7 ms·

I’d argue that if computer hacking wasn’t treated as a crime but rather just a natural occurrence we’d have a much more robust security culture today. It would

by xwdv 3y ago

I’d argue that if computer hacking wasn’t treated as a crime but rather just a natural occurrence we’d have a much more robust security culture today. It would also be a lot more fun to be a hacker.

Izmaki 3y ago
Agreed. What is holding a LOT of people back from doing even kind-hearted hacking (i.e. "grayhat" activities with the purpose of helping the victim) is the fact that a criminal record can break your career entirely. Bug bounty programs only get you that far, and some I believe (I have very limited experience with bug bounty hunting) have a strict scope. It's not worth the risk.
- ransackdev 3y ago
  Greyhats and especially bug bounty programs, pen testers, etc, have explicit authorization from the owners of the systems to access their systems, and perform ethical hacking with a mutually beneficial goal, hackers get paid, and the company gets a little bit less of an attack surface. That’s not illegal What’s illegal is accessing a computer system without the authorization of the owners of the computer system. Technically speaking, port scanning the internet is illegal hacking, as you are not authorized to scan each port number on any of those machines. Ever find a random ip and give port 22 a few random tries over ssh to see if the root password is “guest”, you just committed a federal offense, because you were not authorized to access and attempt to login to that system. Is anyone going to report port scans to the fbi? Failed ssh loggin attempts? (Use a vpn/tailscale and don’t expose ssh to the internet anyway). I often wonder where “knowing” someone’s password and “hacking” their social accounts falls in this discussion. You see or hear about it all the time. “So and so hacked my page” If you have someone’s FB login info and they have no idea that you do, you may have permission to access FB, as everyone does if you accept their TOS, but you don’t have the account owner’s permission to access their account, and if FB knew it wasn’t the account owner, they would not allow that either. So if they don’t allow that, you’re likely violating their TOS, and no longer allowed to access their systems, so maybe it could technically be able to be prosecuted as illegal hacking, idk.
  - anamexis 3y ago
    > Greyhats [...] have explicit authorization from the owners of the systems to access their systems. It sounds to me like you're describing whitehat. Greyhat do these things without authorization, but also without malicious intent. https://en.wikipedia.org/wiki/Grey_hat https://en.wikipedia.org/wiki/Grey_hat
    - ransackdev 3y ago
      Ah yeah I guess it’s true they don’t have permission. At the end of the day I think it comes down to the owner choosing to press charges or not, or even detecting it and subsequently reporting it. I would guess that if the systems have ways to be hacked, the owners likely won’t see the hacks until the white/grey hat reports it to them. Somewhat related, the hackers submitting a vulnerability disclosure to the companies are in a very “extortion-y” dynamic. I wonder how often companies get something like “pay us X amount or we let the world know today instead of waiting for you to fix it”.
    - xwdv 3y ago
      Greyhats may or may not have malicious intent. They don’t play by anyone’s rules but their own.
      - anamexis 3y ago
        A greyhat with malicious intent is just a blackhat.
        xwdv 3y ago
        Not really, because it depends on who the target is. If the greyhat for example maliciously targets a Mexican cartel or Iranian nuclear centrifuge, are they really the bad guy?
        lvturner 3y ago
        Which in turn depends on how many innocent bystanders get killed, maimed or injured as a result of those actions and if the means justify the end...
ummonk 3y ago
I’d argue that if trespassing and burglary weren’t treated as crimes but rather as natural occurrences we’d have a much more robust home security culture today. It would also be a lot more fun to be a trespasser.
- Retric 3y ago
  Hacking requires software or hardware vulnerabilities, without them it’s possible to have a completely invulnerable computer system. Users are frequently blamed, but the dumbest user can’t leak credentials that don’t exist. Home security has no perfectly secure state.
  - majormajor 3y ago
    The odds of "nobody ever accidentally writing a security bug" are astronomically low. Were hacking legal, the risk/reward calculation still encourages huge amounts of effort spent on hacking. No matter how robust your programming security culture, mistakes will happen. And the people who exploited them could have HUGE gains. All for only risking having wasted their time in failure.
    - 3np 3y ago
      > Were hacking legal Do consider "we're hacking legal" or "hacking the legal system", which is widely practiced by corporatae everywhere. Why should it be OK to hack the legal rules set in place by regulators and not the business rules set in place by a business or individual? In both cases it typically involves finding loopholes that allow you to get what you normally wouldn't, while complying with de-facto implementation of rules. (E.g. rooting an Android phone you bought, or requesting data from a publicly readable but probably misconfigured S3 bucket).
      - dahfizz 3y ago
        > while complying with de-facto implementation of rules. If someone leaves their front door unlocked, does that give you permission to enter and take whatever you want? There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works.
eternityforest 3y ago
Would we have a more robust security culture, or would we all be forced to pay with cash everywhere, not use IoT, and mail paperwork in the actual mail? People might not want to use something that disqualified them from legal protection if they used it. It would make tech look unsafe if we just straight up said "This will be hacked and we're not even going to do anything about it". Early 2000a culture was amazing but I'm not sure I'd want to go back to using cash and not having tile trackers. Maybe if you had extremely tight limits on what you can do, you can break in but not alter anything for any reason. But then again, maybe it would have the opposite effect, like in the 90s when we still tried to move to doing as much as possible digitally even though it was almost never secure. Maybe people would just accept it.

by xwdv 3y ago

Izmaki 3y ago

Agreed. What is holding a LOT of people back from doing even kind-hearted hacking (i.e. "grayhat" activities with the purpose of helping the victim) is the fact that a criminal record can break your career entirely. Bug bounty programs only get you that far, and some I believe (I have very limited experience with bug bounty hunting) have a strict scope. It's not worth the risk.

ransackdev 3y ago
Greyhats and especially bug bounty programs, pen testers, etc, have explicit authorization from the owners of the systems to access their systems, and perform ethical hacking with a mutually beneficial goal, hackers get paid, and the company gets a little bit less of an attack surface. That’s not illegal What’s illegal is accessing a computer system without the authorization of the owners of the computer system. Technically speaking, port scanning the internet is illegal hacking, as you are not authorized to scan each port number on any of those machines. Ever find a random ip and give port 22 a few random tries over ssh to see if the root password is “guest”, you just committed a federal offense, because you were not authorized to access and attempt to login to that system. Is anyone going to report port scans to the fbi? Failed ssh loggin attempts? (Use a vpn/tailscale and don’t expose ssh to the internet anyway). I often wonder where “knowing” someone’s password and “hacking” their social accounts falls in this discussion. You see or hear about it all the time. “So and so hacked my page” If you have someone’s FB login info and they have no idea that you do, you may have permission to access FB, as everyone does if you accept their TOS, but you don’t have the account owner’s permission to access their account, and if FB knew it wasn’t the account owner, they would not allow that either. So if they don’t allow that, you’re likely violating their TOS, and no longer allowed to access their systems, so maybe it could technically be able to be prosecuted as illegal hacking, idk.
- anamexis 3y ago
  > Greyhats [...] have explicit authorization from the owners of the systems to access their systems. It sounds to me like you're describing whitehat. Greyhat do these things without authorization, but also without malicious intent. https://en.wikipedia.org/wiki/Grey_hat https://en.wikipedia.org/wiki/Grey_hat
  - ransackdev 3y ago
    Ah yeah I guess it’s true they don’t have permission. At the end of the day I think it comes down to the owner choosing to press charges or not, or even detecting it and subsequently reporting it. I would guess that if the systems have ways to be hacked, the owners likely won’t see the hacks until the white/grey hat reports it to them. Somewhat related, the hackers submitting a vulnerability disclosure to the companies are in a very “extortion-y” dynamic. I wonder how often companies get something like “pay us X amount or we let the world know today instead of waiting for you to fix it”.
  - xwdv 3y ago
    Greyhats may or may not have malicious intent. They don’t play by anyone’s rules but their own.
    - anamexis 3y ago
      A greyhat with malicious intent is just a blackhat.
      - xwdv 3y ago
        Not really, because it depends on who the target is. If the greyhat for example maliciously targets a Mexican cartel or Iranian nuclear centrifuge, are they really the bad guy?
        lvturner 3y ago
        Which in turn depends on how many innocent bystanders get killed, maimed or injured as a result of those actions and if the means justify the end...

ummonk 3y ago

I’d argue that if trespassing and burglary weren’t treated as crimes but rather as natural occurrences we’d have a much more robust home security culture today. It would also be a lot more fun to be a trespasser.

Retric 3y ago
Hacking requires software or hardware vulnerabilities, without them it’s possible to have a completely invulnerable computer system. Users are frequently blamed, but the dumbest user can’t leak credentials that don’t exist. Home security has no perfectly secure state.
- majormajor 3y ago
  The odds of "nobody ever accidentally writing a security bug" are astronomically low. Were hacking legal, the risk/reward calculation still encourages huge amounts of effort spent on hacking. No matter how robust your programming security culture, mistakes will happen. And the people who exploited them could have HUGE gains. All for only risking having wasted their time in failure.
  - 3np 3y ago
    > Were hacking legal Do consider "we're hacking legal" or "hacking the legal system", which is widely practiced by corporatae everywhere. Why should it be OK to hack the legal rules set in place by regulators and not the business rules set in place by a business or individual? In both cases it typically involves finding loopholes that allow you to get what you normally wouldn't, while complying with de-facto implementation of rules. (E.g. rooting an Android phone you bought, or requesting data from a publicly readable but probably misconfigured S3 bucket).
    - dahfizz 3y ago
      > while complying with de-facto implementation of rules. If someone leaves their front door unlocked, does that give you permission to enter and take whatever you want? There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works.

eternityforest 3y ago

Would we have a more robust security culture, or would we all be forced to pay with cash everywhere, not use IoT, and mail paperwork in the actual mail? People might not want to use something that disqualified them from legal protection if they used it. It would make tech look unsafe if we just straight up said "This will be hacked and we're not even going to do anything about it". Early 2000a culture was amazing but I'm not sure I'd want to go back to using cash and not having tile trackers. Maybe if you had extremely tight limits on what you can do, you can break in but not alter anything for any reason. But then again, maybe it would have the opposite effect, like in the 90s when we still tried to move to doing as much as possible digitally even though it was almost never secure. Maybe people would just accept it.