Man counterhacks paypal phisher, deletes data, warns other victims via phone | Hacker News Reader

Man counterhacks paypal phisher, deletes data, warns other victims via phone

reddit.com

I was a little surprised that the legality of this was questioned, so looked it up. In Roman Law tradition this kind of action would apparently be called "periculum in mora". An example would be that you enter another person's apartment without consent, because you noticed a strong smell of gas on the other side of the door.

The OP in the linked article had strong reasons to believe that the people who submitted their credit card data were in imminent danger of large financial damages if he did not stop the fraud quickly.

Apparently (and to my surprise), in the US the idea of "periculum in mora" only applies to law enforcement agents (http://en.wikipedia.org/wiki/Exigent_circumstance_in_United_...), though. Does that mean you would have to let the apartment explode if the police is too slow to show up and stop the gas leak?

In the US, the legal concept of necessity applies. To oversimplify, you can do something otherwise illegal to prevent a worse outcome than the results of your act.

Speaking as a former reserve police officer: Law enforcement agents have many more restrictions places on their conduct than private citizens do. That's why there needs to be an "exigent circumstance" exception for them specifically.

Rest assured, a private citizen would be perfectly within his or her rights entering an apartment to stop a gas leak.

Knowing the US, yes, you'd have to let it explode. And then get sued for letting it explode.

Of course, the alternative is to intervene, and get sued.

If you were to intervene and it still exploded, then God help you.

On the plus side, at least you won't get sued.

Don't be so sure. Death doesn't always stop them.

yes, it may technically be illegal, but that is why we have trial by jury. unless the story sounded made up, i can't really imagine anyone convicting someone that smashed a window or broke down an apartment door to save someone's life.

but really, who would vote this guy guilty of illegal access to a computer system when he was clearly helping phishing victims? and who would press charges against him in the first place, the hosting company where the phishing site was hosted?

Often times details surrounding an act will be kept from the jury. That's how you get juries that send a husband who was growing pot for his cancer-stricken wife to jail. The context was kept from the jury.

Jury nullification (basically what you're referring to here) was a major justification of juries in the first place as it was thought to be a check on state power, but of course the state has neutered it over the last century along with most other checks on its power. Jury nullification is mostly a memory at this point and juries are generally instructed only to consider whether the defendant actually broke the law as such - not whether the law itself is just.

Remember that jury nullification was often used to acquit whites of killing blacks in a time and place when killing a given black could often have been seen as something akin to shooting a raccoon or other vermin.

(This is why violating someone's civil rights is a Federal offense in modern American law: Homicide is a state offense, and the juries in the relevant state courts of that era would not convict for certain kinds of homicide. Federal courts were not nearly as prejudiced.)

I haven't been over to Reddit in a while. Is this really what it's like now?

I remember when I left, /r/programming read pretty much like HN does now, with an occasional mean comment or joke thread left alive to get in the way. The linked thread, though, has no actual discussion. It's just a bunch of people making silly jokes. Sad to see it go that way.

Usually when I tell people about reddit, I tell them to skip the front page and go straight to the reddits page and find topics that interest them.

The front page has too many cat pictures and crap for my taste these days. Hopefully they eventually have the time to implement one of the solutions I suggested to alleviate the problem.

What solutions did you suggest?

I've actually been showing up regularly at NYC's reddit events, and made quite a few friends in the community, but I don't really load up Reddit anymore - too much junk.

Why don't you just tell them to sign-up for only the sub-reddits they are interested in, since that will determine their front page?

*Side note: Kiva would still love to know if you are interested or not (e-mailed you when you posted about looking for new opportunities).

This wasn't posted in /r/programming, though; it's /r/reddit.com, a general purpose subreddit that new users are subscribed to by default, and that has double the subscribers compared to proggit. I imagine lots of new users unsubscribe from proggit but not from /r/reddit.com; anecdotally speaking, reddit's becoming very popular among my non-programmer but internet-familiar friends who like pictures of cats and rage comics.

That isn't to say to that proggit isn't pretty different to HN; going on there now (having not visited it in a while) only a handful of links show as having been visited due to my seeing them on HN. The content there is different and the level of discourse is acceptable, so I like it.

Proggit is almost exactly like news.yc linkwise and pretty much always has been since HN branched off. The comments are a little more relaxed though. There's people who hunt for new popular links on each which haven't reached the other and act something like arbitrage systems and quickly post it up on the lacking board. It's fun to watch, someone should make a realtime diff site between the two, something like that ervqhgg thing from awhile ago.

the difference is that proggit is opt in, while reddit.com is optout....so it's selection bias for quality

Proggit's in the top 10, so I'm pretty sure it's opt-out, unless they treat it like r/atheism and display it in r/all but not on the default frontpage.

Just checked; it's actually opt-in. I made a new throwaway and visited proggit and was greeted with the option to add it to my frontpage.

I think r/programming used to be opt-out. (Wasn't it the first subreddit?) Might be wrong, though.

But yeah, I only use reddit for particular subreddits these days.

I guess, despite its size, they consider proggit to be niche enough that most new users won't want to frontpage it.

Some people enjoy frivolous chat and punnery. I particularly enjoyed the parody of Pirates of Penzance, a verse of which I sang out loud to the amusement of my coworkers. I don't understand this insistence on comparing websites to each other as if one were better than the other - I am a happy user of both HN and Reddit, they both serve separate purposes to me.

Interestingly, although on Hacker News the comparison is typically drawn with Reddit, on Reddit it's generally 4chan that serves that purpose. What site do 4chan users look down on?

>What site do 4chan users look down on?

All of them. With the caveat that when most people refer to 4chan they're referring to /b/, and that that isn't accurate, there really aren't many sites that /b/tards like. They tend to believe (rightly, imho) that every site takes itself too seriously and every community has an unwarranted sense of self-importance. That was generally the motivation behind most of the raids they did. At least, it used to be. It's summer right now so average quality is expected to be low, but a perusal of /b/ really does leave the impression that there aren't many original /b/tards left.

The sites /b/tards hate most:

-reddit (although there's a huge overlap in users, many /b/tards see it as a "sanitized" /b/ where funny things are reposted without anyone doing the work of making them in the first place)

-ebaumsworld (back in the day)

-knowyourmeme/icanhazcheezburger/all the other sites capitalizing off /b/'s memes

-facebook/myspace/deviantart/twitter/every other site whose primary use case seems to be people stroking their ego

Reddit has adopted its own culture and hive-mind—the bigger Subreddits are less focused on intellectual discussion and more on having fun (for better or for worse), but they still have a penchant for interesting articles.

(There was an image that hit Reddit's front page a few months ago that illustrated how the first level of comments were intellectual amd all subsequent were merely "herp-derpery"—have a look for your self.)

/r/truereddit is pretty thin on discussion, but usually good for an interesting read.

Edit: Also, having now read some of the thread under discussion, the top-level tree is garbage, but the subthreads after that are mostly pretty thoughtful.

The link was not to /r/programming it was to /r/reddit.com. /r/programming has it's own problems, but these comments are definitely not representative of that subreddit.

Reddit's down. This appears to be the same thing.

http://imgur.com/vNqt3

Anyone have a mirror?

This is the image linked in the post: http://i.imgur.com/vNqt3.png

Man gets 18 years in prison for hacking account and inflicting unfathomable psychic damage, making his victim feel vulnerable in their own home.

Commenting on an aggregator to a link to an aggregator with a link. Feels like Inception. Someone should post this on digg and go to the 3rd level.

When did "found out that an FTP password is 'password'" start to be something that is a 'counterhack'? Except in Hollywood movies?

Replace the headline with 'Guy that seeks naive people for his phishing site is too dumb to use his own software'.

Hmm. I wonder if I could do a Fermi estimate on the amount of time wasted by this pointless discussion? Let's call this Rob's Fermi Hack on Hacking "Hack":

- We'll start with a semi-reasonable approximation of the number of forums in which people have discussed the word "hack": usenet threads, mailing lists, social news sites. I like 100,000 for this number. Do you think that's too high? I'm thinking that we have to count everything that's been around since, oh, 1995 or so -- since hackers didn't really seem to care about the definition of the word before then.

- Then we need the mean number of times that this discussion has taken place on those forums. According to my semi-private little search engine for HN, the query `comments with "hack"` returns 45,000+ results, going back to 2008. Amusingly, the oldest result is about exactly this same debate. So let's use 100 for this value, because why not?

- Next we need the mean number of replies generated each time this comes up on one of these forums. Let's say "3". I like "3", because my comment here is the third in the thread started by your comment, and I expect my comment to so dazzle readers with its brilliance that nobody else will bother responding. So, 3.

- Finally, we need some kind of time estimate for time-blown-masturbating-about-"hack"-per-comment-per-forum. I'm skewing the curve a bit here with my comment, but that's because I'm a sucker for meaningless gratification. Anyway, let's say 2 minutes for this, because I haven't used the number "2" yet. (I think Fermi is now spinning at relativistic speeds in his grave.)

So we get: 100,000 * 100 * 3 * 2, for 60,000,000 minutes, or 1 million hours, which would probably be enough to write and polish an entirely new operating system from the ground up.

And that would be a neat hack.

(FWIW: I agree with you, especially when the word "hack" found its way into all kinds of silly little timesaving tricks -- "hack your breakfast routine by using paper bowls!" -- but, at this point, seeing someone mention that they disagree with its usage every single time it's used is even more annoying. That battle was lost. The horse is dead. It's time to stop beating it and move on.)

as i understand it:

1) the bad guys found a website who's owner had the password as 'password' and set it up to receive phishing scam data.

2) the good guy found the phishing site and using the same 'password' he changed the phishing HTML, personally called the people who had been scammed so far and then deleted the data.

if you call #1 a hack then #2 has to be a counterhack

Responding to one illegal action with another illegal action is not exactly praiseworthy in my book.

Your book stinks. Standing by while people are taken advantage of and robbed should not be praiseworthy in anyone's book.

> Essentially on discovering I had the power to stop this illegal act without causing any harm, I felt morally obliged to do it.

This guy is a real human and a good man. You sound like a robot, legality is black and white and you don't even bring morality into question.

His entire comment: http://www.reddit.com/r/reddit.com/comments/io76r/i_received...

Tangentially: check out Kohlberg's Theory of Moral Development (http://en.wikipedia.org/wiki/Kohlberg%27s_stages_of_moral_de...) -- people start to make more sense once you get your head around the theory (if you decide that it seems valid).

So, comments like the grandparent's are just examples of the law-and-order stage of moral development, whereas yours are an example of either the fifth or six stages.

When did I ever say anything about standing by?

My sincere apologies, that was a big and incorrect assumption on my part.

"Not responding with another illegal action" is not the same as "idly standing by."

Sometimes legality and morality don't intersect. This is one of those times.

Also, the OP of the reddit article is not a US citizen or resident. Not entirely sure if his actions ARE illegal in his jurisdiction, wherever it is.

Edit: In fact one poster on the reddit post pointed out specifically that in France it would be expressly legal.

Thanks for that. Other sibling posts to yours all seem to be taking the position that "the end justifies the means". That's not what's in effect here at all. In this case there's no such corruption, it's purely engaging in a moral action in defense of those being acted upon immorally.

This is not an example of utilitarian ethics, with the greatest good for the greatest number, or diverting a runaway streetcar to avoid five people on the tracks, at the cost of striking a single person on the other track.

You Lawful - Good people really need to check out how life is in this Chaotic - Good corner. We're living life to the fullest over here.

> You Lawful - Good people

I don't think GP is lawful-good. lawful-neutral as best, potentially lawful-evil. A lawful-good character would not do nothing when facing evil, and would not chide others for acting.

I am not chiding him for acting. I am chiding people for praising his actions.

What's the difference?

The difference is the impact it will have on our society. Isolated cases of illegal actions, to support the greater good, do have their place. But praising it to the world is going to play on others' emotions, encouraging them to do the same in the future. It is a slippery slope. People will be doing it for the attention in the future, not for the greater good.

And there ARE legal actions that can be taken in these scenarios. The worldwide praise of this act will encourage people to not even look for legal alternatives. Vigilante justice will prevail, and over time that damages the greater good.

Fair response. I am not sure I buy the "slippery slope" argument, especially with the intensity of the change you suggest at the end, but fair enough.

Exactly what would you have done had you come across that situation?

I'd guess nothing, like just about everyone else here.

Report the incident to people with authority to act on it. Law Enforcement, his ISP, his data provider... anyone really, who has a legal right to stop the behavior.

In my experience, you've just proposed doing nothing.

And if you have good reason to conclude nobody is going to do anything? (Law enforcement has 'real crimes', the ISP is effectively bought off, nobody else cares.)

Somebody needs to watch Boondock Saints...

And that's why those of us who are evil-aligned are having fun getting stuff done. Being a paladin is all well and fine, but it keeps you from actually benefiting mankind sometimes. "The hottest places in hell are reserved for those who in times of great moral crisis maintain their neutrality", as JFK said.

Reply on news.ycombinator.com