All i'm saying is if you find an exploit, and after you verify it works, you contunue to use it for your own personal ends, you're no longer benign and you shouldn't expect a warm welcome from the security team.
The line is when you start to use exploits on computers not owned by yourself for your own ends instead of for the purpose of verifying and reporting the vuln. Sure you could cross that line a little bit or a lot, but you're not innocent if you're over it.
I think this is what people may have been missing from your original post: at some point things can go from innocent to malicious.
"Crime of convenience" is the most common type, after all.
"I'm not the type to steal, but the cash was left on the counter, and …"
The appropriate response from the security team (after verification) is to pull the site down or immediately patch the vulnerability, if possible. Making an outbound call to a third-party is pointless and irresponsible.
And the details of different plans is not the kind of confidential info that innately deserves protection. Investigating or recording personal information would be bad, but they didn't do that.
Apply for jobs at the other companies with better plans, proceed with interviews, offers and then finally accept one and quit their job at their current employer... To reap the rewards of their malicious hacking...
What does "keep or memorize" have to do with anything? They intentionally abused a misconfiguration to view private information.
I think it's reasonable to disagree about the ethics of that, but I don't think it's really debatable that it was intentional.
"private" information is too vague of a term.
malice implies intent. If we take author at their word, there wasn't any, though you could say they took it too far by looking at other stuff they probably knew it was ethically wrong to do so.
Though, sometimes it isn't clear you're in compromising territory until you're in it.
If any of the confidential information obtained wrongly gets used to advantage … that's malice.
If the parent set out to exploit the insurer by finding inconsistent/unfair pricing, etc etc … that's malice.
What harm was done by someone comparing prices? What organization lost money? Who got worse health service?
"Unethical" and malicious is the current, profit-driven health insurance system.
I know you're coming at it from an absolutist perspective, but I disagree entirely with passing judgement.
Furthermore, the fact that you seem more upset with the person who glanced at a few plan prices rather than at the healthcare system, or the incompetent website operators, is telling.
It removes the information asymmetry, which protect the profits of the seller.
Yeah once you start using a vulnerability maliciously to obtain confidential data for your own personal gain, even if its a stupid vulnerability, you're not really good-guy security researcher anymore.
If all you did was the bare minimum to demonstrate the vuln exists, that's cool. If after you do that you continue to use it to obtain confidential info for your own gain or curiosity, that's not so cool.
> Perhaps it's more difficult to hold yourself accountable than it is to assume that others who've found your shoddy work are malicious actors.
You literally just admited to being a malicious actor in the paragraph above.