5 ms·

Google isn't going to back you in any way - why would they?

e12e 10y ago
I think the parent alludes to Google being named as accomplices along with you. I do however think you're right that that might not mean much for your case. If nothing else, if two parties commit a crime, and one has a major legal team, it seems like the most probable outcome is that the other party will take the fall.
- owenmarshall 10y ago
  That's beyond a fantasy - Google isnt party to a conspiracy because they have a built in affirmative defense: our actions weren't taken to further a conspiracy, they were incidental.
  - jsprogrammer 10y ago
    The question is whether the content is fair game (to access). Google has already proved it to be fair game and if anyone wants to argue otherwise, they would need to then argue with the most flagrant offender, Google, who has much more than just "Confidential" PDFs. Google would be guilty of any charge that could be levied against someone for accessing data that Google actively provides.
    - IanCal 10y ago
      I'm sorry but I think this is rather ridiculous. Google's position is that they have automatically indexed everything that the server said it could, but will remove anything and provide websites a way of doing this. Your position would have to be that you searched for obviously confidential documents, found them and downloaded them without knowing you shouldn't.
      - 13of40 10y ago
        Guys, I think we got out in the weeds a little bit with the google thing. The question is if someone puts up a web server on the internet with no authentication and no notice that it's not open for public use, can they get me for "unauthorized access" if I download content from it? If not, what makes HTTP special - why not SQL or SMB?
        comex 10y ago
        The relevant question is not whether there is an explicit notice, but whether common sense suggests that you are intentionally making unauthorized accesses - as would be the case with the Google search you mentioned. See also: https://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_email_address_leak https://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_...
        jsprogrammer 10y ago
        Common sense? If you send a valid HTTP GET to someone's server and they respond with a 200 OK and some content, the access was not unauthorized. The HTTP protocol actually makes authorization an explicit mechanism that may be disabled or loosened at the implementor's leisure.
        13of40 10y ago
        That's a good point. 401 Unauthorized... They even used the right word.
        comex 10y ago
        To be fair, the EFF took a position in the case I linked that suggests they might agree with you in the present Google hypothetical too: https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-beginning-end https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-begi... Not only that, I was actually surprised to find that the New Jersey court cited a state precedent along similar lines: http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevrulingvacation.pdf http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevru... -> http://caselaw.findlaw.com/nj-superior-court/1508996.html http://caselaw.findlaw.com/nj-superior-court/1508996.html ...though that was interpreting a state law and brought up the fact that the state law has some subtle differences from the federal CFAA (despite very similar wording, quite vague in both cases). On the other hand, in Craigslist v. 3Taps, a district judge found that simply evading an IP ban, while otherwise accessing entirely (intentionally) public information, counts as unauthorized access under the federal law. And then there's the case of Aaron Swartz. But anyway, even under the more permissive of the possible standards, your logic is too simplistic. What if I send a HTTP GET like this? GET /viewarticle.php?title=x%27%20UNION%20ALL%20SELECT%20%2A%20FROM%20%27users HTTP/1.1 It's a perfectly valid and well-formed request according to the HTTP standard, and even valid at the application level, in the sense that you technically can't rule out that an article might exist titled "x' UNION ALL SELECT * FROM 'users", and a correctly written server-side script would interpret the request simply as searching for such an article. But suppose the script isn't correct, and instead of showing an article dumps its user table. Would you say that my access to user data is authorized? Well, I actually don't know how you'd answer the previous question, but I strongly doubt any court would answer yes. If you say no, then the implication follows that either the difficulty of constructing the dubious request, or perhaps the intent, or something else relatively wishy-washy and subjective can make the difference between authorized and unauthorized. It can't be reduced to some strict technical standard.

e12e 10y ago

I think the parent alludes to Google being named as accomplices along with you. I do however think you're right that that might not mean much for your case. If nothing else, if two parties commit a crime, and one has a major legal team, it seems like the most probable outcome is that the other party will take the fall.

owenmarshall 10y ago
That's beyond a fantasy - Google isnt party to a conspiracy because they have a built in affirmative defense: our actions weren't taken to further a conspiracy, they were incidental.
- jsprogrammer 10y ago
  The question is whether the content is fair game (to access). Google has already proved it to be fair game and if anyone wants to argue otherwise, they would need to then argue with the most flagrant offender, Google, who has much more than just "Confidential" PDFs. Google would be guilty of any charge that could be levied against someone for accessing data that Google actively provides.
  - IanCal 10y ago
    I'm sorry but I think this is rather ridiculous. Google's position is that they have automatically indexed everything that the server said it could, but will remove anything and provide websites a way of doing this. Your position would have to be that you searched for obviously confidential documents, found them and downloaded them without knowing you shouldn't.
    - 13of40 10y ago
      Guys, I think we got out in the weeds a little bit with the google thing. The question is if someone puts up a web server on the internet with no authentication and no notice that it's not open for public use, can they get me for "unauthorized access" if I download content from it? If not, what makes HTTP special - why not SQL or SMB?
      - comex 10y ago
        The relevant question is not whether there is an explicit notice, but whether common sense suggests that you are intentionally making unauthorized accesses - as would be the case with the Google search you mentioned. See also: https://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_email_address_leak https://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_...
        jsprogrammer 10y ago
        Common sense? If you send a valid HTTP GET to someone's server and they respond with a 200 OK and some content, the access was not unauthorized. The HTTP protocol actually makes authorization an explicit mechanism that may be disabled or loosened at the implementor's leisure.
        13of40 10y ago
        That's a good point. 401 Unauthorized... They even used the right word.
        comex 10y ago
        To be fair, the EFF took a position in the case I linked that suggests they might agree with you in the present Google hypothetical too: https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-beginning-end https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-begi... Not only that, I was actually surprised to find that the New Jersey court cited a state precedent along similar lines: http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevrulingvacation.pdf http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevru... -> http://caselaw.findlaw.com/nj-superior-court/1508996.html http://caselaw.findlaw.com/nj-superior-court/1508996.html ...though that was interpreting a state law and brought up the fact that the state law has some subtle differences from the federal CFAA (despite very similar wording, quite vague in both cases). On the other hand, in Craigslist v. 3Taps, a district judge found that simply evading an IP ban, while otherwise accessing entirely (intentionally) public information, counts as unauthorized access under the federal law. And then there's the case of Aaron Swartz. But anyway, even under the more permissive of the possible standards, your logic is too simplistic. What if I send a HTTP GET like this? GET /viewarticle.php?title=x%27%20UNION%20ALL%20SELECT%20%2A%20FROM%20%27users HTTP/1.1 It's a perfectly valid and well-formed request according to the HTTP standard, and even valid at the application level, in the sense that you technically can't rule out that an article might exist titled "x' UNION ALL SELECT * FROM 'users", and a correctly written server-side script would interpret the request simply as searching for such an article. But suppose the script isn't correct, and instead of showing an article dumps its user table. Would you say that my access to user data is authorized? Well, I actually don't know how you'd answer the previous question, but I strongly doubt any court would answer yes. If you say no, then the implication follows that either the difficulty of constructing the dubious request, or perhaps the intent, or something else relatively wishy-washy and subjective can make the difference between authorized and unauthorized. It can't be reduced to some strict technical standard.