6 ms·

I think your analogy is incorrect. On a network you have to first identify yourself and then request access. If you have been specifically asked to not acces

I think your analogy is incorrect. On a network you have to first identify yourself and then request access. If you have been specifically asked to not access that (open) network in the past the onus should be on the network to keep a record of you. If you knowingly change your identity to bypass that level of security, then yes you are now trespassing.

nxc18 10y ago
Power deliberately changed their IP address after being blocked by Facebook, so yes, they deliberately changed their identity and were in fact trespassing.
- radiorental 10y ago
  case closed, no new precedent needs to be set.
- acranox 10y ago
  IP address does not equal identity.
  - coldtea 10y ago
    For the purposes of this discussion, and the "technical solutions" the grantparent asks for, it does.
    - Karunamon 10y ago
      It really shouldn't. An IP is just an endpoint which could be accessed by n physical people. Going much further down this road ends up in some rather unpleasant territory.
    - ythl 10y ago
      So what if that guy moves away and Comcast reassigns his IP address to some other customer?
      - coldtea 10y ago
        The guy did not do that in this court case, and for the purposes of this discussion. They did something else.
  - pc86 10y ago
    Pedantry. They instituted a technical change with the sole aim of circumventing Facebook's attempts to block their access.
    - riskable 10y ago
      This is the same argument people are making against this ruling. It sets a very bad precedent. Arguing that an IP address is an identity "for this case" or "this argument" has the same fundamental problem. No, an IP address is not an identity and blocking an IP address is the physical world equivalent of putting up some traffic cones on a sidewalk. You can still get to where you want to go but you now have to "walk around" or "work around" as we call it in the digital world. The only "clear message" it sends is, "don't use that IP."
      - pc86 10y ago
        I'm not arguing that an IP address is an identity. I'm arguing that Facebook made it explicitly clear, both via a cease & desist letter as well as technical changes, that it did not want Power accessing its servers or its data, whether on their own or on behalf of Power users. > The only "clear message" it sends is, "don't use that IP." Are you saying with a straight face that anyone at Power thought it was a coincidence that suddenly they couldn't access Facebook from very specific IP addresses?
        darkarmani 10y ago
        > I'm arguing that Facebook made it explicitly clear, both via a cease & desist letter as well as technical changes, that it did not want Power accessing its servers or its data, whether on their own or on behalf of Power users. Then it should stop authorizing Power to do so. Why would it let the credentials work for Power unless those credentials authorized Power access? That's the problem. The simple solution is 2-factor authentication. This is a solved problem. If you have "open access" of your web services and and access is non-disruptive, I don't know why this should be a criminal violation. It shouldn't be criminal just because it doesn't fit with your business model.
JimDabell 10y ago
They weren't accessing Facebook with their own account, they were accessing Facebook with their users' accounts.
- dspillett 10y ago
  At that point there is a significant chunk of law which may apply: if they can be seen, by the latter of the law, to be falsifying their identity (by using someone else's) to gain access to a resource, then there may be a case for them to be charged with fraud. Also, even though facebook themselves sometimes ask for the credentials to your other services (i.e. email accounts so they can scan for shared contacts), I bet their user agreements stipulate that your credentials for facebook should not be shared. I doubt they'd be stupid enough to punish their users for this, but is there some law that would be useful here for taking action against Power for encouraging users to breach their agreement with fb? NOTE: I'm not a lawyer so you'll need to check with one before relying on what I've just said to be correct!
  - pc86 10y ago
    > if they can be seen, by the latter of the law, to be falsifying their identity (by using someone else's) to gain access to a resource, then there may be a case for them to be charged with fraud. You've just made quite a few APIs illegal.
    - dspillett 10y ago
      Where "impersonation" is part of the protocol no deception is involved, so this shouldn't affect such APIs. In fact in those cases it is not really impersonation, it is acting on behalf of, presumably by prior agreement (or similar by words that are a bit less anthropomorphic).
  - riskable 10y ago
    Using someone's identity is only illegal if you do it without their knowledge/permission. Valets don't need to sign a power of attorney contract in order to use your keys to park your car. It's not really relevant to this case.
mikeash 10y ago
That's not how it works for physical trespassing. The onus is entirely on the trespasser not to go places he's not allowed. If a property owner tells you to stay off their property, and you subsequently visit that property, you're trespassing no matter how few barriers you encountered to that visit. Why shouldn't a clear "don't touch my web site" be legally enforceable, just like a clear "don't enter my unfenced, totally open yard" is? Note: I'm not at all sure it should be enforceable, and the idea makes me uncomfortable, but I can't come up with a good reason. This is a bit different from the common problem where someone guesses a URL and gets hit with unauthorized access. There, they merely lacked explicit permission to access the system in question, and the weird legal argument is that building a URL by hand implies unauthorized access. Here, the access followed a letter explicitly telling him not to access their system.

nxc18 10y ago

Power deliberately changed their IP address after being blocked by Facebook, so yes, they deliberately changed their identity and were in fact trespassing.

radiorental 10y ago
case closed, no new precedent needs to be set.
acranox 10y ago
IP address does not equal identity.
- coldtea 10y ago
  For the purposes of this discussion, and the "technical solutions" the grantparent asks for, it does.
  - Karunamon 10y ago
    It really shouldn't. An IP is just an endpoint which could be accessed by n physical people. Going much further down this road ends up in some rather unpleasant territory.
  - ythl 10y ago
    So what if that guy moves away and Comcast reassigns his IP address to some other customer?
    - coldtea 10y ago
      The guy did not do that in this court case, and for the purposes of this discussion. They did something else.
- pc86 10y ago
  Pedantry. They instituted a technical change with the sole aim of circumventing Facebook's attempts to block their access.
  - riskable 10y ago
    This is the same argument people are making against this ruling. It sets a very bad precedent. Arguing that an IP address is an identity "for this case" or "this argument" has the same fundamental problem. No, an IP address is not an identity and blocking an IP address is the physical world equivalent of putting up some traffic cones on a sidewalk. You can still get to where you want to go but you now have to "walk around" or "work around" as we call it in the digital world. The only "clear message" it sends is, "don't use that IP."
    - pc86 10y ago
      I'm not arguing that an IP address is an identity. I'm arguing that Facebook made it explicitly clear, both via a cease & desist letter as well as technical changes, that it did not want Power accessing its servers or its data, whether on their own or on behalf of Power users. > The only "clear message" it sends is, "don't use that IP." Are you saying with a straight face that anyone at Power thought it was a coincidence that suddenly they couldn't access Facebook from very specific IP addresses?
      - darkarmani 10y ago
        > I'm arguing that Facebook made it explicitly clear, both via a cease & desist letter as well as technical changes, that it did not want Power accessing its servers or its data, whether on their own or on behalf of Power users. Then it should stop authorizing Power to do so. Why would it let the credentials work for Power unless those credentials authorized Power access? That's the problem. The simple solution is 2-factor authentication. This is a solved problem. If you have "open access" of your web services and and access is non-disruptive, I don't know why this should be a criminal violation. It shouldn't be criminal just because it doesn't fit with your business model.

JimDabell 10y ago

They weren't accessing Facebook with their own account, they were accessing Facebook with their users' accounts.

dspillett 10y ago
At that point there is a significant chunk of law which may apply: if they can be seen, by the latter of the law, to be falsifying their identity (by using someone else's) to gain access to a resource, then there may be a case for them to be charged with fraud. Also, even though facebook themselves sometimes ask for the credentials to your other services (i.e. email accounts so they can scan for shared contacts), I bet their user agreements stipulate that your credentials for facebook should not be shared. I doubt they'd be stupid enough to punish their users for this, but is there some law that would be useful here for taking action against Power for encouraging users to breach their agreement with fb? NOTE: I'm not a lawyer so you'll need to check with one before relying on what I've just said to be correct!
- pc86 10y ago
  > if they can be seen, by the latter of the law, to be falsifying their identity (by using someone else's) to gain access to a resource, then there may be a case for them to be charged with fraud. You've just made quite a few APIs illegal.
  - dspillett 10y ago
    Where "impersonation" is part of the protocol no deception is involved, so this shouldn't affect such APIs. In fact in those cases it is not really impersonation, it is acting on behalf of, presumably by prior agreement (or similar by words that are a bit less anthropomorphic).
- riskable 10y ago
  Using someone's identity is only illegal if you do it without their knowledge/permission. Valets don't need to sign a power of attorney contract in order to use your keys to park your car. It's not really relevant to this case.

mikeash 10y ago

That's not how it works for physical trespassing. The onus is entirely on the trespasser not to go places he's not allowed. If a property owner tells you to stay off their property, and you subsequently visit that property, you're trespassing no matter how few barriers you encountered to that visit. Why shouldn't a clear "don't touch my web site" be legally enforceable, just like a clear "don't enter my unfenced, totally open yard" is? Note: I'm not at all sure it should be enforceable, and the idea makes me uncomfortable, but I can't come up with a good reason. This is a bit different from the common problem where someone guesses a URL and gets hit with unauthorized access. There, they merely lacked explicit permission to access the system in question, and the weird legal argument is that building a URL by hand implies unauthorized access. Here, the access followed a letter explicitly telling him not to access their system.