> Van Buren is really good news for port scanning, for example: so long as the computer is open to the public, you don’t have to worry about the conditions for use to scan the port.
As a frequent user of nmap, this is good to hear.
But I am confused by the implications here.
How is port scanning different legally from brute forcing passwords? Iterating integers is fine, iterating the dictionary is not? What if there's an integer ID in the URL but it's MD5 hash'd and I recognize for what it is and iterate integers and MD5 them?
Because humans are trivially able to recognize the difference between those two activities. A judge that has that case in front of them can _really_ easily see the difference between those activities.
Similarly, password stuffing (just trying many passwords on the login form) would be illegal, since you are trying to gain access. Not sure how that works if you are not successful though.
Port-scanning would be fine. Interesting edge case is, what happens if you port-scan, find an open telnet port, and use it to get a shell. There is no authentication, but does that mean you are authorized? My gut says that logging in to such a telnet port (when the device is not yours) is a CFAA violation. Just like walking in to a random house when the door is open is still illegal.
Not being "not authorised" is not the same as being authorised. Authorisation is a positive action.