Is it possible to sue a hacker based on his mail? Some friend of mine got his mailbox hacked yesterday, meaning his entire contactlist received mails from him saying something like: I'm in a bad period in my life, I really feel sad, please mail me back. So he got warned by some of his contacts, and therefore changed his password asap. Today, he was surprised to receive no mail at all, even when specifically trying to send himself a mail from another mailbox. I immediately suspected that the pirate could have redirected his mails to another mailbox, so I checked in his parameters and found that it was indeed the case. So now we have a presumed adress of said pirate as it was written in clear in the redirection params, and the question comes: Would this be sufficient to sue the pirate for intruding my friend's mailbox ? And if so, how should he do it ?
Yes you can sue for whatever damage has been suffered. However, good luck identifying someone from an email address - they are effectively anonymous. Your friend needs to change all of his passwords immediately. The hacker has probably used the day he had to change all the passwords he could think of. This may include your bank. The hacker almost certainly now has enough info to carry out an identity theft - make sure your friend protects his credit.
If your friend uses your address for mail, then it is his responsibility to ensure that he has ready access to the post - that is, generally, by providing the address to businesses, courts, etc, he warrants that he has access to the address and therefore the post. Depending on your arrangement with your friend, you may have a duty to notify him of the arrival of the mail, and/or to deliver it to him, and/or to forward it to him. Again, depending on whether the arrangement forms a legally binding contract, your duty may or may not be legally enforceable, and your friend may be able to seek indemnity or damages from you if he suffered adverse legal consequences as a result of the mail arriving and your failure to notify/deliver/forward. If he ignores it, the liability is likely to be his and his alone, subject to the above. It is unlikely to affect your visa or its extension but it's best to engage a solicitor to review your circumstances and advise you on this. As far as your credit score (though my understanding is that credit scores are evaluated by individual institutions and not provided by any of the credit reporting bureaus) will be affected, it would only be affected if your friend committed fraud in your name or became a debtor in your name. Letting a friend's mail be delivered to you is not a criminal offence that I've been able to identify.
Are online stores supposed to state the true “order cost”/value of an order on the package/envelope for the customs? Yes Is it common practice to slash 10x off of the price for the customs to not add various fees? Common? Probably no. Uncommon? Also, probably no. Isn't that illegal? Yes Of course, they can claim it was a mistake if ever found out, but if they do it consistently, that seems difficult... Not to mention there must be electronic proof of how much each order actually cost the customer? Yes Look, robbing banks is illegal but people still rob banks. Similarly, ripping off HM Revenue &amp; Customs is illegal but people still do that too. In fact, far more people do that than rob banks.
The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient if properly implemented (strong hash function, use of salt, etc). But other methods of securing the password might be sufficient. Encrypting the PW rather than hashing it, so that an authorized person could decrypt it temporarily might be OK. Or perhaps a security app can separately retrieve only the specified characters of the PW through some sort of encryption. Or perhaps the ISP is not using proper security. In the case of Knuddles in the linked news story, an actual breach occurred which led to the poor security being reported. You could send a report to the appropriate national Data Protection Authority.
As a baseline, you may assume that your code will be used legally. It sounds like this still applies in your case: there is an entirely reasonable and legal use for login code, so you had no reason to assume that there might be a problem. This puts you legally in the clear. To be liable, you'd need to know or at least reasonably suspect that your code would be used to violate the law.
Article 10 (1) Basic Law / Art. 10 Abs. 1 Grundgesetz: The privacy of correspondence, posts, and telecommunications shall be inviolable. You can send whatever you want via postcard (as long as it doesn't constitute a different criminal offense). Technically, whoever were to decrypt your message, besides the addressee, would probably commit Data Espionage according to §202a (2) Criminal Code / § 202a Abs. 2 Strafgesetzbuch. The second paragraph states that this only applies if the data is transmitted electronically, magnetically, or otherwise in a manner which is not immediately perceptible. I would argue that a non-sealed postcard with an encrypted message would be &quot;not immediately perceptible&quot;.
An Art 15 Subject Access Request (SAR) “shall not adversely affect the rights and freedoms of others.” It would be a grave violation of privacy for an email provider to search its users' account contents. It is therefore likely that the email provider would refuse to fulfil that subject request, unless required to perform a search via a court order. Instead, the SAR could be directed to the account holder (Alice or Dave), if they are subject to the GDPR. Depending on the exact legal framework, emails might be protected under confidentiality of communications rules, making such searches similarly illegal to wiretapping. At least in germany, I am fairly certain that an email provider would be criminally liable if they were to disclose emails from their users' email accounts to a third party.
Yes (in most jurisdictions), but why should you? There might be some interests in publishing the 1,000 most common passwords, e.g. to support security awareness lectures (or to build rainbow tables for nefarious purposes), but anybody who wants to hash them with a specific algorithm can do so easily. It is probably easier to type the passwords from a printed book and to hash them on the computer than it is to type the hashed passwords -- bad passwords would tend to be easy to type. That being said, computer crime laws are generally lagging behind the state of the art, or they are overly broad, so it might be illegal in some places as a &quot;hacking tool&quot; ...