There's a couple other questions already addressing legalities, ethics, and liabilities of hacking websites with open invitations.
These got me to thinking: How good of an idea is it, from a security standpoint, to be hacking these websites at all? Sure, they offer a great potential learning opportunity for those who wish to exercise their skills. But what threat could they pose to such individuals, many of whom may be playing with fires they do not yet fully understand?
Donning my tin-foil hat, some particular risks come to mind:
- The site could be a honeypot, run by government or other entities looking to gather information about active (or would-be) hackers.
- The site could be set up by a black-hat as a honeypot to gather a list of interesting, hackable amateurs to target.
- A third-party black-hat could potentially access the site's logs and farm them for data about interesting, hackable amateurs to target.
Are these concerns realistic? What's the likelihood that any or all of these could come true? Are there other ways that one's own systems could be getting put at risk (from a standpoint of security compromise, not legal matters) when being used to hack these sites?
In what ways should one try to mitigate these risks? What might be some good alternatives, if the risk is deemed too much?