Hacker News Reader

Comment by ang_cire | Hacker News Reader

This was not "releasing" information, though, it was already public. The "dark web" isn't someplace you require some special invite-only connection to, it's just regular websites (even if they use TOR) that anyone can access if they know where to look.

View on HN

It is naive to suggest that it is equally easy for the general public to search the dark web for an illicit data breach vs. go to a a publicized website.

Hell, I am in infosec and it would probably take me a few hours or more to find raw data. A grandma can click a website on CBS and type a name.

Your argument essentially sets up certain websites as being "more public" than others as a legal test for liability, in a way I can only assume would be based on Google index and search results (how Grandma finds it), which is wild to suggest.

How would that even work? You linked to something that Google didn't index, so you're liable for spreading private info, but another person who posted the same data, but whose reference site was indexed by Google, isn't liable?

I upvoted you stance, but at this point in technology, it's fairly easy to find articles on how to get on Tor and use a search engine that indexes Onion content. The two are not equivalent, but is it possible that you worry about visiting the dark web, versus the actual difficulty to do so? You are in infosec, so you are probably very conscious of what you can and can't do and track easily. The dark web is more difficult to track, but is it that much more difficult to access if you don't care about general privacy concerns? There are so many "easy" methods online to get you on the dark web, and most don't care too much about privacy like you or I care about. Just food for thought, I don't go searching the dark web, to keep my security to a level I can understand, and I don't think there's anything wrong with that.

Heck, most VPN providers provide guides to accessing TOR.

Ref:

https://surfshark.com/blog/how-to-use-tor

https://www.expressvpn.com/vpn-service/tor-vpn

https://protonvpn.com/support/tor-vpn/

https://nordvpn.com/blog/what-is-tor/

https://www.privateinternetaccess.com/blog/how-to-use-privat...

Hard to claim it's secret information IMO.

I agree, and also, thank you for these reference links! I wasn't aware so many VPN providers had instructions to access TOR.

You’re wrong.

I’m in infosec as well.

Kids (12+) know how to use Tor because we’ve made the “dark web” a cool place at this point.

And the Rhysida ransomware onion can be found with a simple Google search. The knowledge that’s it was Rhysida is public information .

STEPS TO REPRODUCE:

1. Download and install Tor

2. Search for Rhysida on Google

3. City of Columbus data is on the front page

Except there is a reasonable chance that he distributed illegally obtained uncensored data to people outside of the investigation, while being part of the investigative team. That’s not something you do, even if it’s not illegal.

> part of the investigative team

The article doesn’t mention this…

I think you have either found additional context not shown here, or created it erroneously. This person was not part of an investigative team.

Reply on news.ycombinator.com