Just wow...

>One of my favorite low key social engineering hacks is that I used to have a keylogger installed on every machine I own. Whenever a friend needs to hop on my machine to show me something, they'd log into an account they own and I would have their password.

This isn't a "low key social engineering hack", it's betraying someone's trust.

>I would sit next to them and subtly jerk the mouse pointer right before they were about to click on something and it drove them mad for a good 20 minutes before I couldn't hold onto the giggles anymore.

This isn't actually funny, it's just being obnoxious and mean.

If you're next to them why not just jerk their arm when they are trying to click? It achieves the same "goal" of "entertaining" yourself and pissing the other person off. Jerk their laptop when you walk by. Throw stuff at them. Smack them in the head. Trip them when they get up to pee. "Hilarious."

>among a group of friends where everyone was trying to hack everyone else and pretty much anything was considered fair game.

This sounds like the bully saying "we were all having fun together."

You don't know the difference between having fun with someone and having fun at their expense - and that's just disturbing.

As someone who lived during the Windows 98 era, I wouldn't want others reading my IMs and emails (I had some very sexual and personal communication over those channels) or viewing my browsing habits.

> This isn't a "low key social engineering hack", it's betraying someone's trust.

I've known some kids who went through a phase where you would ask them something like "Did you clean your room?", they'd say "Yes!" and then later, upon confronting them with their messy room, they'd get this self-satisfied sneaky look, and cackle: "Hah! I tricked you!"

While I sympathize with the David-and-Goliath allure of reversing the power-relationship between them and the adults in the household, I tried to explain that such direct lies weren't quite the kind of devious tricksterhood that gets a celebration.

Cmon, man. You've never heard of someone "hacking" a facebook account and changing the profile picture to a poop emoji or something?

It is juvenile prank, sure, but high schoolers are literally juveniles.

Obviously, you shouldn't do stuff like this to someone who will freak out and get upset about it.

Persistent bullying and harassment is, of course, not ok. But most "cyber crimes" that high schoolers commit against each other are NOT that. They are dumb pranks like changing a person's sexual orientation on facebook.

For most situations, the vast majority of kids would just be embarrassed for like 10 seconds, laugh, and maybe try to prank the person back.

Yeah but there's a big difference between 'hacking' a friend's Facebook or MySpace account, since it usually happens if they just leave the account open on a computer, and actually keylogging their password.

> For most situations, the vast majority of kids would just be embarrassed for like 10 seconds, laugh, and maybe try to prank the person back.

That seems to imply that very little bullying occurs through such means. I'm sceptical of that.

Entirely depends on age and context. When I was a teen the group of friends I ran with would be constantly attempting to "hack" the other, so you were always on guard. Honestly I attribute that more than most things to my early interest in computer security and getting my foot in the door with programming. It turned into a pretty nice career so far. Sure it got tiring sometimes, but overall it was a great life experience I wouldn't trade for anything.

We also kept this between ourselves. It's a much different situation if I "pwn" my friend who is attempting to do the same back to me vs. a typical normal kid.

Those practices learned put myself and my friends in a pretty unique mental space for the time. It was an age in time where all this stuff was new, computers truly did not do as much important life stuff, and being a teenager playing pranks and cat and mouse was fun. Just this stupid "real world" experience in your mid/late teens was enough to typically get an entry level job in IT - typically starting off with more skills than your superiors.

What was NOT OK were the few guys who never grew out of that BS. I ended a business partnership after I found out my "partner" had opened my workstation and removed the BIOS battery to reset things, and install a keylogger. At that point it's no longer funny, it was not a novel or interesting attack, and was simply being an untrustworthy asshole.

I'm really happy you weren't a friend of mine in those days. Turnabout was fair play and compromising each others machines was a way to learn the basics of security. People would see a good prank as a being handed a choice bit of meat: time for revenge :)

Jesus what an overreaction. You've never played a prank on someone or had one played on you? My friends and I in high school did this exact kind of stuff and it was a lot of fun. We just learned to be paranoid about being pranked, it wasn't some pseudo bullying outlet. If anything it taught us that people can hack your stuff, so don't be an idiot. To this day I still don't log on to any accounts on any public computer or even a friend's computer. How often do you go to a computer lab or library and see that somebody forgot to log out of their Facebook or Gmail account or something? Maybe if their friends screwed with them when they were kids they would know better.

Sure, I've been pranked (old shaving cream on the hand while sleeping comes to mind) and I'm sure I've participated in pranks but none come to mind right now.

HOWEVER, there's a huge difference between a harmless prank and betraying someone's trust to be mean to them. I consider keylogging and pwning someone's machine deep into the in the "asshole" category. I also think that jerking someone's mouse when they are trying to click is not clever, just annoying, not funny. Especially because it could more effectively be done physically. It's in the same league as tripping someone when they walk by - just dick behavior.

A prank is something the pranked can laugh at, not just the pranker.

Since I was just leaning to explore my sexuality during that time and my IM messages and emails reflected that I'd be pretty horrified to know someone stole my password, pwned my machine, and read them. Like, seriously horrified and very violated.

You call shaving cream on the hand a prank? VANILLA! (just kidding) Idk. I guess we were bad kids when I grew up because we would hack each other's runscape accounts and stuff and drop each other's stuff or transfer it to a fake account and hold for IRL ransom until somebody made you breakfast or something along those lines. Or we would watch somebody type their password on their laptop and if we caught it we would put a gross or lame picture on the desktop. I think if anything it actually built trust and friendship between us. Of course there was some drama once in awhile or you'd really make somebody mad, but at the end of the day we all stayed friends, and still are over a decade later. We had a lot of laughs, but it was like, ok who has the group not picked on recently? Time to prank them.

So while I understand in cases like yours it can be bad, I think calling for legal action and generally freaking out about it as a general rule is pretty lame. Kids will be kids. Shit happens. Life happens. Don't let people use your computer.

So you steal passwords from people who trust you and consider you a friend?

If you were befriending someone with the sole intention of getting their passwords, that might be considered social engineering.

If you are just exploiting the existing trust of friends and family for fun, that's sociopathy.

> One of my favorite low key social engineering hacks is that I used to have a keylogger installed on every machine I own. Whenever a friend needs to hop on my machine to show me something, they'd log into an account they own and I would have their password.

Is that legal? Seems like a good way to get sued/arrested if you annoy the wrong person, or your 'friends' ever report you for it.

But seriously, that's pretty messed up either way really. You're exploiting people that think you're friends with them to get information from their computers without their knowledge. It's at best not ethical and worst not legal.

He was talking about high school shenanigans. ¯\_(ツ)_/¯

Kids play pranks on each other. Thats not going to be the end of the world, and nobody is going to be sent to jail.

He also explicitly said that everyone was doing it to everyone else, so obviously this isn't some cyber bullying scenario where someone is getting seriously hurt.

I remember people doing lots of dumb pranks like this in high school, and nobody ever got emotionally scared because someone "hacked" their facebook page (because it was left open as someone went to the bathroom) and changed their "interested in" profile section to "men".

Jeez let's call the FBI because of these high school friends playing pranks on each other. Maybe we can get one a criminal record or a large fine. That'll really solve this "problem" and teach those kids "lessons". I can't believe that on hacker news of all places people are talking about the legality of kids in high school playing pranks on each other with computers. You guys sound just like the government.

HN has been a site for the masses for quite some time now. In other words, the quality is severely degraded.

I mean, apart from the moral issues here, what you are doing is illegal.

And that's fine, if it wasn't for the fact that your HN profile advertises your business.

Do you also do this to your clients?

Ahahahah

What a great world we live in!

I also did this as a stupid teenager. Regretted ever doing it, friends got super mad at me when I came clean. There are some things that you just shouldn't know about, reading private conversations where your friends talk about you and say what they really think of you can be really depressing.

Where's the social engineering part? Trying to convince people you aren't a scumbag so they become your friend long enough for you to swipe their password?

I mean, I'm pretty sure that is social engineering, doesn't make them any less of an asshole though.

You could easily see something you shouldn't want to see. Not cool.

You can never un-see or un-know something. If you wonder just what kind of spot that can put you in, just keep hacking your own friends... I suspect any one of us would eventually see something we'd rather not have.

I'm apparently the only person who thinks this is indeed funny. Wouldn't be cool with it as an adult, would find it totally hilarious as a teenager.

so you would act like a bro and then stab your friends in the back by exploiting your fake friendship with them to get their most personal information and then leverage that to mess with them (after you have explored their accounts a bit looking for anything that was funny or that you could use to exploit, of course), but later you would giggle about it.

so it was just a prank?

what part of this is social engineering and not you just being a piece of shit?

I'm happy not to be your friend.

I wrote a keystroke logger for Windows, but I've never used it outside of demonstrations. Doing so may be illegal, so talk to a lawyer in your state to get the facts. Here's the source code:

https://github.com/w8rbt/keycap

That's just being an asshole, don't use fancy words about it.