Who can I hire to hack me?

Re:Who can I hire to hack me? by tptacek on Sunday March 31, 2019 @11:44AM (#19536142)

You probably can't reasonably pay someone to attack third parties that protect your information. For instance, at several of the startups we run security for, even with your password, a suspicious new pattern of login anomalies will generate an investigation that will consume resources on our end, and we'd be pretty pissed to find out that we'd done it because of a stunt you paid for.

[ Parent | on HN ]

Re:Who can I hire to hack me? by lukecameron on Sunday March 31, 2019 @11:55AM (#19536231)

While I agree with the general unfairness of this, on the other hand we currently have an ecosystem where SaaS products are used by most people to get their work done and generally manage their lives.

Shouldn't we have the right to know or be able to check how secure our data and identity is on these services?

[ Parent | on HN ]

Re:Who can I hire to hack me? by tptacek on Sunday March 31, 2019 @11:56AM (#19536235)

No. As a matter of fact, you do not have the general right to "check" how secure a SAAS provider is.

[ Parent | on HN ]

Re:Who can I hire to hack me? by danShumway on Sunday March 31, 2019 @12:26PM (#19536414)

> Shouldn't we

> you do not

I don't think this answers the question. Of course unsolicited pen testing is already illegal; that's not an interesting question imo. What I'm more curious about is security industry opinions about whether or not the current law is a good idea.

Are there any changes you would make to the law if you had the ability to do so, or do you see a more general danger in allowing customers to attack their own accounts?

[ Parent | on HN ]

Re:Who can I hire to hack me? by tptacek on Sunday March 31, 2019 @12:35PM (#19536469)

I would change the way CFAA charges are sentenced. I would not eliminate the general prohibition on hacking other people's computers.

[ Parent | on HN ]

Re:Who can I hire to hack me? by goshx on Sunday March 31, 2019 @12:17PM (#19536349)

We get "checked" multiple times on a daily basis. How do you deal with those?

[ Parent | on HN ]

Re:Who can I hire to hack me? by tptacek on Sunday March 31, 2019 @12:20PM (#19536368)

Some SAAS companies set up bug bounties that offer explicit permission to test. Some companies offer that permission without a bounty. In the absence of either of those conditions, much of what a pentest firm would do to check the security of a website is a federal crime.

It's not a crime that is routinely prosecuted (at least not in the US; there are horror stories from the UK). But that doesn't mean it's safe to build a business around that activity.

(To be clear: I'm saying this about general security testing, not taking over someone's account who's paid you to do so. That's not criminal, just sort of unethical.)

[ Parent | on HN ]

Re:Who can I hire to hack me? by goshx on Sunday March 31, 2019 @12:29PM (#19536429)

How does a business like Acunetix still exist if that's really the case? Anyone online can use their services to check any website.

[ Parent | on HN ]

Re:Who can I hire to hack me? by tptacek on Sunday March 31, 2019 @12:33PM (#19536457)

Acunetix sells a product that you can use lawfully or unlawfully. In the very unlikely event you were to find and later exploit a serious vulnerability in a major SAAS company using the Acunetix scanner, it would not be Acunetix that the lawyers would target.

[ Parent | on HN ]

Re:Who can I hire to hack me? by beardedwizard on Sunday March 31, 2019 @07:29PM (#19539165)

Really not true at all, it's a matter of contract negotiations and deal sizes.

[ Parent | on HN ]

Re:Who can I hire to hack me? by tptacek on Sunday March 31, 2019 @07:34PM (#19539196)

You do not have a general right. Obviously, 3rd-party penetration tests exist, and obviously there are a variety of things you can do short of actual testing to "check" security.

[ Parent | on HN ]

Re:Who can I hire to hack me? by YjSe2GMQ on Sunday March 31, 2019 @11:49AM (#19536185)

I imagine that if there was a larger market for this people like you would allow personal pen-testers to pre-register their attempts. Just out of necessity.

[ Parent | on HN ]

Re:Who can I hire to hack me? by progval on Sunday March 31, 2019 @02:41PM (#19537386)

On the other hand, you might be able to profit from this, if these third parties are able to find vulnerabilities in your process. Free security audits.

[ Parent | on HN ]