4 ms·

I don't use any service without having a basic understanding oh how secure and private their systems are - the CFAA makes that all illegal "You wouldn't open a

by nikcub 10y ago

I don't use any service without having a basic understanding oh how secure and private their systems are - the CFAA makes that all illegal "You wouldn't open an unlocked door" is the "you wouldn't download a car" of infosec. The later redefined theft as not requiring anybody to be deprived of a good while the former has the same flaw, you arent deprived of any good, you aren't harmed, you haven't been coerced or forced - i.e. It meets none of the common law definitions of trespass[0] [0] but it does explain why ddos attacks, spam and stealing user data are trespass because they do meet those definitions

pluma 10y ago
FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. There's a difference between "opening an unlocked door" and opening it, walking through it, making notes of everything behind it and repeating this room for all the other unlocked doors and then doing that pretty much continuously for days, weeks, months or however long Uber did it.
- nikcub 10y ago
  My point was that walking through an unlocked door is a terrible analogy for accessing a resource URI that isn't directly linked from a page
- pdpi 10y ago
  > FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. I would totally open an unmarked unlocked door in a public space that has locked doors clearly marked "restricted access", especially if the layout of the place I'm visiting suggests that there would be something interesting there. That's pretty much what it boils down to, no? Just because you didn't document an endpoint doesn't necessarily mean it's restricted access. In fact, if the end point is accessible, and you have other sections of your service that require authentication, then it's very much the exception that proves the rule — the fact that you specifically forbid access to some routes reasonably means that, in general, I'm allowed access to unauthenticated endpoints.
UncleMeat 10y ago
Enumeration attacks are clearly covered by CFAA based on current law. See weev for example.

by nikcub 10y ago

pluma 10y ago

FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. There's a difference between "opening an unlocked door" and opening it, walking through it, making notes of everything behind it and repeating this room for all the other unlocked doors and then doing that pretty much continuously for days, weeks, months or however long Uber did it.

nikcub 10y ago
My point was that walking through an unlocked door is a terrible analogy for accessing a resource URI that isn't directly linked from a page
pdpi 10y ago
> FWIW, I wouldn't walk through an unlocked door I'm clearly not meant to walk through. I would totally open an unmarked unlocked door in a public space that has locked doors clearly marked "restricted access", especially if the layout of the place I'm visiting suggests that there would be something interesting there. That's pretty much what it boils down to, no? Just because you didn't document an endpoint doesn't necessarily mean it's restricted access. In fact, if the end point is accessible, and you have other sections of your service that require authentication, then it's very much the exception that proves the rule — the fact that you specifically forbid access to some routes reasonably means that, in general, I'm allowed access to unauthenticated endpoints.

UncleMeat 10y ago

Enumeration attacks are clearly covered by CFAA based on current law. See weev for example.