3 ms·
>Requests with SQL in them shouldn't be illegal. Intent matters here. If little "Johnny DROP TABLE" causes a problem with his input but there is no evidence he
by madmax96 10y ago
>Requests with SQL in them shouldn't be illegal.
Intent matters here. If little "Johnny DROP TABLE" causes a problem with his input but there is no evidence he did so deliberately, I don't think a sane person would argue he was cracking. But if a user fetches "Main St. USA Business" unencrypted passwords and sells or distributes them, clearly a line has been crossed. That line seems to be "personal profit", financially or otherwise.
- riskable 10y agoActually, there's loads of laws like this! I'd argue that if a user fetches the unencrypted passwords of users from a website that they shouldn't be punished at all because merely obtaining such information isn't harmful to anyone until it is used (in a nefarious way). If I download a huge list of credit card/account details that someone accidentally exposed on their website have I committed a crime? Certainly not! If I use those account details to commit fraud (or similar crimes) then it's a problem. Aside: If someone is able to pull unencrypted passwords from any company's database the real crime there is the fact that the passwords were stored unencrypted in the first place!
- deleted 10y ago[deleted]