3 ms·
It's actually not. Laws are not an appropriate analogy for technical security controls. First and foremost, laws exist which are clearly not enforced. Technical
by dsacco 9y ago
It's actually not. Laws are not an appropriate analogy for technical security controls. First and foremost, laws exist which are clearly not enforced. Technical security controls exist, or they don't. They don't generally rely on human arbitrators for enforcement, unlike legislation. Once it is in place, the technical nature of the control is self-enforcing; bypassing the enforcement is what constitutes "hacking." In this way criminality and hacking aren't comparable. A better comparison might be security policies and laws, but that's close to tautological because they're so similar.
Moreover, laws can be broken unintentionally, and under this definition you cannot hack something unintentionally. Awareness can be tantamount to intentionality - I'd argue most people aren't even aware they're jaywalking when they do it. It stretches the boundaries of believability that someone would log in as someone else and not be aware that they did it. In a contrived scenario where they did somehow accomplish that, I wouldn't call it hacking.
- lazylizard 9y agojust to confirm. within this scheme, all a website needs is 2 form fields "userid" and "password" , they don't even have to do anything, and if you crawled it, you've hacked it?
- dsacco 9y agoIf the login interface actually works (i.e. it's actually an access control), and you successfully login with credentials that aren't yours - yes, you've hacked it. It's only a hack if you intend to do it and the interface is a good faith implementation. I don't really follow your question in this comment and the other one though - what do you mean about CIA desires? You need to understand that a technical control represents a control in order to intentionally bypass it.
- lazylizard 9y agothe problem is good faith and desire? if theres a bunch of numbers in my url after i login, and i'm oh so curious what i'd see if i increment that number by 1, now i'm hacking? i mean, i believe the website simply didnt want to implement session control, if i saw someone else's account details, is that acceptable interpretation? there's no "rule of the internet" that says we must only navigate by provided links on a html page, is there?
- dsacco 9y ago> if theres a bunch of numbers in my url after i login, and i'm oh so curious what i'd see if i increment that number by 1, now i'm hacking Under the definition above, if you do it to deliberately bypass the control, then yes. If you do it out of curiosity without believing you might subvert any control, then no you're not hacking.