Note: I realize there is no legally binding talk hereinafter.

There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep web" servers. As security yokels, we find it interesting to see how secure (or insecure) these dumps are; many are from reputable entities. To that end, it would be fun, interesting, and provide good experience to crack some of these dumps.

A court had previously found a man guilty, as Thomas pointed out in this answer, for simply running a password cracker, but this was expunged (as if he never did anything wrong). In addition, gimmiky articles have journalists writing about how they've cracked passwords.. I doubt they'd be shouting it if it were illegal.

So, is there any legal risk at visiting one of these "dump servers", downloading the hashdump, and cracking passwords? At what point do you metaphorically "cross the rubicon"?

Obviously, using any cracked passwords would just be rude.

closed as off-topic by Adi, TildalWave, Xander, Steve, AJ Henderson Feb 19 '14 at 21:48

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    This question appears to be off-topic because it is about legal advice which, even if valid, most of the time can be locale-specific. – Adi Feb 19 '14 at 13:13
  • 2
    @Adnan: "Laws - Answers on laws, regulations and licencing should not be taken as legally binding - we're security professionals so deal with legal issues, but this site is not a law site." There are 147 questions on this site about legal issues. There is a "Legal" tag. – Rubber Duck Feb 19 '14 at 13:35
  • 1
    I'm not saying all legal questions are off-topic, I'm saying your legal question (this question) is off-topic. There are numerous laws that can be broken, each case of this sort (even the speific kind you're mentioning) is a case of its own, with its own circumstances and context. So you're question would be extremely specific. Paradoxically, your question is extremely broad as well. There are, literally, thousands of jurisdiction with their own governing laws that handle each and every case separately. Addressing it on that level would take pages. Talk to your lawyer. – Adi Feb 19 '14 at 14:27

Starting with the huge caveat that this may or may not apply based on your locality and is not in any way legal advice, a large portion of cybercrime laws are based around illegally accessing resources. If you use a computer system in a way that it was not intended to be used, you could be prosecuted by the owner of the system. This is essentially laws in the vein of trespassing.

Now, one could make the argument that the list is stolen goods, however that often doesn't really hold up very well as it isn't stolen, it is a copy. The copy was obtained by trespassing to get it, but the information itself (unless protected by intellectual property somehow) is not actually stolen. It is the user's copy even if illegally obtained.

In most cases, that means this information can be distributed just as freely as any other leak. The copy of the file belongs to the attacker and if they release it, then accessing it is probably legal.

Now, that could be wrong if your local jurisdiction may have laws that make it illegal specifically, but it becomes a tricky slope if you are responsible for determining if every single thing you access was legally obtained. Again, most of the precedent of this kind of thing stems from intellectual property and is most often civil law rather than criminal.

One thing is certain, it is a complex legal issue with no immediately clear solution. It will take time for the legal system to catch up with the 21st century in a way that helps prevent cybercrime but that doesn't cause unintended consequences at the same time.

Your best bet, as always, is to talk with a lawyer in your local jurisdiction that is up to date on the laws where you are rather than talking to a random developer on the internet that just happens to follow the applicable laws half hearted and casual.

  • So, your answer basically says "This is complicated. Talk to your lawyer as we're not law experts". Which could have been put as a comment under the question. – Adi Feb 19 '14 at 14:29
  • @Adnan - basically, though it goes in to a little bit of a primer as to what the basis of the laws are. That's about as far as I think we can comfortably go here, but it is more information than the asker would otherwise have. I'd say the answer is more "it should be legal baring any unique local legislation, but such laws will probably start appearing soon if they haven't already" – AJ Henderson Feb 19 '14 at 14:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.