7 ms·

Reloading a page isn't exploiting it though. That's normal use. With a bar that low it becomes a game of you reading the minds of the implementors. "Oh, maybe

Reloading a page isn't exploiting it though. That's normal use. With a bar that low it becomes a game of you reading the minds of the implementors. "Oh, maybe they didn't think that anyone would bookmark a URL, etc. Maybe they want me to go to page X, which may or may not link to this anymore...?" It'd be better for everyone (judges) to assume that they meant to make the service entirely unprotected. Then innocent page-reloaders wouldn't go to jail and people could sue the company for their marketing lies, etc.

tptacek 10y ago
Since CFAA defines no strict-liability crimes, simply reloading a page is extraordinarily unlikely to get you charged.
- EdHominem 10y ago
  That's gamed though. It's supposed to be criminal intent but prosecutors routinely bend it to be intent to perform any action during which a crime may have happened. (I did not intend to trespass on your land, though of course I did intend to go for the walk in the first place...) I can intentionally call your documents department and "guess a URL" without breaking the law, but if I do it on your webserver that same legal intent is turned around and used a proof of criminality. Leaving me with guessing "well, there's a document there in the public folder but maybe they don't want me to see it." Of course, this is all about malicious and inconsistent prosecution. For you and I it's a theoretical game, but Weev could go back to jail for relying on convention to guess that index.html is public. We need an actual technological bar otherwise our security industry becomes an ass-covering exercise.
  - Natsu 10y ago
    Yes, I do see some need for a technical bar. That's why I've said before that for 'unauthorized access' to a computer system you (should) need to knowingly access a protected system in a way not permitted by the rights granted to you by the computer system, or by deliberate deception of either the computer systems or people. So there needs to be an actual lock on the door that you've done something to bypass, whether that be manipulating the computers or lying to someone (or thing) to gain access.
    - tptacek 10y ago
      No similar provision exists for unauthorized access to property. Opening an unlocked window (or door, or curtain) and climbing through it is an offense with a name: breaking and entering.
      - AnthonyMouse 10y ago
        But you aren't opening an unlocked window (or door, or curtain). You're asking the property manager to open it for you, and they do.
        tptacek 10y ago
        Also breaking and entering!
        AnthonyMouse 10y ago
        Breaking and entering implies there is no authorization but here we have the property manager saying yes. Also, breaking and entering is generally a misdemeanor rather than a felony. And on top of that, there is no entering. People love to paint bad abstractions on top of computers, but fundamentally all there ever can be is you asking the remote computer to do something and it deciding whether to do it or not. That doesn't look anything like B&E or trespass. The best meatspace analogy is social engineering. But there is no generic law against manipulating people and the laws against specific types of manipulation are highly context-dependent because so is the harm.
        tptacek 10y ago
        Where are you getting this "misdemeanor" thing from? Burglary is a felony, and it's defined in most places simply by entering a building or vehicle without permission and with illicit intent (that intent need not be "to steal stuff").
        10y ago

tptacek 10y ago

Since CFAA defines no strict-liability crimes, simply reloading a page is extraordinarily unlikely to get you charged.

EdHominem 10y ago
That's gamed though. It's supposed to be criminal intent but prosecutors routinely bend it to be intent to perform any action during which a crime may have happened. (I did not intend to trespass on your land, though of course I did intend to go for the walk in the first place...) I can intentionally call your documents department and "guess a URL" without breaking the law, but if I do it on your webserver that same legal intent is turned around and used a proof of criminality. Leaving me with guessing "well, there's a document there in the public folder but maybe they don't want me to see it." Of course, this is all about malicious and inconsistent prosecution. For you and I it's a theoretical game, but Weev could go back to jail for relying on convention to guess that index.html is public. We need an actual technological bar otherwise our security industry becomes an ass-covering exercise.
- Natsu 10y ago
  Yes, I do see some need for a technical bar. That's why I've said before that for 'unauthorized access' to a computer system you (should) need to knowingly access a protected system in a way not permitted by the rights granted to you by the computer system, or by deliberate deception of either the computer systems or people. So there needs to be an actual lock on the door that you've done something to bypass, whether that be manipulating the computers or lying to someone (or thing) to gain access.
  - tptacek 10y ago
    No similar provision exists for unauthorized access to property. Opening an unlocked window (or door, or curtain) and climbing through it is an offense with a name: breaking and entering.
    - AnthonyMouse 10y ago
      But you aren't opening an unlocked window (or door, or curtain). You're asking the property manager to open it for you, and they do.
      - tptacek 10y ago
        Also breaking and entering!
        AnthonyMouse 10y ago
        Breaking and entering implies there is no authorization but here we have the property manager saying yes. Also, breaking and entering is generally a misdemeanor rather than a felony. And on top of that, there is no entering. People love to paint bad abstractions on top of computers, but fundamentally all there ever can be is you asking the remote computer to do something and it deciding whether to do it or not. That doesn't look anything like B&E or trespass. The best meatspace analogy is social engineering. But there is no generic law against manipulating people and the laws against specific types of manipulation are highly context-dependent because so is the harm.
        tptacek 10y ago
        Where are you getting this "misdemeanor" thing from? Burglary is a felony, and it's defined in most places simply by entering a building or vehicle without permission and with illicit intent (that intent need not be "to steal stuff").
        10y ago