Hacker News Reader

Comment by sandworm101 | Hacker News Reader

>> just sending random data over google-analytics.

Back when I was in the security field, I heard discussions about this sort of thing as a form of attack. The question was whether a computer that sent false or incorrect information was either engaging in a DOS attack or was violating the CFAA in that it was using false information to access a service. The DOS attack would be on the tracking system rather than a website resource, false information to degrade the effectiveness of the tracking system overall. The CFAA angle would be that participation in ads/tacking was part of the contract for accessing the 'free' service, that by blocking ads or sending false info the user is using a false credential to access the service. At the time, many thought that by using an ad-blocker that users were failing to pay, passively stealing website content. Those who sent false information were engaged in active theft.

View on HN

I'll grant that sending fake data is more active than merely not loading ads, but I personally consider not loading ads about as malicious as failing to read a billboard, or failing to subscribe when a webpage says 'Subscribe now'.

I don't think I'll ever quite understand the idea that the user is under any obligation to do whatever. Just because their user-agent might have some default behaviour doesn't mean that the user-agent should be expected to act in the interest of the server.

Though there's an argument to be made that sending lots of false data in response to a request to post personal information to google-analytics is a bit like manipulating a public survey by sending in silly answers. I'm not sure to what extent that is illegal but I'll grant that it's not exactly ethically correct.

>> not loading ads about as malicious as failing to read a billboard

Because, at this time, ad blocking tools are relatively benign. But what if we think of them more as content-blocking or content-management tools? What if I have a tool that blocks only right-wing advertisements or content? What if I have a tool that blocks all images of women showing too much skin? Block images of black people? Such not-neutral tools would radically change public perceptions. Legislation might follow.

There was a comical toll out there that would replace the text "Trump" with "The idiot" on viewed websites. That's the thin edge of this wedge.

Just because something is evidence of objectionable political view doesn't mean it should be forbidden.

This is approximately the time when you go from passively not agreeing to be tracked or have your attention stolen or your computer compromised by ad networks to collaborating with your fellow citizens to destroy the business of the ad networks by making it difficult to impossible to operate. In truth if every free ad supported service ceased to exist the internet would go on none the less.

I'm deeply interested in these issues as well - the criminal aspect of the CFAA being disconnected from actual harm caused to people is insane to me.

There does seem to be momentum towards a narrow reading of the CFAA when it comes to providing false information against terms of service, though, as per these 2013 analyses... though they fall short of actually giving any guarantees.

https://www.whiteandwilliams.com/media/alert/247_Coverage%20...

http://tsi.brooklaw.edu/cases/matot-v-ch

On the other hand, a denial of a motion to dismiss in Ticketmaster v. Prestige from 2018 seems to have drawn a distinction between breaching terms of service alone, and being told in a cease-and-desist not to breach those terms; the latter more clearly outlines what would be considered exceeding authorized levels of access.

https://casetext.com/case/ticketmaster-llc-v-prestige-entmt-...

Where does false information end and privilege escalation begin? Can that question depend on whether your privilege escalation is something as simple as "I'm now able to avoid the fine-print contract that I need to watch certain types and customizations of ads in order to access the service?" What constitutes sufficient notice to a user that certain actions are explicitly forbidden, if a C&D does but terms of service do not? All questions that, as far as I can tell, haven't been fully answered.

(Obligatory: Not a lawyer, the above is not legal advice.)

> The CFAA angle would be that participation in ads/tacking was part of the contract for accessing the 'free' service, that by blocking ads or sending false info the user is using a false credential to access the service.

I'm horrified whenever I see people having this perception of the issue, and worried that it'll get accepted by the legal system as the correct view.

From my POV, the only contract that exists between me and a random ad-loaded website is the one negotiated between my computer and their server - that is, the HTTP protocol, which clearly stipulates that I can render any reply you send me in whatever way I like. This contract provides many tools for expressing the intent of gating content behind some requirements (like payment, or receiving different content first), but the common rule is: you don't send the content you're gating before the client proves they've met the requirements.

And honestly, I'd consider mixing ads into content to be borderline CFAA (the ads themselves being abusive and often fraudlent, and sometimes malware) - and sending software intending to compromise my user agent (like trackers, or ad-blocking busters) to be crossing the CFAA line. Unfortunately, I don't think the lawyers would agree with me :(.

Are you horrified when a movie theatre doesn't want people sneaking in their own food and drink? Some consider that trespass in that you have broken the contract you agreed to when buying the ticket. They can call the cops and have you arrested for accessing the theatre in contravention of the rule. I could see an equivalent for websites that adopt a "no ad blocking" rule.

Can you cite this actually happening?

If you are asked to leave and do not leave I can see you possibly being arrested for trespassing, but I fail to see what you would be arrested for by bringing in food from outside the theatre. Sure, they could ban you from coming back to property (and this could lead to trespassing arrests, if you did return) but thats about it.

I'd expect such websites to communicate it, though, and do the minimum of work to prevent me from entering with ad blocker on. I'm fine with paywalls, and even "disable your ad blocker" walls - they're up-front, and in agreement with spirit of the HTTP protocol.

Much like cinemas. If I try to bring in food I didn't bought at the cinema store, I will be stopped at ticket check and refused entry. Also, the cinema doesn't require me to buy food as a condition for watching the movie. If they did, I'd consider it the price of entry.

What current ad-loaded websites are doing is the equivalent of letting you in to watch a movie, and then having someone come to you as you're watching, and poke you and yell at you because you didn't buy anything at the store.

> They can call the cops and have you arrested for accessing the theatre in contravention of the rule.

I've never heard of a cinema calling cops on people who snuck in food into the theatre. Is that US-specific?

It only happens when people are discovered, begin arguing, are told to leave, and don't. It's mostly drunk people who have brought alcohol into a movie. Cops remove them as trespassers who refused to leave after being told to.

Reply on news.ycombinator.com