Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Found a leak of US citizens personal data. Should I report it?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 85 posts

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#41

Post by loktarogar »

coffeeblack wrote: post #32
lucasyvas wrote: post #26

If it were me I'd honestly do nothing. History has shown it's equally likely to be a lose-lose scenario. Let it remain as-is. If it's related to protecting children or a vulnerable group, maybe report it. Otherwise, whatever. Either way, don't do it in a way that they know it was you who found it.

Isn’t any group “vulnerable”? What does that word even mean?

Vulnerable groups are physically, mentally, or socially disadvantaged persons. Can be groups like disabled folks, migrants/refugees, and children.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#42

Post by aborsy »

lpapez wrote: post #40

The fact is that you gained unauthorized access to personal information, which might be a criminal offence in your jurisdiction despite your honorable intentions. My advice is to let it go and not implicate yourself any further. Relevant personal anecdote from the EU: one time I was checking the API of a service I wanted to use and managed to obtain full access to the database which among bunch of PII also contained…

Just send from an email not under your real name.

Further, I am not sure the company can prove this is unauthorized access when they provide the data without requiring authentication (through negligence). They could claim, we made it open to public but the public is not supposed to download it, but this is a difficult claim, eg, it should have been clearly stated in their website at minimum. It’s a bit like public photography.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#44

Post by zamnos »

waihtis wrote: post #36

Look for a www.domain-of-the-company.com/security.txt file. That's where you might find a responsible disclosure contact if the company has one (high chance they don't)

https://www.netflix.com/security.txt exits, but Apple, Google, Microsoft, and Meta don't have one.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#45

Post by lun4r »

Several commenters suggest to do nothing to stay out of trouble. What if the system is compromised by someone else, possibly with bad intentions, tomorrow? You might already have left traces. If an investigation is conducted it could lead back to you. Not reporting it could get you in a lot more trouble. Read up on the topic of Responsible Disclosure. Or consider reporting it through a lawyer and journalist, as others have suggested

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#46

Post by zamnos »

You should yes, but world is full of "shoulds" that aren't followed, often for entirely valid reasons. If the organization doesn't have a public bug bounty program, then I wouldn't report it to them - find an intermediary to whom you can anonymously dump the information to. Even something as trivial "view source" is liable to get you investigated for 'hacking', which is a hassle you just shouldn't have to deal with - here's the story of a journalist in Missouri who had that happen to them.

https://www.vice.com/en/article/pkpmj7/this-is-the-hacking-i...

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#47

Post by zamnos »

lun4r wrote: post #45

Several commenters suggest to do nothing to stay out of trouble. What if the system is compromised by someone else, possibly with bad intentions, tomorrow? You might already have left traces. If an investigation is conducted it could lead back to you. Not reporting it could get you in a lot more trouble. Read up on the topic of Responsible Disclosure. Or consider reporting it through a lawyer and journalist, as other…

Depends on how good OP's opsec is as a security researcher. If they're any good, they should know what traces they left. Did they use a VPN via a coffee shop's wifi, or did they connect from home. Canada is a different country from the US though, so it might be time for them to lawyer up and see how extradition works for CFAA violations.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#48

Post by lpapez »

aborsy wrote: post #42
lpapez wrote: post #40

The fact is that you gained unauthorized access to personal information, which might be a criminal offence in your jurisdiction despite your honorable intentions. My advice is to let it go and not implicate yourself any further. Relevant personal anecdote from the EU: one time I was checking the API of a service I wanted to use and managed to obtain full access to the database which among bunch of PII also contained…

Just send from an email not under your real name. Further, I am not sure the company can prove this is unauthorized access when they provide the data without requiring authentication (through negligence). They could claim, we made it open to public but the public is not supposed to download it, but this is a difficult claim, eg, it should have been clearly stated in their website at minimum. It’s a bit like public ph…

Sending anonymously could work if possible, here you have to be authenticated with your government email, otherwise they just ignore it.

On the other topic: it definetly isn't anything like public photography you mentioned, at least not in my jurisdiction. Here it is enough that the company says "you were not supposed to see that data" and that is enough to claim unauthorized access. It is then up to the court to prove that they had adequate protections etc.

The OP says they are based in Canada. It definetly warrants hiring a lawyer to get advice on this matter, but IMO it is not worth it at all. The best possible outcome is getting a tap on the back and a thanks from the company, the worst possible outcome is legal proceedings. Expected net gain is negative.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#49

Post by j3th9n »

sixhobbits wrote: post #10

Maybe tell someone like Troy Hunt from haveibeenpawned. He has a pretty good reputation/following for verifying this kind of thing and telling the right people.

Telling divd.nl (Dutch Institute for Vulnerability Disclosure) can be a good option too.

Re: Ask HN: Found a leak of US citizens personal data. Should I report it?

#50

Post by [deleted] »

loktarogar wrote: post #41
coffeeblack wrote: post #32

Earlier quoted context omitted.

Isn’t any group “vulnerable”? What does that word even mean?

Vulnerable groups are physically, mentally, or socially disadvantaged persons. Can be groups like disabled folks, migrants/refugees, and children.

[deleted]
Post reply on HN