Hacker News Reader

Comment by rayiner | Hacker News Reader

It's absurdly reductionist to make arguments like this. There are lots of things that are okay or not okay based on context. Is it unauthorized to type the above into a URL bar? Almost certainly not. Might it be unauthorized if you type it into a URL bar, see that it contains private information that by its nature was probably not intended to be public, then do it 10,000 more times? Then that might be unauthorized.

There is no reason to reduce the world to absurd simplicities when even children would be able to distinguish between various courses of action.

View on HN

Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script.

The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).

I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage.

However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else.

I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.

It also spoofed the user-agent of an iPad.

Still, it made a request to a webserver, and the webserver gave up the data. That's not the requester's fault.

I use a spoofed user agent all of the time.

> However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else.

What if you did it by hand? Where's the line between what's ok and what's not?

Ultimately the line is drawn based on what the evidence implies about intent. What does downloading 10 URLs by hand to get a proof of concept say about intent versus downloading 10,000 with a script?

If we're going to give "security researchers" license to test other people's systems without consent, shouldn't we at least have some understanding that such actions will be narrowly tailored to prove the necessary point?

It says nothing to people in the know.

It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific set, and it avoids having to pick known good IDs.

You aren't giving anyone license anyone than the tide needs license to use the beach. You need to recognize that unpassworded sequential URLs are a vulnerability even if you shoot the messenger.

And thus, shooting the messenger, and justifying it, is evidence of someone who doesn't get "it".

> However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior

How is this different than using Facebook's graph URI endpoints ---- excepting the fact that Facebook publishes the schema?

What if Facebook had some URIs that were not covered in the schema? Are you then liable for a federal felony if you access them? Or are they liable for failing to protect personal information by not keeping it behind an encryption interface?

I just said it's a qualitative difference. I deliberately did not opine on the legality or the ethics, I simply reject the idea that we can say that there's no difference between a by-hand downloading of a couple of URLs and a massive by-script downloading of thousands+. As is so often the case, there's no bright shining line, but there is a line here, and trying to be reductionistic and claim there's no difference is, in my opinion, not a valid argument.

It may very well be the case that it should also not be illegal, or that we want the common sense solution where it's still "illegal" but not a criminal felony but rather a civil matter (illegal is not a binary flag, after all).

>However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior.

So, a search engine then. Let Google, Bing and DuckDuckGo know they're wanted for questioning.

As I observe elsewhere, all I'm saying is that there's a qualitative difference, not that the qualitative difference implies illegality. Are you going to defend the proposition that there is no legal, moral, or philosophical distinction that can be made between Google and a guy downloading a web page once by hand?

Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose. I consider this a criticism of the law, not the search engines.

>. Are you going to defend the proposition that there is no legal, moral, or philosophical distinction that can be made between Google and a guy downloading a web page once by hand?

I'm not a lawyer so I can't speak directly to "legally" but I believe there shouldn't be a legal difference between a search engine loading a page and me doing it by hand. After all, how would I hand verify what my search engine is saying if doing so might be illegal?

>Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose. I consider this a criticism of the law, not the search engines.

You could be right and I would agree the law today is horribly screwed up.

No, not "Google pulling one page"... Google. The whole thing. We've been talking about the difference between grabbing one page and grabbing thousands+ of pages all along... are you reading what I'm actually saying or just knee-jerking here?

> Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose.

What exactly has changed in the law in the 15 years since Google started up? The CFAA is almost 30 years old...

Okay, fair enough - so instead of Article URLs, I started typing names:

  https://news.ycombinator.com/user?id=paulgraham
  https://news.ycombinator.com/user?id=RHashem
  https://news.ycombinator.com/user?id=RayinerHashem

To see if I could get any personal information like email addresses, profile information, etc... What if instead of usernames, they were simply integers - I.E. https://news.ycombinator.com/user?id=000001, https://news.ycombinator.com/user?id=000002, etc...

Was that unauthorized? How about illegal?

Seriously - I think Weev is a complete Troll, and he was totally hacking AT&T - but I don't think his actions came anywhere close to criminal. I"m really happy to hear he has competent representation.

Honestly I am struggling to think of an action that is ok to do once but illegal to repeat a thousand times - you make it sound like the bad businessmans theory - we make a loss on each item but make up for it in volume

Try dumping one coke can on someone's yard versus 10,000.

Do you want my physical address. I'll take your 10,000 aluminum cans.

Not cans. The contents of the cans.

In that case, either one may be littering, vandalism, or property destruction. While it would be wasteful and silly to pursue a prosecution for one occurrence, a single occurrence is still a crime.

Let's go to the logical extreme then:

Is dripping one solitary drop of soda the exact same crime as inundating your yard continuously with soda for, say, 24 hours?

Hilarious example, since both would involve trespassing and destruction of property. It's just that 10k would be enough to have it perused and one likely wouldn't.

There are various charges that could be brought in the second case based on what dumping 10,000 cans versus 1 can says about intent.

Knocking on my door.

Once is fine. 1000 times is harassment.

A list of a bunch of hashes of an email address and some sort of ID number? Sounds like a "White Pages" to me.

Please tell me you're not in any powerful political position. You sound exactly like the kind of evil people in charge who are finding new ways to arrest people for things that weren't illegal before hand.

Reply on news.ycombinator.com