Frequently I get requests from students and security researchers to get a copy of my password research data, so I built a data set of ten million usernames and passwords that I am releasing to the public domain. But is it legal for me to release this data?