3 ms·

Im not a hacker/cracker or whatever but I am curious would it be illegal to use one of those usernames and passwords to see if it actually worked for an account

• IkmoIkmo 12y ago
  Depends on the jurisdiction, but generally yes it'd be illegal. You can compare it to opening someone's home because he left his key in a public place unbeknownst to him. You generally couldn't make the argument that 'he may have wanted people to have the key, that's why he left it in a public/open source place'. Firstly, one can't assume that, so we must hear it explicitly before it's true. And secondly, if universal open-source access was provided, there wouldn't be a key to find as there wouldn't be a lock in the first place to allow specific access. The whole point of a password or key means you do not want fully open access to all, meaning any password or key in an open-source project is likely unintentional, a mistake, and thus you'd be entering without permission which is illegal in most jurisdictions.
• lstamour 12y ago
  I'd say this crosses the line, in a day and age where using CURL can land jail time (e.g. AT&T "leak"). Guessing a password doesn't legally grant you the right to enter a server, either. That'd be like saying you had a right to trespass because someone left the gate open or didn't build it high enough. It doesn't work that way. I really think Github needs better protections for this. Consider a search for "export GITHUB_SECRET" ;-)