That isn't how private torrents work. They contain a key that identifies the user who downloaded it, for bookkeeping purposes on the site (tracking bytes in and bytes out for ratio purposes), but you cannot get into the site's UI from the information in the torrent. This was a deliberate design decision in most private tracker software, notably Gazelle, because it was accepted that people would post the .torrent files in other places. Many trackers also limit the IP addresses that are permitted to join a swarm based upon the same identifier in the torrent file; all of the ones I've been in have required me to disclose the IP addresses of my seedboxes, and attempting to use another IP address would get my account flagged for a ban.

So no, your assumption is completely incorrect. Even if someone shoved a passthepopcorn torrent in there, (a) that person would likely get banned from ptp, (b) it probably wouldn't work in the first place because joker's servers couldn't join the swarm and (c) the information that the owner of joker can glean from such a torrent file would be almost entirely useless unless the goal is boosting the ratio of the user.

As much as you'd assume about something you've never used, private torrents are actually a well-oiled, quite secure machine. It's easy to think of pirates as incompetent, but Gazelle is actually decent software and the biggest problem I ever faced while involved in that scene was DDoS attacks against the trackers.

>This was a deliberate design decision in most private tracker software, notably Gazelle, because it was accepted that people would post the .torrent files in other places

Err no. Passkeys were designed so that you could track users without needing IP address -- IP tracking is fragile and doesn't work with multiple peers/ip, which happens very frequency.

> Many trackers also limit the IP addresses that are permitted to join a swarm based upon the same identifier in the torrent file

Once again, not really. Most sites don't really care what IPs you use (so long as they aren't part of blanket banned regions or similar). PTP does not require you disclose your IP, they don't care if you use multiple IPs, and doing so will not flag you for a ban. There are better ways of finding bad users, which includes sharing between trackers.

>(a) that person would likely get banned from ptp, (b) it probably wouldn't work in the first place because joker's servers couldn't join the swarm and (c) the information that the owner of joker can glean from such a torrent file would be almost entirely useless unless the goal is boosting the ratio of the user.

A) No, they wouldn't.

B) Unless joker.com is using a custom bittorrent app (highly unlikely) they can join the swarm just fine

Charming - it's been a while since I've touched a torrent, let alone a private one, things have obviously changed. Last time it was around, the equivalent of an API key was stored within the torrent file, allowing anyone in possession of the file 'access' to the website. By access, I mean access to RSS feeds and the like, allowing someone to effectively utilise the account with HTTP(S) calls.

Edit: Still appears to be the case. Get the users unique code (call it what you will) from the .torrent, and understand the RSS URL structure for said website, and you've got yourself download links for all the torrents by using someone else's account.