Member Avatar for Ccholic

I am thinking about making a website on a VPS. I've read on internet that if someone hacks my website and puts a malware into links or if he steals personal information(including passwords), not only hacker but the owner of the website is responsible too and a lawsuit may be opened against him/them and may pay big fines.

If this is true then I really don't understand how so many people create websites and taking this risk.There may be no lawyer in this forum but I am asking to other people too, to webdevelopers(or people who want to be a webdeveloper) or people who have a website if they know about the laws/policies related to this and how they take the risk.

  • 2 Contributors
  • 3 Replies
  • 355 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

Reply to (and building on ’s points): ownership of a hacked site does not automatically make the owner criminally or civilly liable for a hacker’s actions, but legal exposure is real when the site operator fails to take “reasonable” security steps or neglects breach-notification duties. U.S. guidance for businesses explains basic obligations (inventory data, minimize retention, protect what’s kept, and plan for incidents), and every U.S. state has breach-notification rules that vary by jurisdiction. (ftc.gov)

Liability usually follows negligence or misrepresentation: examples include keeping passwords in plaintext, leaving backups or S3 buckets public, ignoring published vulnerabilities, or promising security in a privacy policy and then failing to implement it. Regulators and courts look for documented, industry-standard protections; technical guidance on safe password storage and authentication practices is available from OWASP and NIST. (cheatsheetseries.owasp.org)

A short, practical risk-reduction checklist (prioritized):

  • Collect only the personal data actually needed.
  • Enforce TLS everywhere and HSTS.
  • Keep OS, web server, CMS, and plugins patched.
  • Store credentials as salted, slow hashes (Argon2 preferred; fallback bcrypt/scrypt) and enable MFA.
  • Apply least-privilege, logging, monitoring, automated vulnerability scans, WAF, and offline backups.
  • Maintain an incident-response playbook that lists notification steps and timelines (note: GDPR requires notification to the supervisory authority within 72 hours for EU personal data). Example password-hash pattern in Node.js: 
const argon2 = require('argon2');
const hash = await argon2.hash(password);
// store hash
const ok = await argon2.verify(hash, attempt);

(gdpr.eu)

Documenting security choices and retention/notification policies is the practical defense: it reduces legal risk and demonstrates “reasonable” care if a breach happens. That said, no technical posture removes all risk; for specific liability, notification timing, or cross-border rules, obtain legal advice and keep evidence of the security steps taken (logs, patch records, audits).

Recommended Answers

All 3 Replies

Member Avatar for rproffitt

Let's cover a few items.

  1. Passwords. If you store passwords in the old bad way of plain text then you deserve the grief and trouble. This area is well discussed and there is no longer any excuse to leak passwords.
  2. URLs. Since you don't control what's on other sites and this may vary by country you are not liable UNLESS you are a site about illegal activities which is on its own a quagmire since what is legal here may be illegal in another country.
  3. If you live in fear over all this, why would you create such a site?
Member Avatar for Ccholic

Thanks for your answer.

If you live in fear over all this, why would you create such a site?

Actually I was not aware of that I might be hold responsible for hackers' activity/data leakage on my website when I first decided to make a website, now still I want to create a website but want to be sure that it will not put me in trouble.

Edited by Ccholic
Member Avatar for rproffitt

I don't see how you can avoid any possibility of trouble. You could reveal more or decide not to write Jeffrey Epstein didn't kill himself or "Free Hong Kong." Now that I've written this you can too?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.