5 ms·

Hasn't unauthorized access of a server with weak or no security measures been proven illegal many times in court already, though? Admittedly, I'm not a legal ex

by joemi 9y ago

Hasn't unauthorized access of a server with weak or no security measures been proven illegal many times in court already, though? Admittedly, I'm not a legal expert of any kind, but I could swear that's a common thing.

theossuary 9y ago
That's like saying you looked at my open front door so you committed B&E
- joemi 9y ago
  Sure, that's one way to look at it. But also, since you have to actually interact with the server in order to discover such vulnerabilities in it, it could also be viewed as similar to walking in through an unlocked door and looking around. That, at least, is trespassing, I believe.
  - tertius 9y ago
    Or making an inventory list of everything inside. "Oh, here's a filing cabinet, I'll just pull the inventory. Just peeking in..."
    - slackingoff2017 9y ago
      When you connect with ftp or HTTP you get a top level directory or a home page. Same thing as looking through an open door.
  - theossuary 9y ago
    Alright if we want to get specific it's like being blind and touching a home's open front door. Incredulous that the door is open you feel around inside for a second and feel a set of keys on the hook. You leave at this point and a week later are arrested for B&E because your fingerprints are on the keys (or you were stupid enough to tell the owner their door was open)
- maxerickson 9y ago
  Yes, the CFAA has a low bar for charging with a felony.
hoprocker 9y ago
The analogy is a little twisty, but yeah, seeing the files in the directory is probably like looking in through the door, and actually opening them is probably more like trespassing.
- tertius 9y ago
  So he downloaded a list of files. That's like going in the door, opening the refrigerator (or filing cabinet) and making an inventory. The list itself could have private and protected information.
  - slackingoff2017 9y ago
    An ftp client downloads a list of files as soon as you connect. It's the same as fat fingering a website in your browser. Are you saying I should go to jail if I type the wrong website, it loads, and it turns out that site was supposed to be "private"? My browser downloaded the home page and all the files on it. What if I click the wrong wifi network and use it all day without noticing? Should I get charged for "unauthorized access"? There needs to be a reasonable standard for security above "so insecure you could do this by accident" to send people to jail. Whoever set up the server that shitty should be charged with negligence.
    - tertius 9y ago
      > Are you saying I should go to jail if I type the wrong website No, I'm not saying anyone should go to jail. The person in question did not do this by mistake though. In general I'm in agreement with you. I'm just making sure we don't mix analogies. Looking through an open door is not the same as connecting to an FTP server and getting list of files.
      - slackingoff2017 9y ago
        I'm saying that unauthorized access shouldn't apply to things that are trivial to access even by mistake. The law needs to be at the same standard as real life. For example the police can search your belongings unless they're locked, then you need a warrant. If you've got a service wide open on the internet with no security it shouldn't be a crime just because somebody found it. The difference between doors and locks is that going through real life doorways is a lot different than connecting to a service. On the internet the act of connecting to it gives you access to the inside, there's no second act of walking in. It's like an open door that throws a copy of it's contents at anyone that finds it.

by joemi 9y ago

theossuary 9y ago

That's like saying you looked at my open front door so you committed B&E

joemi 9y ago
Sure, that's one way to look at it. But also, since you have to actually interact with the server in order to discover such vulnerabilities in it, it could also be viewed as similar to walking in through an unlocked door and looking around. That, at least, is trespassing, I believe.
- tertius 9y ago
  Or making an inventory list of everything inside. "Oh, here's a filing cabinet, I'll just pull the inventory. Just peeking in..."
  - slackingoff2017 9y ago
    When you connect with ftp or HTTP you get a top level directory or a home page. Same thing as looking through an open door.
- theossuary 9y ago
  Alright if we want to get specific it's like being blind and touching a home's open front door. Incredulous that the door is open you feel around inside for a second and feel a set of keys on the hook. You leave at this point and a week later are arrested for B&E because your fingerprints are on the keys (or you were stupid enough to tell the owner their door was open)
maxerickson 9y ago
Yes, the CFAA has a low bar for charging with a felony.

hoprocker 9y ago

The analogy is a little twisty, but yeah, seeing the files in the directory is probably like looking in through the door, and actually opening them is probably more like trespassing.

tertius 9y ago
So he downloaded a list of files. That's like going in the door, opening the refrigerator (or filing cabinet) and making an inventory. The list itself could have private and protected information.
- slackingoff2017 9y ago
  An ftp client downloads a list of files as soon as you connect. It's the same as fat fingering a website in your browser. Are you saying I should go to jail if I type the wrong website, it loads, and it turns out that site was supposed to be "private"? My browser downloaded the home page and all the files on it. What if I click the wrong wifi network and use it all day without noticing? Should I get charged for "unauthorized access"? There needs to be a reasonable standard for security above "so insecure you could do this by accident" to send people to jail. Whoever set up the server that shitty should be charged with negligence.
  - tertius 9y ago
    > Are you saying I should go to jail if I type the wrong website No, I'm not saying anyone should go to jail. The person in question did not do this by mistake though. In general I'm in agreement with you. I'm just making sure we don't mix analogies. Looking through an open door is not the same as connecting to an FTP server and getting list of files.
    - slackingoff2017 9y ago
      I'm saying that unauthorized access shouldn't apply to things that are trivial to access even by mistake. The law needs to be at the same standard as real life. For example the police can search your belongings unless they're locked, then you need a warrant. If you've got a service wide open on the internet with no security it shouldn't be a crime just because somebody found it. The difference between doors and locks is that going through real life doorways is a lot different than connecting to a service. On the internet the act of connecting to it gives you access to the inside, there's no second act of walking in. It's like an open door that throws a copy of it's contents at anyone that finds it.