When should I use the word hacker, cracker, or black hat?

Question

Everybody seems to have their own meaning of the word "hacker". To some, it's the good-guy vigilante with some non-professional characteristics.

To others, it's the aggressor, bad-guy, cracker, or black hat that exploits for personal gain (money, pride, or other motivations)

Question:

What are different meanings of these words to different audiences? For example, what word should be used to describe the "bad guy" to:

1. The general public

2. Management / Clients

3. Skilled colleagues

4. This IT Security site

Answer 1

In general I'd suggest avoiding use of the word, because it's meaning in general English is completely opposite to the meaning of the original jargon word, which means that sooner or later you're going to confuse or irritate someone.

See the New Hackers Dictionary, for example, specifically sense 8.

(Warning: that's the kind of document you'll get sucked into and spend days reading the whole thing!)

In it's place, I like to use something vague like "attacker" with non-technical people, and to get very precise and say things like "threat actor" when talking to security professionals.

Answer 2

Communication is a two-party protocol. You should use whatever terminology is most appropriate to convey the meaning of your ideas, and that depends on who listens. In most circles, I will use "evil hacker" to designate the villain:

• For most people, a "hacker" is by definition a morally shady individual whose night-time prowling of the Internet and his questionable hygiene distinguish as a generally inappropriate person, to be avoided whenever possible. For these people, the extra adjective ("evil") is just a redundant term added for emphasis and to balance the sentence metrics.

• The (relatively few) people who do make a distinction between hackers, crackers and "black hat", will consider "hacker" as a morally neutral term which indicates technical skills and competence; they are ready to believe that a hacker can be malevolent or benevolent. The adjective ("evil") then makes the expression unambiguous.

That way, there is no misunderstanding. Although different listeners will interpret each word in various incompatible ways, they will all understand the whole expression with the same overall sense, which is the point of communication.

I don't use the term "cracker" because it makes people think of biscuits, which is, at best, a distraction.

Answer 3

1 and 2: if you don't use hacker, they won't know what are you talking about. The problem? If you keep using hacker, they will never differentiate what a hacker is. It's a continuous loop.

3: Some will know and others won't. Most common is use hacker and here we go again in the loop.

4: Pentester (white), ethical hacker (white-grey), cracker (black).

Answer 4

The problem with the term "hackers" is that it usually stereotypes into a well formed role that actually makes no sense for threat modelling.

When doing threat modelling I don't use the term hacker anymore because the definition is too wide. I have actually started to specialise the term into the various motivations behind the attacker, e.g. financial, publicity, information, disruption, and so on.

When you start to specialise the attacking entity (person, company, our own staff, competitor, gov't agency, foreign gov't agency) into their motivation you can built a really good threat model and work out where you need to invest in protection against "hackers".