Chapter 10 — Ethics and authorized practice

Chapter 10 — Ethics and authorized practice

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Authorisation first"]
  N2["10.2 Handling sensitive material"]
  N3["10.3 Responsible disclosure"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Authorisation first"]
  N2["10.2 Handling sensitive material"]
  N3["10.3 Responsible disclosure"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Authorisation first]
    |
    v
[10.2 Handling sensitive material]
    |
    v
[10.3 Responsible disclosure]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) apply ethical rules to cryptographic testing; (2) obtain and document authorisation; (3) handle discovered weaknesses responsibly.

10.1 Authorisation first

Priya learns that testing a system's cryptography, for example scanning TLS settings or attempting to crack password hashes, requires written authorisation from its owner. Before her Chapter 7 scan, Grace signed a scope listing hosts, dates and allowed tools. Testing outside scope, even with good intentions, can break laws and trust. Dr. Echeverría tells the class that the same technical act can be legitimate research or a crime depending on authorisation, which is why professionals document it every time. Priya keeps a copy with her notes.

10.2 Handling sensitive material

During a class exercise on password strength, Priya's group receives a synthetic password-hash file created by the lecturer. They are reminded never to use real leaked password databases, which contain real people's secrets even if publicly available. Results are discussed only in aggregate. Priya learns to treat keys, hashes and personal data as hazardous materials: minimise copies, store them encrypted, delete them when done and record who had access. Group members sign a short handling agreement at the start of the exercise, and the lecturer deletes the file at the end of term.

10.3 Responsible disclosure

Later, while using a public e-book app outside her coursework, Priya notices that it sends login details over plain HTTP. She does not test further. She reports it to the vendor's security contact with a short description and a ninety-day disclosure window, following the coordinated disclosure practice her course teaches, and informs Dr. Echeverría. The vendor fixes it within a month and thanks her. She notes that exploiting the flaw to "prove" it would have been unethical and unnecessary.

Worked example

Priya documents a signed scan scope, uses only synthetic hash files, and reports an HTTP login flaw through coordinated disclosure without further testing.

Synthetic case. The vendor and events are invented.

Errors and limits

Public availability of leaked data does not make its use ethical. Disclosure without giving the vendor time can harm users.

Exercises

• EX028 — Authorisation content. What did Grace's signed scope list? Rubric: 3 = hosts, dates and allowed tools;; 2 = two;; 1 = vague;; 0 = none.
• EX029 — Leaked databases. Why must students not use real leaked password databases? Rubric: 3 = they contain real people's secrets even if public;; 2 = privacy;; 1 = allowed;; 0 = none.
• EX030 — Disclosure steps. How did Priya handle the HTTP login flaw? Rubric: 3 = stopped testing, reported to vendor security contact with ninety-day window, informed lecturer;; 2 = reported;; 1 = exploited;; 0 = none.

Synthesis

Authorised scope, careful handling of secrets and coordinated disclosure make cryptographic testing ethical.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →