Hacker News Reader

Comment by hiq | Hacker News Reader

> I'm leafing through the linked site and I can see SSNs, tax forms, enrollment forms - yikes!

Haven't you just admitted that you downloaded the files and browsed them? Isn't that illegal in the US?

I haven't looked at that onion site, but presumably that link is just a list of files, not their content. Otherwise, it has no blackmail value.

There are a few pictures of docs with SSNs on that page.

It appears to be some sort of leaks onion site titled "clop leaks".

Thanks for taking the risk of visiting a potentially exploit-ridden site for everyone. So, it contains a list of things to be leaked, plus leaks a sample to prove they're not bluffing?

Not a lawyer, but if that's true, how could sites like http://haveibeenpwned.com exist?

For one thing, http://haveibeenpwned.com is Australian, so not subject to US law. It might be illegal to access it in the US, but it's not illegal for it to exist.

It isn't illegal in the US either.

People -- visit the 'dark web' is NOT illegal. Browsing via Tor is perfectly legal. Reading some extortion website is not illegal.

Downloading someone else's ransomwared data -- that starts to become gray.

Preferably use Tor in an isolated VM, you have to assume the Firefox instance is corrupted.

They don’t publish the data itself they just compare a hash of it to a hash of whatever you submit for comparison.

Right, but they have to look at that data to create those hashes, no?

No, you submit your own hashes or partial hashes.

I think donw was talking about the much more gray-area part of HIBP: obtaining the lists of leaked passwords, in order to hash each one and store the hashes.

Reply on news.ycombinator.com