Hacker News Reader

Comment by tptacek | Hacker News Reader

To me, the big question underneath all of this is password dumps. I don't know that there was much uncertainty about buying vulnerabilities. But password dumps are almost always per se stolen data, and it's a bit of an open secret that there are anti-ATO teams using those dumps to create better versions of HIBP. I read this looking for clear guidance on whether it was safe to buy a password dump if you're only using it to force password resets for your users, and didn't come away with much certainty in either direction.

View on HN

>As noted above, many of the federal criminal statutes associated with the type of stolen data that tends to be sold in Dark Markets—e.g., passwords, account numbers, and other personally identifiable information—only apply if there is intent to further another crime: for instance, an intent to use the information to defraud.33 For this reason, a purchaser of the stolen data who lacks a criminal motive is unlikely to face prosecution under those statutes.

Which part is unclear?

> knowingly purchasing another party’s stolen data without that party’s authorization can pose some legal risk. It is much more likely to raise questions about the purchaser’s motives and result in scrutiny from law enforcement and the legitimate data owner, particularly if a trade secret is involved.

So if you're buying password dumps only to protect your own users from account takeover then you're unlikely to face legal consequences? However, that's not ironclad and not explicitly protected by the law. No promises.

I know some large sites will use illicit passwords dumps to revoke re-used passwords for their own users. Though they'll be very obtuse and just tell users something like "your password has expired". Given the fuzzy legality of this practice, I can understand why.

Also, there's a potential gap between "protecting your users" and "selling protection for users to other companies" that you'd really like to see clarified, if you're a vendor who buys password dumps to provide a commercial ATO service.

Most lawyers would still say not to do this to a small client with limited resources to defend themselves. A more well funded client would be walked through a process that combines obfuscation with plausible deniability. Being scrutinized is just as bad as being put on trial when the alternative is a zero risk position. So when you collect the data you need a strategy that minimizes being noticed (or being noticed by a party that is allowed to act), executes in a way that produces minimal evidence (or the kinds of evidence a lawyer can't have dismissed), and which might violate the spirit of the law but not its letter (unless you're European because they find writing real laws cumbersome).

The part where it goes on to say that the data should be sequestered and surrendered immediately to law enforcement, and that you might still be subject to an investigation.

If motive is the defense against prosecution, then clearly you should be potentially subject to investigation. How else should we check that you're not actually lying about your motive?

"unlikely" is very very unclear.

It's copied not taken therefore is no theft. Unless the password is copyrighted I don't see what law the receiver is breaking, I think the gray area is when you pair usernames with the password but a password only list I don't see the issue. The only possible crimes I think are ones that have to do with either facilitating or conspiring to facilitate a criminal enterprise.

We had first-principles analyses like these before the DOJ stepped in to try to clarify.

Reply on news.ycombinator.com