Hacker News Reader

Comment by w3rhn2j34oh5o | Hacker News Reader

Boom, now Troy is monetizing stolen data. Unethical and illegal.

It does cost money to run a service like this. He's historically had sponsors, but you can't expect someone to run a high traffic service for free forever.

And the local pawn shop has expenses too. Just because they have to pay rent and electricity costs does not make selling a stolen item legal.

There's a difference - he's not selling the leaked passwords. He's selling the information that a password has been leaked for a certain account. You can't buy stolen passwords from the site, so it's perfectly legal.

I don't think it is that clear -- he is selling access to a data set containing PII (email address or account names). Its stolen data. One can make a case that free and open access to this data set is a common good, however once money is involved, one is conducting business with data that one did not legally obtain. It is not 'perfectly legal'.

I don’t think the API ever returns that information. You need to already have the email address to be queried.

He gives a cost breakdown showing that he's almost guaranteed to lose money off it. Azure is charging him 3.5$ per 1 million calls to ratelimit/charge people for using the api. He's charging 3.5$. Consider that Stripe will be taking another 35 cents or so... lets just say if this was a monetization method it's not a very good one.

He can try to justify it however he likes -- its selling stolen goods. Just because you sell stolen goods under their value, or under your costs to provide does not suddenly make it ok.

Oh come on. It is plainly evident that he is not "selling stolen goods". He is providing a valuable public service merely checking whether people are caught up in those "stolen goods" and the context in which it occurred. In these changes, he is seeking only to recover his costs and reduce the time he spends administrating it, which he has done at absolutely no charge for 5+ years.

You are quite simply wrong and you should just admit it, rather than repeating your ludicrous claims in ever more hysterical terms.

I don't see it as him monetizing the stolen data, but the mere existence of it.

No getting around that he sell access to stolen data.

He didn't orginally steal it. He collected the illegal dumps and runs a service on top of that data.

There is nothing wrong selling stolen data provided someone else dumped it first.

So fencing stolen goods is not illegal if someone else stole it? I don't think so. Stolen is stolen -- nobody has any right to sell it.

Reply on news.ycombinator.com