Re: Large password list

[Valdis.Kletnieks () vt edu]

On Fri, 02 Dec 2011 13:40:54 EST, Travis Biehn said:
> My password leaks will all be released under the GPL.

That may not be legally allowable, for one of several reasons:

1) Most password lists are almost certainly "mere aggregations of facts" and thus
not eligible for copyright protection at all.  This would almost certainly be true for
any list of passwords from one source, as it would almost certainly be programmatic
with little or no creative input, and probably true for groups of sources.

2) You can get around that by claiming it's a "compilation". 17 USC 101 says:

A "compilation" is a work formed by the collection and assembling of
preexisting materials or of data that are selected, coordinated, or arranged in
such a way that the resulting work as a whole constitutes an original work of
authorship. The term "compilation" includes collective works. 

And you can probably make the case that the choice of which sources to include
in the compilation constitutes an original work.  Congrats. You now have copyright on
the compilation - but *not* on the individual passwords.

3) Unfortunately, the individual users still have the copyright on their passwords/hashes,
and unless you get their permission, you can't relicense the passwords/hashes under GPL.
And there's also the compilation copyright the site has on the list of all passwords at their site 

:)

(For real fun, consider that published and unpublished works are treated differently.  And
a password list almost always becomes a published work without the permission of
the author(s) ;)

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/