4 ms·

Bypassing the paywall is more unethical that blocking ads. It is one thing to have control over your own browser but another to steal something from another si

by mchahn 11y ago

Bypassing the paywall is more unethical that blocking ads. It is one thing to have control over your own browser but another to steal something from another site. Also, isn't it illegal to bypass computer security?

nkrisc 11y ago
How is modifying your own request headers any different than choosing to not display content returned in the response body? Their server can choose to do what it wants with your request and you can choose what to do with the response it sends. Are User-Agent headers legally protected identities?
- drostie 11y ago
  Unfortunately, yes. The law legally protects anything which you might use to gain unauthorized access; that includes e.g. a password field. (That is, it is indeed breaking into a system if you type in the correct password, say by reading it on a post-it on someone's monitor, but you are not supposed to know that password.) This sort of thing makes the entire business of law complicated and impossible to automate. Then again, lots of sci-fi dystopias are dreams of an automated law that somehow destroys the fabric of society, so...
- effie 11y ago
  The difference is substantial; in principle, one can modify his request to intentionally bypass the authorization mechanism occurring on the server. One cannot mislead anyone/anything by displaying his data in a customized way in private on his computer.
  - nkrisc 11y ago
    Fair point. Intent matters. However must it be demonstrated that there is some specific malicious intent behind changing a request header versus simply changing your user agent for the heck of it? In a related point, some news sites load a modal and prevent scrolling over an article asking you to sign up. However if the full article is included in the response and I read it by simply viewing the response body (HTML) is that circumventing security? Actual example. In this case modifying how the response is rendered in my browser, I can bypass their intentions. Obviously the better way of doing this would be to not send the entire article content until they've determined I should be able to view it.
    - effie 11y ago
      > must it be demonstrated that there is some specific malicious intent... I think so. Just the act of changing User-Agent alone does not mean a fraud is happening. User-Agents get changed often for valid reasons - research, detection of cloaking, testing etc. > However if the full article is included in the response and I read it by simply viewing the response body (HTML) is that circumventing security? That is a hard issue. I think the answer should be no, it is not circumvention, at least not in the above sense.(\) If you can get full article on your computer, directly readable without fraudulent behaviour on your part, this means that the sender did not place a security measure to guard it, so there can be no circumventing it. Switching javascript off or displaying source text of the document is fully in the control of the requestor and the sender should know it. (\) Unfortunately, it seems legal systems allow companies to restrict what you do with things they produce, even if you do it on your computer in private, so legally, this may not be successful in court.

by mchahn 11y ago

nkrisc 11y ago

How is modifying your own request headers any different than choosing to not display content returned in the response body? Their server can choose to do what it wants with your request and you can choose what to do with the response it sends. Are User-Agent headers legally protected identities?

drostie 11y ago
Unfortunately, yes. The law legally protects anything which you might use to gain unauthorized access; that includes e.g. a password field. (That is, it is indeed breaking into a system if you type in the correct password, say by reading it on a post-it on someone's monitor, but you are not supposed to know that password.) This sort of thing makes the entire business of law complicated and impossible to automate. Then again, lots of sci-fi dystopias are dreams of an automated law that somehow destroys the fabric of society, so...
effie 11y ago
The difference is substantial; in principle, one can modify his request to intentionally bypass the authorization mechanism occurring on the server. One cannot mislead anyone/anything by displaying his data in a customized way in private on his computer.
- nkrisc 11y ago
  Fair point. Intent matters. However must it be demonstrated that there is some specific malicious intent behind changing a request header versus simply changing your user agent for the heck of it? In a related point, some news sites load a modal and prevent scrolling over an article asking you to sign up. However if the full article is included in the response and I read it by simply viewing the response body (HTML) is that circumventing security? Actual example. In this case modifying how the response is rendered in my browser, I can bypass their intentions. Obviously the better way of doing this would be to not send the entire article content until they've determined I should be able to view it.
  - effie 11y ago
    > must it be demonstrated that there is some specific malicious intent... I think so. Just the act of changing User-Agent alone does not mean a fraud is happening. User-Agents get changed often for valid reasons - research, detection of cloaking, testing etc. > However if the full article is included in the response and I read it by simply viewing the response body (HTML) is that circumventing security? That is a hard issue. I think the answer should be no, it is not circumvention, at least not in the above sense.(\) If you can get full article on your computer, directly readable without fraudulent behaviour on your part, this means that the sender did not place a security measure to guard it, so there can be no circumventing it. Switching javascript off or displaying source text of the document is fully in the control of the requestor and the sender should know it. (\) Unfortunately, it seems legal systems allow companies to restrict what you do with things they produce, even if you do it on your computer in private, so legally, this may not be successful in court.