Hacker News Reader

Comment by bawolff | Hacker News Reader

> After I shopped a few other companies to see how our plans compared

Yeah once you start using a vulnerability maliciously to obtain confidential data for your own personal gain, even if its a stupid vulnerability, you're not really good-guy security researcher anymore.

If all you did was the bare minimum to demonstrate the vuln exists, that's cool. If after you do that you continue to use it to obtain confidential info for your own gain or curiosity, that's not so cool.

> Perhaps it's more difficult to hold yourself accountable than it is to assume that others who've found your shoddy work are malicious actors.

You literally just admited to being a malicious actor in the paragraph above.

View on HN

Language cheapens itself when spoken cheaply. Abusing over the top terminology on minute areas of controversy will ultimately lesson the impact of your outrage when something actually bad comes along. Someone browsing healthcare plans available to other employees of different companies is not something that should win you the label “malicious actor” and come associated with other implications. This data leaking harms literally nobody other than perhaps the company offering the worst coverage to its employees. Your response is the real problem here: If I had done this, reported it, and then been called a “malicious actor” on a forum titled “Hacker News” my knee jerk response would just be to shut up about it next time.

I used the word "malicious". Its not like i used the word "murderer" or "evil overlord". I'm not saying OP should go to jail or anything.

All i'm saying is if you find an exploit, and after you verify it works, you contunue to use it for your own personal ends, you're no longer benign and you shouldn't expect a warm welcome from the security team.

The line is when you start to use exploits on computers not owned by yourself for your own ends instead of for the purpose of verifying and reporting the vuln. Sure you could cross that line a little bit or a lot, but you're not innocent if you're over it.

> you contunue to use it for your own personal ends

I think this is what people may have been missing from your original post: at some point things can go from innocent to malicious.

"Crime of convenience" is the most common type, after all.

"I'm not the type to steal, but the cash was left on the counter, and …"

> ... and you shouldn't expect a warm welcome from the security team.

The appropriate response from the security team (after verification) is to pull the site down or immediately patch the vulnerability, if possible. Making an outbound call to a third-party is pointless and irresponsible.

I imagine having an assertion that the person didn't keep any of the data might be important to legal. (Ianal)

Browsing the different plans is not malicious. Jesus.

And the details of different plans is not the kind of confidential info that innately deserves protection. Investigating or recording personal information would be bad, but they didn't do that.

Exactly... for them to "benefit", they would have to:

Apply for jobs at the other companies with better plans, proceed with interviews, offers and then finally accept one and quit their job at their current employer... To reap the rewards of their malicious hacking...

More directly, they as employees could pressure their bosses to renogtiate the insurance contract.

It wasn't just plan details though... They accessed names, SSNs, etc.

Not on purpose, and they didn't keep or memorize it.

The GP comment says "After I shopped a few other companies to see how our plans compared". That sounds pretty "on purpose" to me.

What does "keep or memorize" have to do with anything? They intentionally abused a misconfiguration to view private information.

I think it's reasonable to disagree about the ethics of that, but I don't think it's really debatable that it was intentional.

They were intentionally viewing plan information. The personal information wasn't the goal and wasn't retained.

"private" information is too vague of a term.

> malicious actor

malice implies intent. If we take author at their word, there wasn't any, though you could say they took it too far by looking at other stuff they probably knew it was ethically wrong to do so.

Though, sometimes it isn't clear you're in compromising territory until you're in it.

If any of the confidential information obtained wrongly gets used to advantage … that's malice.

If the parent set out to exploit the insurer by finding inconsistent/unfair pricing, etc etc … that's malice.

Hmm. You make a good point. Fair enough.

You lost me at "maliciously".

What harm was done by someone comparing prices? What organization lost money? Who got worse health service?

"Unethical" and malicious is the current, profit-driven health insurance system.

I know you're coming at it from an absolutist perspective, but I disagree entirely with passing judgement.

Furthermore, the fact that you seem more upset with the person who glanced at a few plan prices rather than at the healthcare system, or the incompetent website operators, is telling.

If you accessed my medical records, nobody would be “harmed” as they are fairly normal. It would still be wrong.

Because it would be a privacy issue. But that assumes they're looking at your information on purpose, and not just some price tags.

>What harm was done by someone comparing prices?

It removes the information asymmetry, which protect the profits of the seller.

Exactly. So, no harm to any real people.

I definitely agree that this is not a big ethical breach in terms of magnitude, but it is still better not to look. Apparently this is not intended to be public information. If this information is private, I guess the companies want to derive some (slight) competitive advantage from not sharing it. I think you could make a strong argument that companies should make their healthcare offerings public knowledge, but they aren't currently (I guess?). In any case, access should be granted on the basis of an even playing field.

Oh no, not the heckin' confidential insurance negotiations! What's the worst that can happen by those being exposed?

Reply on news.ycombinator.com