Why does '4,000 credentials captured' price neither a password lot nor a live session?

## The claim being tested A single lure can be converted two ways, and a capture count treats the results as one thing. The interviewer is checking whether you can price inventory the way the operator does, because that is what predicts what happens next. ## Good one: an unverified password lot Harvested passwords are strings nobody has checked. Every lot contains typos, stale passwords, garbage from suspicious victims and dead accounts, in proportions the seller does not know either. The seller does not usually find out, because checking is a separate activity with its own cost, so verification is pushed onto the buyer. That shapes the price directly. Bulk lots trade per thousand at a level that already assumes most entries are worthless; the buyer is paying for a statistical expectation and monetising the surviving fraction. The good decays continuously as victims rotate passwords, and it decays faster once anything prompts a broad reset. But it decays slowly enough to be warehoused: a file can be held for weeks, split, and sold more than once, which caps the unit price because exclusivity is not part of the offer. ## Good two: a live session The session captured by a relay is the opposite kind of good in every respect that matters commercially. It is verified by construction, because the genuine service issued it only after a real authentication succeeded, so there is no live-rate discount at all. It cannot be warehoused: it expires on the service's clock regardless of what anyone does with it, so it must be delivered and used inside its own lifetime. And it cannot honestly be resold twice, because two buyers cannot both be first. So it prices as one access, not as one unit, and the number attached to it is orders of magnitude away from a per-thousand rate for passwords. Comparing the two on the same scale is the error the question is aimed at. ## What the count also hides: whose accounts Price follows identity more than volume. Four thousand consumer mailboxes are breadth: the buyer wants many doors and does not care which. Forty accounts at one named manufacturer are depth: the buyer wants that organisation, and may pay more for the smaller lot precisely because it is the smaller lot. A count with no tenant attached cannot be placed in either market. This is why the same operator sells to both. The lure is the expensive part to run once; the conversions come out of it as two product lines, and an access broker who never intrudes further makes their margin by sorting the output correctly rather than by using any of it. ## Freshness as a priced attribute Because both goods decay, time since capture is quoted the way a perishable good's date is quoted. A batch offered the same day is a different product from the same batch three weeks later, and the two clocks run at wildly different speeds: three weeks costs a password lot some fraction of its live rate, and costs a session everything. ## How to answer without overclaiming The strong version names the axes and refuses to give one number: liveness, clock, identity, exclusivity and freshness. Then it says what the count actually is, which is a measure of how well the lure performed, not a measure of what came out of it. The two are only loosely related, and an operator who confuses them prices their own inventory badly. ## The trap in the other direction Do not swing to saying the count is meaningless. It bounds the upper end, it tells you the lure ran at scale rather than against a handful of chosen people, and a batch that large implies an untargeted delivery rather than a hand-built pretext for one person. That is a real inference about how the operation was run. It is simply not a price.