5 ms·

> I'm arguing that Facebook made it explicitly clear, both via a cease & desist letter as well as technical changes, that it did not want Power accessing its se

> I'm arguing that Facebook made it explicitly clear, both via a cease & desist letter as well as technical changes, that it did not want Power accessing its servers or its data, whether on their own or on behalf of Power users. Then it should stop authorizing Power to do so. Why would it let the credentials work for Power unless those credentials authorized Power access? That's the problem. The simple solution is 2-factor authentication. This is a solved problem. If you have "open access" of your web services and and access is non-disruptive, I don't know why this should be a criminal violation. It shouldn't be criminal just because it doesn't fit with your business model.

drewgross 10y ago
If I tell you not to enter my house, and take no further steps to prevent you from entering my house, such as closing the door, it's still illegal for you to enter my house. If I tell you not to enter my business, and take no further steps for prevent you from doing so, it's illegal for you to enter (unless I have banned you for being a protected class). If I tell you not to ssh into a computer I own, and take no further steps to prevent you from doing so, it's still illegal. I think a lot of software engineers get so wrapped up in the technical side of security and dealing with anonymous and untraceable threats that they don't realize that for the most part, the law doesn't care about technical access control. It cares about social access control.
- pc86 10y ago
  Thank you for coming up with a much better example than I could.
- darkarmani 10y ago
  > If I tell you not to ssh into a computer I own, and take no further steps to prevent you from doing so, it's still illegal. What if you tell me to stop doing it, but my friend is allowed and he types all of the commands that i tell him to type and then he sends me the data? That's why it doesn't quite make sense. It doesn't make as much sense for a publicly accessible website and user tokens. It makes sense from a tort point of view, but not from a criminal point of view. The next step away would be for users to install an app that logs into facebook and forwards the data to the centralized server.

drewgross 10y ago

If I tell you not to enter my house, and take no further steps to prevent you from entering my house, such as closing the door, it's still illegal for you to enter my house. If I tell you not to enter my business, and take no further steps for prevent you from doing so, it's illegal for you to enter (unless I have banned you for being a protected class). If I tell you not to ssh into a computer I own, and take no further steps to prevent you from doing so, it's still illegal. I think a lot of software engineers get so wrapped up in the technical side of security and dealing with anonymous and untraceable threats that they don't realize that for the most part, the law doesn't care about technical access control. It cares about social access control.

pc86 10y ago
Thank you for coming up with a much better example than I could.
darkarmani 10y ago
> If I tell you not to ssh into a computer I own, and take no further steps to prevent you from doing so, it's still illegal. What if you tell me to stop doing it, but my friend is allowed and he types all of the commands that i tell him to type and then he sends me the data? That's why it doesn't quite make sense. It doesn't make as much sense for a publicly accessible website and user tokens. It makes sense from a tort point of view, but not from a criminal point of view. The next step away would be for users to install an app that logs into facebook and forwards the data to the centralized server.