full-disclosure - Re: Large password list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 02 Dec 2011 16:23:10 -0500
From: Valdis.Kletnieks@...edu
To: Travis Biehn <tbiehn@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Large password list

On Fri, 02 Dec 2011 13:40:54 EST, Travis Biehn said:
> My password leaks will all be released under the GPL.

That may not be legally allowable, for one of several reasons:

1) Most password lists are almost certainly "mere aggregations of facts" and thus
not eligible for copyright protection at all.  This would almost certainly be true for
any list of passwords from one source, as it would almost certainly be programmatic
with little or no creative input, and probably true for groups of sources.

2) You can get around that by claiming it's a "compilation". 17 USC 101 says:

A "compilation" is a work formed by the collection and assembling of
preexisting materials or of data that are selected, coordinated, or arranged in
such a way that the resulting work as a whole constitutes an original work of
authorship. The term "compilation" includes collective works. 

And you can probably make the case that the choice of which sources to include
in the compilation constitutes an original work.  Congrats. You now have copyright on
the compilation - but *not* on the individual passwords.

3) Unfortunately, the individual users still have the copyright on their passwords/hashes,
and unless you get their permission, you can't relicense the passwords/hashes under GPL.
And there's also the compilation copyright the site has on the list of all passwords at their site 

:)

(For real fun, consider that published and unpublished works are treated differently.  And
a password list almost always becomes a published work without the permission of
the author(s) ;)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/