Live data from Hacker News

I exploited existing YouTube videos with a fake Patreon profile

lucas03.com

61–70 of 70 posts

Re: I exploited existing YouTube videos with a fake Patreon profile

#61
post #55

Earlier quoted context omitted.

The writer at the end refunds the money and messages Patreon to fix the issue, I think that would go massively in his favour in the rare change it ended up in front of a judge.

Yes, this is called white-hat or ethical hacking, a well-established concept even at the government level.

No it isn’t. White hats are very careful to ensure that their work does not affect other people. “I gave the money back” isn’t good enough.

Re: I exploited existing YouTube videos with a fake Patreon profile

#63

Earlier quoted context omitted.

Nah. It's not fraud if they don't get any benefit from it. Since they refunded the single, solitary person who pledged $3/month, then shut it all down, it's all good from the fraud angle.

A dead comment asked if stealing 100 dollars if fine if you give it back. So I'll chip in that for basic theft, one of the core elements is intent to permanently deprive the original owner. So if someone steals money, changes their mind, and then returns it, that's still theft. And taking money to spend, with a promise of returning money later, still counts as theft. But if the intent all along was to return it the n…

Everyone in this thread should read

www.criminaldefenselawyer.com/resources/criminal-defense/criminal-offense/what-difference-between-joyriding-stealing-a-ca r

Re: I exploited existing YouTube videos with a fake Patreon profile

#64
post #55

Earlier quoted context omitted.

Yes, this is called white-hat or ethical hacking, a well-established concept even at the government level.

No it isn’t. White hats are very careful to ensure that their work does not affect other people. “I gave the money back” isn’t good enough.

This is not always possible, however. How should the hacker have proceeded in this case?

Re: I exploited existing YouTube videos with a fake Patreon profile

#65

Earlier quoted context omitted.

No, theft is theft, regardless of whether or not you return the item later. There is no loophole that allows people to temporarily steal things as long as they kindly return them later.

The parent isn't claiming that it's legal to take something so long as you have intent to return it. Just that the standard definition of theft requires "permanently" as an element, and maybe taking something temporarily would be some other crime. See the model penal code[1] "(1) "deprive" means: (a) to withhold property of another permanently or for so extended a period as to appropriate a major portion of its econo…

We’re so deep into pedantry that we’re missing the point of the conversation.

To clarify, most jurisdictions have definitions of theft that will be true even if you only deprive the person of their property for a short period of time:

> Today, many states have extended the definition of theft to include depriving the owner of the property even for a short period of time, thus rendering unauthorized borrowing as theft.

From https://lawshelf.com/shortvideoscontentview/theft-crimes-a-s...

So yes, maybe there is some jurisdiction somewhere that wouldn’t define unauthorized borrowing as theft, but chances are good that if you borrow something without authorization, you can be guilty of theft (among other things) in most jurisdictions.

Re: I exploited existing YouTube videos with a fake Patreon profile

#66
post #64

Earlier quoted context omitted.

No it isn’t. White hats are very careful to ensure that their work does not affect other people. “I gave the money back” isn’t good enough.

This is not always possible, however. How should the hacker have proceeded in this case?

Pushing beyond the account creation step wasn't necessary. Enabling the payment functionality is where it deviated into black hat territory.

Re: I exploited existing YouTube videos with a fake Patreon profile

#67
post #64

Earlier quoted context omitted.

No it isn’t. White hats are very careful to ensure that their work does not affect other people. “I gave the money back” isn’t good enough.

This is not always possible, however. How should the hacker have proceeded in this case?

By stopping. If it is not possible for you to penetrate a service without causing disruption or harm to others, then you stop. You could reach out to the business and say "hey, you should consider checking this out" or asking if they offer some sort of test system for pentesters. But sometimes the result is just to not proceed at all.

Re: I exploited existing YouTube videos with a fake Patreon profile

#68
post #64

Earlier quoted context omitted.

No it isn’t. White hats are very careful to ensure that their work does not affect other people. “I gave the money back” isn’t good enough.

This is not always possible, however. How should the hacker have proceeded in this case?

If he'd _needed_ to test payment (arguable), he could have created a 'real' account, deleted it, squatted his own deleted account, and sent payments to it himself.

Re: I exploited existing YouTube videos with a fake Patreon profile

#70

"I discovered this neat new hack called 'fraud'"

Social engineering is a hack.

I never said it wasn't.

I am just saying that in security, while it can be very difficult to always find where the line between ethical and unethical conduct is; and what will get a company to pay attention to an issue without getting yourself arrested;

What I AM saying is that this person blew so far past that line that I wonder if they are even aware that one exists. All without even considering that, maybe, "that time last week when I committed wire fraud" probably isn't the best topic for a blog post.

Do I think that the author was acting maliciously or in bad faith? No. But the US justice system has a really nasty habit of not taking facts like these into account; as Aaron Swartz tragically learned.

Tl;dr "it's just a prank, bro" is not an effective legal defense, and prosecutors fucking LOVE convicting hackers.

Post reply on HN