Hacker News Reader

Comment by sigzero | Hacker News Reader

Didn't he use an unpublished link? That would be "unauthorized" to me.

That strikes me as a very surprising position to take.

So you consider it a felony to enter in a browser some URL that has not been been "published". What exactly counts as published? For instance, if I created another page that links to it, is that "published"? Is it still "published" if I later delete that other page? Is it "published" if someone else somewhere in the world creates a page linking to it, but I never create one? What if I print a riddle in the newspaper, which says that the answer to the riddle is the URL in question... is that "publishing" it? What if it's a really HARD riddle? What if I don't print the riddle in the newspaper, but it's a really easy riddle... something like "just add one"?

I honestly do not think that whether you "publish" a URL should be used as an indicator of whether access is authorized. Every web server I have ever heard of has the ability to return a "401 Unauthorized" error code, and to do so or not based on the credentials of the person connecting. If I were writing the law, I would say that guessing a password to put in such a box, or accessing it with a malformed request used a bug in the server to bypass such a credential check would certainly qualify as "unauthorized access", but that "AT&T didn't bother to require a check before returning the data to any browser that asked for it" would be evidence that it was explicitly authorized.

Curious - did I do something "unauthorized" by entering:

https://news.ycombinator.com/item?id=5419914

Into the URL bar? (One less than this article's URL)

It's absurdly reductionist to make arguments like this. There are lots of things that are okay or not okay based on context. Is it unauthorized to type the above into a URL bar? Almost certainly not. Might it be unauthorized if you type it into a URL bar, see that it contains private information that by its nature was probably not intended to be public, then do it 10,000 more times? Then that might be unauthorized.

There is no reason to reduce the world to absurd simplicities when even children would be able to distinguish between various courses of action.

Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script.

The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).

I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage.

However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else.

I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.

> However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else.

What if you did it by hand? Where's the line between what's ok and what's not?

Ultimately the line is drawn based on what the evidence implies about intent. What does downloading 10 URLs by hand to get a proof of concept say about intent versus downloading 10,000 with a script?

If we're going to give "security researchers" license to test other people's systems without consent, shouldn't we at least have some understanding that such actions will be narrowly tailored to prove the necessary point?

It says nothing to people in the know.

It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific set, and it avoids having to pick known good IDs.

You aren't giving anyone license anyone than the tide needs license to use the beach. You need to recognize that unpassworded sequential URLs are a vulnerability even if you shoot the messenger.

And thus, shooting the messenger, and justifying it, is evidence of someone who doesn't get "it".

It also spoofed the user-agent of an iPad.

Still, it made a request to a webserver, and the webserver gave up the data. That's not the requester's fault.

I use a spoofed user agent all of the time.

> However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior

How is this different than using Facebook's graph URI endpoints ---- excepting the fact that Facebook publishes the schema?

What if Facebook had some URIs that were not covered in the schema? Are you then liable for a federal felony if you access them? Or are they liable for failing to protect personal information by not keeping it behind an encryption interface?

I just said it's a qualitative difference. I deliberately did not opine on the legality or the ethics, I simply reject the idea that we can say that there's no difference between a by-hand downloading of a couple of URLs and a massive by-script downloading of thousands+. As is so often the case, there's no bright shining line, but there is a line here, and trying to be reductionistic and claim there's no difference is, in my opinion, not a valid argument.

It may very well be the case that it should also not be illegal, or that we want the common sense solution where it's still "illegal" but not a criminal felony but rather a civil matter (illegal is not a binary flag, after all).

>However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior.

So, a search engine then. Let Google, Bing and DuckDuckGo know they're wanted for questioning.

As I observe elsewhere, all I'm saying is that there's a qualitative difference, not that the qualitative difference implies illegality. Are you going to defend the proposition that there is no legal, moral, or philosophical distinction that can be made between Google and a guy downloading a web page once by hand?

Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose. I consider this a criticism of the law, not the search engines.

>. Are you going to defend the proposition that there is no legal, moral, or philosophical distinction that can be made between Google and a guy downloading a web page once by hand?

I'm not a lawyer so I can't speak directly to "legally" but I believe there shouldn't be a legal difference between a search engine loading a page and me doing it by hand. After all, how would I hand verify what my search engine is saying if doing so might be illegal?

>Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose. I consider this a criticism of the law, not the search engines.

You could be right and I would agree the law today is horribly screwed up.

No, not "Google pulling one page"... Google. The whole thing. We've been talking about the difference between grabbing one page and grabbing thousands+ of pages all along... are you reading what I'm actually saying or just knee-jerking here?

> Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose.

What exactly has changed in the law in the 15 years since Google started up? The CFAA is almost 30 years old...

Okay, fair enough - so instead of Article URLs, I started typing names:

  https://news.ycombinator.com/user?id=paulgraham
  https://news.ycombinator.com/user?id=RHashem
  https://news.ycombinator.com/user?id=RayinerHashem

To see if I could get any personal information like email addresses, profile information, etc... What if instead of usernames, they were simply integers - I.E. https://news.ycombinator.com/user?id=000001, https://news.ycombinator.com/user?id=000002, etc...

Was that unauthorized? How about illegal?

Seriously - I think Weev is a complete Troll, and he was totally hacking AT&T - but I don't think his actions came anywhere close to criminal. I"m really happy to hear he has competent representation.

Honestly I am struggling to think of an action that is ok to do once but illegal to repeat a thousand times - you make it sound like the bad businessmans theory - we make a loss on each item but make up for it in volume

Try dumping one coke can on someone's yard versus 10,000.

Do you want my physical address. I'll take your 10,000 aluminum cans.

Not cans. The contents of the cans.

In that case, either one may be littering, vandalism, or property destruction. While it would be wasteful and silly to pursue a prosecution for one occurrence, a single occurrence is still a crime.

Let's go to the logical extreme then:

Is dripping one solitary drop of soda the exact same crime as inundating your yard continuously with soda for, say, 24 hours?

Hilarious example, since both would involve trespassing and destruction of property. It's just that 10k would be enough to have it perused and one likely wouldn't.

There are various charges that could be brought in the second case based on what dumping 10,000 cans versus 1 can says about intent.

Knocking on my door.

Once is fine. 1000 times is harassment.

A list of a bunch of hashes of an email address and some sort of ID number? Sounds like a "White Pages" to me.

Please tell me you're not in any powerful political position. You sound exactly like the kind of evil people in charge who are finding new ways to arrest people for things that weren't illegal before hand.

I'm curious as to why most technical issues on HN involving the law come down to silly black or white viewpoints? I thought this audience would be sophisticated enough to know that this type of thing isn't a binary either/or issue.

Are you purposefully ignoring the fact that the law relies on context to determine if you are acting in good faith or not? Or is everyone who reduces this issue to an either/or position doing so purposefully just because they hate the fact that there is nuance to the law which is much more subtle than the science most of us are schooled in?

I'm not sure if you are responding to me or not - tough to tell from the indent - but, I really am interested in people's viewpoints - no ulterior motive here.

Some people would say typing in their own article ID values into a URL bar is unauthorized, but not illegal. Some people would say that typing username ID values to get personal email addresses, is unauthorized, but probably not illegal. Some people might say writing a script to enter all combinations of userids to get username/email addresses on HN is illegal, but probably not a felony.

I was genuinely interested in hearing what people had to say, as I trust our audience here, and let their opinions shape mine.

Can you clarify what "published" means in the context of a http link? Preferably citing the appropriate section in the RFC, http://www.w3.org/Protocols/rfc2616/rfc2616.html?

basically if he looses the court. 404 page may result in getting orange jumpsuit and nice check to be paid. In my opinion leaving personal information accessible to general public (i.e. no authentication needed) is a crime. Letting journalists know is not a crime. In this case AT&T is responsible for misplacing personal data, and not the guy who had free access to it. In some ways it's really similar to Aaron Swartz case, as both guys found a way to get the data, and both got sued. I would suggest looking into this case more closelly as if he ends up in jail or pays a dime, a simple misuse of some companies website and/or public API (think Google Maps, etc.) Could land you in jail

http://en.wikipedia.org/wiki/Security_through_obscurity

The fact that a security mechanism is poor shouldn't mean that it doesn't create a legally enforceable boundary. If I tape my door shut instead of buying a proper lock, that doesn't give you the right to walk in.

Bad analogy. A door is an access control mechanism. A Uniform Resource Locator is not.

A more apt analogy would claiming that having your phone number not published in the phone book constitutes a legally enforceable boundary against being contacted by phone.

We can debate about whether URLs have elements of an access control mechanism or not, but if obscured URLs don't create a legally protect-able boundary, the argument should be because they're not an access control mechanism, not that they're a poor access control mechanism (which is the usual implication of "security through obscurity"). In other words, the argument should be about how clearly the boundaries are drawn, not how effective the security mechanisms are.

Granted. The security-through-obscurity link was an oversimplification.

Here's an analogy for you:

I don't publish my address in the phonebook or anywhere, but because you know that 4001 Example streeet is a house and 4003 Example street is a house, you're still able to solicit me at 4005 Example street.

Reply on news.ycombinator.com