Hacker News Reader

Comment by unethical_ban | Hacker News Reader

It's stunning that you may have read this conversation and still think people have an issue with security research on Tor in general.

The testing, and perhaps even the specific methods of the this test, are not the question. The question is the morality of CMU being paid by authorities to uncover PII about hidden services and report back to them.

Test the system (potentially with your own uni's red/blue teams instead of on other 'public' hidden services) and report back anonymized reports of the data. One can say "Doing X, I got result Y" without giving out the personal details of results, much less to the FBI.

View on HN

Yes. It's the difference between pubishing a paper "How to break TLS" and a paper "How to break TLS, with an appendix of 10,000 credit card numbers I logged using this method".

this.

Doing the legwork of law enforcement, is different from doing research.

It's not stunning. It is a long-running controversy with Tor and its operators. Most of what's in the "Ethical Tor Research Guidelines" is common-sense, but some of it potentially forecloses important research.

The comment I replied to said developers should only welcome white hat attackers. We seem vaguely agreed that black hats won't stop attacking because they are unwelcome, so what change is effected by only welcoming white hats?

To use the lock analogy:

It's not OK to break into random houses under the guise of lock picking research. Even if it is research, it's still B&E.

However, the designer/manufacturer/seller/marketer of the defeated locks would look silly to come out and say, "No fair, you're not allowed to pick those locks. We clearly said you could only do that in our test lab!"

So where does that leave the guy who discovered nearly all hotel locks are trivially hackable?

I'm pretty sure everyone here would mock the hotel lock vendors for complaining... even if a government paid that guy to illegally break into a bunch of hotel rooms.

No, if your scenario occurred, there would be a similar sentiment as in the thread here. Motive matters.

I don't recall Cody going into a number of rooms, photographing their contents and sharing those photographs with the authorities.

If I understand correctly, he did a lot of the work with the idea of selling hotels an alternative to the keycard programmers that come with the locks, and the company that did that purchased stuff to work with.

This story has lots of discussion of it:

https://news.ycombinator.com/item?id=4281722

Especially this comment:

https://news.ycombinator.com/item?id=4282666

(Also, not all hotels, just lots and lots of them that used that particular implementation)

What if those locks were willingly sent from house to house with the intention that the sending would obscure their source/destination? If you signed your house up to be one of those locations and decided to try to pick some of the locks that were shipped through your house, you would consider that B&E?

Reply on news.ycombinator.com