4 ms·
> Now, I'm obviously documenting this insanity to write a blog post over the next couple of days, Many countries have hacking laws that are exceptionally broad
by michaelt 4y ago
> Now, I'm obviously documenting this insanity to write a blog post over the next couple of days,
Many countries have hacking laws that are exceptionally broad, written in the 1980s by legislators who had never even touched a computer. A law might, for example, ban "gaining unauthorized access to a computer system"
This means that if you accidentally find what looks like a security problem, and you look around a bit to make sure you're not raising a false alarm - you're already in violation of the law.
If your country has any such laws, to claim credit for your discovery would be to admit to a crime.
And while you might not have done anything you think of as hacking, put yourself in the mindset of the site operator. They might feel as if you've put a gun to their heads, or that scaring you into shutting up and deleting any data you've downloaded is them protecting their customers - they might go to the cops and give the cops a very different perspective.
If you want to alert the world to this breach, may I suggest downloading the breached data anonymously and e-mailing it anonymously to Troy Hunt of Have I Been Pwned?
- _jvqm 4y agoI will tell an anonymous person to do this, but I’m not sure if Troy Hunt cares about a random one-of-thousands service and a few thousand affected users.
- michaelt 4y agoA few minutes ago, you were calling it a "pretty extreme data leak" and "millions of dollars" so I think he'd at least know how to validate the leak and enter it into HIBP.
- _jvqm 4y agoThese statements stand unchanged. The usage of "pretty extreme" could be regarding the "quality" of data, not quantity. Compared to the usual data leaks on HIBP it seems like an occurrence that happens frequently and the affected user count is abysmally low. Some anonymous person might fire off an email to Troy Hunt regardless.
- jimmaswell 4y agoIs this something you'd get extradited for? Sounds like they're not in the same country.
- ffhhj 4y agoA few years ago I had an app that checked emails for leaks. Never collected the queried emails. Google didn't like it and banned my account without any warning.
- suprjami 4y agoAnonymous disclosure to a trusted party is the only correct answer. Excellent advice.