Hacker News Reader

You seem to be talking about something different from what sullivanmatt and I were talking about. He said that collecting session IDs is not illegal, but posting them would be. That is the statement with which I was taking issue.

At any rate, it certainly doesn't seem correct to say "it isn't illegal" as a blanket statement.

View on HN

I was referring to calling it unauthorized access. If I do this to my own machines, which is how I wrote and tested this code, then it is entirely authorized.

I would agree that collecting session ids on systems that you do not own or have legitimate access to is almost certainly illegal.

I think his statement strongly implied that he was speaking about session ids of site he doesn't own. If you own the site, saying that "using the session ids would be illegal" is a stretch, at least without qualifiers. So, pretty sure he was talking about other people's sites.

Reply on news.ycombinator.com