Slashdot Mirror
Email Provider ProtonMail Says It Hacked Back, Then Walks Claim Back (vice.com)
An anonymous reader shares a report: On Wednesday, encrypted email provider ProtonMail claimed it had hacked someone who was impersonating its service in phishing emails, and the company then swiftly deleted the tweet. Early Wednesday morning, the security researcher known as x0rz tweeted out a series of screenshots allegedly showing someone sending emails that directed targets to a fake ProtonMail login screen. "You have an overdue invoice," the message read. In response, ProtonMail said it had taken action. "We also hacked the phishing site so the link is down now," ProtonMail tweeted. Depending on the context and what exactly the retaliating organization did, hacking back can be illegal. Hacking could violate the Computer Fraud and Abuse Act, or perhaps even wiretapping legislation. A recently proposed bill would attempt to legalize the practice. ProtonMail swiftly deleted its tweet, but not before x0rz could grab and subsequently tweet a screenshot. x0rz then deleted his own tweet at the request of ProtonMail.
the security researcher known as x0rz
oh, please. not an actual security researcher.
So apparently, this is some amateur-hour outfit? I thought they were supposed to be technically and legally astute.
They either don't have lawyers, don't know when to talk to them, or don't listen to them. Or they let random idiots post on their Twitter feed.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
You cant legally but hey can
They probably figured out they hacked a government phishing operation.
Maybe not enough to be prosecuted (USA is a known knee-jerk place for prosecuting anyone they could because some prosecutor is hunting their career). Anyway I doubt the phishing site will press charges.
This article mentions the CFAA, however ProtonMail (and Proton Technologies AG) seem to be located wholly in Switzerland, so this law would not apply. I am not sure of any equivalent laws Switzerland may have.
They hacked the man behind the curtain didn't they?
x0rz found the tweet, posted it and then ProtonMail told them who they hacked and x0rz promptly yanked down their post too!
If that's not "oh sh--!" moment, I dunno what is!
If that is indeed true they violated the computer fraud act and opened them selves up to legal actions.
Hacking could violate the Computer Fraud and Abuse Act, or perhaps even wiretapping legislation.
This is clearly a reference to US law. ProtonMail is based in Switzerland, hence, US law is utterly irrelevant. I know that most /.ers are located in the US, but your country does not encompass the world.
Of course, we have our own laws regarding electronic breaking and entering, and IANAL so I'm not going to speculate about the legalities here. Just wanted to point out that ProtonMail is not a US company, so comments about US law are off-base.
Enjoy life! This is not a dress rehearsal.