|
Title: Is it OK to for a website owner to bruteforce password hashes? Post by: Apache on October 11, 2013, 09:52:13 PM I'd like to communities opinion on this. This is a hypothetical situation..... ;)
Do you guys think its OK (legally or morally) for a website owner to bruteforce the password hashes of a number of users of their website, and then use the resulting passwords to access their accounts on other websites and email addresses? Do you think it makes a difference if its part of an investigation into possible scamming? Do you think it makes the website owner less trustworthy? What if the website owner is being trusted with millions of dollars worth of BTC? Do you think its worse if the owner gave the hashes to someone else and paid them bruteforce it? What if you had proof that a website owner did this, would you prove it to the community? Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: Nixsy on October 11, 2013, 09:55:31 PM Completely immoral, Horribly wrong and possibly illegal. If you are a web master/ site owner you should not have to ask these questions.
Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: BurtW on October 11, 2013, 09:55:48 PM Why all the crap? Spit it out. Present your proof. Get on with it.
Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: pedrog on October 11, 2013, 10:20:28 PM Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: oser41eric on October 11, 2013, 10:24:49 PM Do you guys think its OK (legally or morally) for a website owner to bruteforce the password hashes of a number of users of their website, and then use the resulting passwords to access their accounts on other websites and email addresses? It is not OK, it is dumb to bruteforce the password hashes of a number of users of their website, because before the password was hashed, the password was known to the website owner :P Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: BurtW on October 11, 2013, 10:57:44 PM Do you guys think its OK (legally or morally) for a website owner to bruteforce the password hashes of a number of users of their website, and then use the resulting passwords to access their accounts on other websites and email addresses? It is not OK, it is dumb to bruteforce the password hashes of a number of users of their website, because before the password was hashed, the password was known to the website owner :P Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: fattypig on October 12, 2013, 02:31:53 AM I'd like to communities opinion on this. This is a hypothetical situation..... ;) Do you guys think its OK (legally or morally) for a website owner to bruteforce the password hashes of a number of users of their website, and then use the resulting passwords to access their accounts on other websites and email addresses? Do you think it makes a difference if its part of an investigation into possible scamming? Do you think it makes the website owner less trustworthy? What if the website owner is being trusted with millions of dollars worth of BTC? Do you think its worse if the owner gave the hashes to someone else and paid them bruteforce it? What if you had proof that a website owner did this, would you prove it to the community? I don't get it, why you wanna hack yourself? don't you already have password for all of them? Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: johnniewalker on October 12, 2013, 05:06:11 AM Of course its not ok. I remember Yahoo wouldn't even release the password of a dead soldier to his family. If I had evidence of it of course I'd share it with the community.
Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: Shallow on October 12, 2013, 05:30:12 AM What kind of a question is this ???
Title: Re: Is it OK to for a website owner to bruteforce password hashes? Post by: bludstem on October 12, 2013, 08:37:53 AM No ethical web designer would ever exploit user accounts in any way let alone cracking passwords. It is wrong of any webmaster to want to crack their user's passwords on more levels than I can even fathom. I would never recommend any behavior of this nature. I also do not recommend abusing a user's trust in any other way either.
|
