3 ms·

Is this a violation of the CFAA? Without explicit permission to do this, it seems an awful lot like unauthorized use

thephyber 9y ago
I'm not a lawyer, so my opinion is worth what you paid for it, but... Without an authentication bypass, I don't think the CFAA applies (last I perused it). The end user probably doesn't have standing under CFAA unless the website's ToS suggested they would not act this way. If you, as a web visitor, visit a website you are largely at the mercy of whatever plugins they load onto your browser during that session. In exchange for access to the content on the site, the website owner can steal your data (tracking + analytics), your bandwidth (autoplay advertising videos), and the processing resources associated with loading a webpage (or whatever else you can do in a webpage). The website's owner might be able to bring a case against the person who injected it, perhaps (depending on who it was and who authorized it). The infraction may not be "breaking into" a computer as the CFAA requires if it was a CBS/Showtime employee/contractor who did it. It is almost certainly grounds for some sort of punitive employment / civil action if it wasn't a requested feature by CBS/Showtime. The fun part about the law is that the gray areas aren't all defined ahead of time. Web visitors can sue or attempt to bring criminal charges and we get to watch how it unfolds in the courts.
- schwede 9y ago
  But when I go to a website I expect to get the content. I don't expect the owner to use my computer for mining. That seems like unauthorized use to me.
  - CoryG89 9y ago
    But when I go to website I expect to get the content. I don't expect the owner to use my computer for running a bunch of tracking ad code. That seems like unauthorized use to me.
  - thephyber 9y ago
    While I don't think that's actually how the law can be interpreted, it does get at the central issue most computer users/researchers have with the law. It allows different standards for what "unauthorized" means, hence it is very elastic and can easily be abused, especially when combined with the plea bargain process (@see Aaron Schwartz).
superkuh 9y ago
Everything is a violation of the CFAA. It's just a matter of who it is rocking the boat. They could just as easily make a ToS that would make it a violation of the CFAA to disable the monero miner. I don't see any problem with crypto-miners on pages for revenue though. They're no more resource stealing or annoying that the typical JS 'web app' that pass for websites these days.
wyldfire 9y ago
CFAA is wholly or at least primarily a part of the code focusing on criminal violations. So unfortunately it would require a motivated government attorney in order to invoke the CFAA. This likely falls beneath their outrage level.
Tepix 9y ago
What's the difference (legally speaking) between a badly programmed inefficient ad that hogs your CPU and some mining code?
- Dolores12 9y ago
  intention

I'm not a lawyer, so my opinion is worth what you paid for it, but... Without an authentication bypass, I don't think the CFAA applies (last I perused it). The end user probably doesn't have standing under CFAA unless the website's ToS suggested they would not act this way. If you, as a web visitor, visit a website you are largely at the mercy of whatever plugins they load onto your browser during that session. In exchange for access to the content on the site, the website owner can steal your data (tracking + analytics), your bandwidth (autoplay advertising videos), and the processing resources associated with loading a webpage (or whatever else you can do in a webpage). The website's owner might be able to bring a case against the person who injected it, perhaps (depending on who it was and who authorized it). The infraction may not be "breaking into" a computer as the CFAA requires if it was a CBS/Showtime employee/contractor who did it. It is almost certainly grounds for some sort of punitive employment / civil action if it wasn't a requested feature by CBS/Showtime. The fun part about the law is that the gray areas aren't all defined ahead of time. Web visitors can sue or attempt to bring criminal charges and we get to watch how it unfolds in the courts.

schwede 9y ago
But when I go to a website I expect to get the content. I don't expect the owner to use my computer for mining. That seems like unauthorized use to me.
- CoryG89 9y ago
  But when I go to website I expect to get the content. I don't expect the owner to use my computer for running a bunch of tracking ad code. That seems like unauthorized use to me.
- thephyber 9y ago
  While I don't think that's actually how the law can be interpreted, it does get at the central issue most computer users/researchers have with the law. It allows different standards for what "unauthorized" means, hence it is very elastic and can easily be abused, especially when combined with the plea bargain process (@see Aaron Schwartz).

superkuh 9y ago

Everything is a violation of the CFAA. It's just a matter of who it is rocking the boat. They could just as easily make a ToS that would make it a violation of the CFAA to disable the monero miner. I don't see any problem with crypto-miners on pages for revenue though. They're no more resource stealing or annoying that the typical JS 'web app' that pass for websites these days.

wyldfire 9y ago

CFAA is wholly or at least primarily a part of the code focusing on criminal violations. So unfortunately it would require a motivated government attorney in order to invoke the CFAA. This likely falls beneath their outrage level.

Tepix 9y ago

What's the difference (legally speaking) between a badly programmed inefficient ad that hogs your CPU and some mining code?

Dolores12 9y ago
intention