5 ms·

This really hits the nail on the head. Does sending an HTTP request and receiving an HTTP 200 response code indicate that you're authorized? IMO, yes. What i

This really hits the nail on the head. Does sending an HTTP request and receiving an HTTP 200 response code indicate that you're authorized? IMO, yes. What if you send 5 million requests over the course of X timeframe, each of which also receives an HTTP 200 response. Have you "exceeded authorized access" at that point? IMO you haven't -- but right now the answer is basically, "maybe, TBD on a case-by-case basis" which is a decidedly poor answer. And, as you eloquently summarized, that's precisely the problem with this part of the CFAA. Unfortunately I don't think that the outcome of this specific case will do much to clarify this aspect of CFAA. That said, the final opinion could possibly shine a bit of light in the right direction if we're lucky, but I'm not holding my breath for a black-and-white interpretation any time soon...

cookiecaper 11y ago
>Does sending an HTTP request and receiving an HTTP 200 response code indicate that you're authorized? IMO, yes. It'd be a boon for anyone who depends on data scraping (which includes basically everyone in some form or another) if the Court decided that issue in that way, but I agree that it seems really unlikely that that will be broached in this case. Meanwhile, big companies will be able to scrape to their hearts' content while small companies are forcibly shut down for the same when one such big company retains a big law firm to intimidate an upstart they're afraid of with the threat of a lawsuit that costs millions just to litigate, excluding any potential damages. If the small company were to attempt to use the same law(s) to defend themselves, they'd be guaranteeing themselves said millions in legal fees, as the big company will aggressively defend itself, so it's not really an option. License to bully for the rich, bupkis for everyone else. That's how legal gray areas work.
snowwrestler 11y ago
That would certainly make life easier on technologists--just read the HTTP code and if it's 200 you're good. But the legal concept of authorization doesn't rest on technology, and there's actually a good reason for that: if the technology was that reliable, then you wouldn't need the law at all. That is, if servers always returned a 401, 403, 511, etc. status code for unauthorized access attempts, then it would be impossible for unauthorized access to occur. And we don't tend to bother with laws restricting impossibilities. But we all know the reality: people are imperfect and therefore so is their technology. A server could return a 200 status on a page that you are not authorized to see.
- AnthonyMouse 11y ago
  > But we all know the reality: people are imperfect and therefore so is their technology. A server could return a 200 status on a page that you are not authorized to see. That's the whole problem. 99+% of the time the status code is correct and the server will give you the data if it's supposed to but not if it isn't. It's generally quite reliable and people are expected to and do rely upon it -- that's what it's for. But 100% of the cases that end up in court will be in the <1% where the server made a mistake. If we had a better way to deterministically evaluate authorization than what the server is using then we could use it to improve the server and therefore ought to. So we have a choice: Either it is impossible to deterministically evaluate whether access to a particular server is authorized, or we defer to the server's determination (and improve the server where possible). In the latter case this law is obviously then redundant and silly, but that doesn't make it the wrong choice.
  - snowwrestler 11y ago
    Status codes are not reliable indications of authorization at all. If you steal someone's password, the server will give you 200's all day long, even though your entire session would be unauthorized.
    - AnthonyMouse 11y ago
      But you know you've stolen somebody else's password. It isn't a grey area. The server is telling you that that user is authorized, which is true, and you know that that user is not you. If you want to take the narrow interpretation of the CFAA without making it a dead letter, that is how you violate it.
      - snowwrestler 11y ago
        Either HTTP status codes are reliable indicators of legal authorization--generally, to all observers--or they are not. Obviously they are not, since they fail to identify what you acknowledge would be a clear violation. To go back up the thread, these quotes are contradicted by the stolen password scenario: "The canonical way people know whether they're authorized to do something to a computer system is that it allows them to do it. If you aren't authorized then it comes back with "access is denied" and you can't do it." "Does sending an HTTP request and receiving an HTTP 200 response code indicate that you're authorized? IMO, yes." Look, I agree that the CFAA is too vague and therefore places a chilling effect on legitimate computer science research. I'm just saying: HTTP status codes are not the answer. The answer to a problematic law is to remove or improve the law.

cookiecaper 11y ago

>Does sending an HTTP request and receiving an HTTP 200 response code indicate that you're authorized? IMO, yes. It'd be a boon for anyone who depends on data scraping (which includes basically everyone in some form or another) if the Court decided that issue in that way, but I agree that it seems really unlikely that that will be broached in this case. Meanwhile, big companies will be able to scrape to their hearts' content while small companies are forcibly shut down for the same when one such big company retains a big law firm to intimidate an upstart they're afraid of with the threat of a lawsuit that costs millions just to litigate, excluding any potential damages. If the small company were to attempt to use the same law(s) to defend themselves, they'd be guaranteeing themselves said millions in legal fees, as the big company will aggressively defend itself, so it's not really an option. License to bully for the rich, bupkis for everyone else. That's how legal gray areas work.

snowwrestler 11y ago

That would certainly make life easier on technologists--just read the HTTP code and if it's 200 you're good. But the legal concept of authorization doesn't rest on technology, and there's actually a good reason for that: if the technology was that reliable, then you wouldn't need the law at all. That is, if servers always returned a 401, 403, 511, etc. status code for unauthorized access attempts, then it would be impossible for unauthorized access to occur. And we don't tend to bother with laws restricting impossibilities. But we all know the reality: people are imperfect and therefore so is their technology. A server could return a 200 status on a page that you are not authorized to see.

AnthonyMouse 11y ago
> But we all know the reality: people are imperfect and therefore so is their technology. A server could return a 200 status on a page that you are not authorized to see. That's the whole problem. 99+% of the time the status code is correct and the server will give you the data if it's supposed to but not if it isn't. It's generally quite reliable and people are expected to and do rely upon it -- that's what it's for. But 100% of the cases that end up in court will be in the <1% where the server made a mistake. If we had a better way to deterministically evaluate authorization than what the server is using then we could use it to improve the server and therefore ought to. So we have a choice: Either it is impossible to deterministically evaluate whether access to a particular server is authorized, or we defer to the server's determination (and improve the server where possible). In the latter case this law is obviously then redundant and silly, but that doesn't make it the wrong choice.
- snowwrestler 11y ago
  Status codes are not reliable indications of authorization at all. If you steal someone's password, the server will give you 200's all day long, even though your entire session would be unauthorized.
  - AnthonyMouse 11y ago
    But you know you've stolen somebody else's password. It isn't a grey area. The server is telling you that that user is authorized, which is true, and you know that that user is not you. If you want to take the narrow interpretation of the CFAA without making it a dead letter, that is how you violate it.
    - snowwrestler 11y ago
      Either HTTP status codes are reliable indicators of legal authorization--generally, to all observers--or they are not. Obviously they are not, since they fail to identify what you acknowledge would be a clear violation. To go back up the thread, these quotes are contradicted by the stolen password scenario: "The canonical way people know whether they're authorized to do something to a computer system is that it allows them to do it. If you aren't authorized then it comes back with "access is denied" and you can't do it." "Does sending an HTTP request and receiving an HTTP 200 response code indicate that you're authorized? IMO, yes." Look, I agree that the CFAA is too vague and therefore places a chilling effect on legitimate computer science research. I'm just saying: HTTP status codes are not the answer. The answer to a problematic law is to remove or improve the law.