The boxes are legit to buy and own and will work as a freesat box , where it becomes dubious is when you connect them to the internet and run software on them that decrypts the Sky channels on the fly to view them.
Its not as simple as it sounds and you do need a subscription(either monthly or annually and quite often known as a ‘Bouquet’)
As pk13 said above its using a form of cardsharing so is illegal if caught.
I have looked into it in the past(being a ex-Sky engineer amongst others) but decided its more hassle than its worth, the boxes/software can be a bit flakey ,OK if your a techno geek but a pain otherwise.
Sky are rumoured to be changing the cards/decryption method again in the future, so if/when this happens all the boxes using the current method will stop working(Until someone discovers another work around).