorpalhex 4y ago
It should be noted that posting someones identity is distinctly not the same as executing them.
- ziddoap 4y ago
  If you need that noted, I'm worried. It's an expression that I thought most people would understand, but to make it abundantly clear: I do not think that Krebs is executing people. Nor do I think he has the legal training to be a judge. He might have been on a jury before, I'm not sure. I am using it as an expression to state that he is taking upon himself the task that is normally reserved for either LEA and/or the court system, which is ascribing guilt.
  - chipsa 4y ago
    He appears to be acting as an investigative reporter. Such acts have a long history of naming and shaming people, even ones that were not previously public figures. That he writes for his own publication is not really material to the fact that he is acting as a reporter.
    - ziddoap 4y ago
      Funny enough to some, I disagree with any reporter who names private citizens with little proof and no avenue for recourse. Especially when they post things like a persons non-redacted passport, for example, which has plenty of personal information that is not material to the story in any which way. If you have enough information to release a bunch of personal information on someone and tell thousands of people that they are guilty of something, you should go to the appropriate LEA and either take some care writing your story or wait until an actual investigation has happened, reporting on those results. Edit to add: At least in this case, regarding Krebs, it would seem that at least one senior editor and journalist agrees with me that Krebs acted unethically (see the first comment for a link to a tweet by a senior editor at The Verge). Other major news organizations (e.g. CBC) have policies not to named those only accused of a crime, except in extenuating circumstances or after a charge is laid/legal proceedings have begun. They must also report on the outcome of the criminal investigation.