9 ms·

As far as the CFAA, you may have a point. However, the EFF is spot on when it comes to the DMCA, which does in fact allow for speech to be restricted even when

by Meist1 8y ago

As far as the CFAA, you may have a point. However, the EFF is spot on when it comes to the DMCA, which does in fact allow for speech to be restricted even when no identifiable 'hack' under the CFAA is alleged. The MBTA case is probably the most famous - https://www.wired.com/2008/08/eff-to-appeal-r/ https://www.wired.com/2008/08/eff-to-appeal-r/ Also, while not approving of 'weev' or his methods, I think most on HN and elsewhere would agree that merely visiting a website should not be considered a hack - https://www.wired.com/2013/03/att-hacker-gets-3-years/ https://www.wired.com/2013/03/att-hacker-gets-3-years/ - adding an additional layer to this mess.

crankylinuxuser 8y ago
Ive always wanted to know, using CFAA logic, how does one know if someone is offering a service to be used online? Is there a standard service that announces available services? If not, how do I know if I'm 'allowed' to use Google.com:80 ? Where is that fact delineated?
- snowwrestler 8y ago
  In the terms of service. For Google, that's: https://policies.google.com/terms https://policies.google.com/terms
  - crankylinuxuser 8y ago
    That's fine you gave me a link and a path... How do I know I'm allowed to go there?
    - snowwrestler 8y ago
      How did you know that you're allowed to come here? And yet, here you are. I don't think you actually believe what you're trying to argue here.
      - lscharen 8y ago
        I think you're missing the (subtle) point that is trying to be made. I can go to google.com or HN because I type the URL into a browser and the page is displayed -- I didn't need to go through an approval process or present a security token or anything else to gain access. Now, what if I type in a URL into my browser that happens to look like company.com/users/12345/purchases and it displays a page of information. Did I "circumvent" anything in this case? Did I "exceed" my authorized access? If so, what is the fundamental difference between accessing google.com and this hypothetical URL?
        Filligree 8y ago
        > If so, what is the fundamental difference between accessing google.com and this hypothetical URL? Your intention. It matters.
      - deleted 8y ago
        [deleted]
      - _jal 8y ago
        The point isn't what people believe about thought experiments, the point is the uncertainty in the law. Yes, it is reductio ad absurdum to question hitting port 80 on a public site. Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? Note that there are people here claiming that the last bit is 'hacking' under the law, and in some cases they are right. So now we can't change URLs without hacking, but only when doing so knowingly exceeds authorization. Well, what does that mean? Let me offer an example: Someone uses the dumb disable-right-click Javascript to stop people from downloading their images. I disable JS and save an image. Put aside copyright and focus on the CFAA: Have I broken it? If so, does this seem to be the sort of thing that should be a felony to you?
        pvg 8y ago
        Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? That's why we have trials and juries and so on. 'Working a little harder' and trying to find trivial logical gotchas in law is a pointless thing to do and discuss because it's very much not how the legal system works. The law is not a program interpreted once by some literalist, implacable CPU.
    - rayiner 8y ago
      The test under the CFAA is the opposite: there is only liability if you know that you’re not allowed to go there.
- rayiner 8y ago
  > knowingly accessed a computer without authorization or exceeding authorized access The CFAA requires knowingly exceeding authorized access or doing so intentionally. If, in fact, you don’t know access is unauthorized, you’re not liable for a CFAA violation. So you can go blissfully through life doing what you, in good faith, may reasonably guess the web site owner intends you to do. You don’t need the rules “deliniated” just like for any other kind of property. However, there is what you say about what you knew, and what a jury may reasonably infer about what you knew. If you say you didn’t know accessing port 80 was unauthorized, the jury will probably buy it, because port 80 is expected to host publicly available web services. However, if you take a URL and start manually fiddling with numbers, and you see that it yields credit card information, the jury probably won’t believe you if you say you didn’t know that access was unauthorized.[1] Similarly if you access a resource, and the web site owner tells you not to do it, or bans your IP, now you know. CFAA prosecutions are almost invariably based on a scenario where it is abundantly clear that someone knew she wasn’t supposed to be doing what she was doing. [1] But, say you’re accessing a page programatically and there is a bug in your code and you access some URL that yields credit card information, which you promptly delete because you are acting in good faith. There is no CFAA violation because you had neither knowledge or intent. And to my knowledge, nobody has been convicted of violating the CFAA in such a situation.
  - angersock 8y ago
    The problem comes when we've normalized the idea of exploring public endpoints as "yeah, this is probably exceeding authorized access".
    - harryh 8y ago
      The problem comes when we've normalized the idea of exploring buildings with unlicked doors as "yeah, this is probably exceeding authorized access". People on here talk all the time about how their digital possessions are just as important as their physical possessions (if not more-so). Given that it seems perfectly reasonable to have the same cultural norms about exploring digital spaces as physical ones.
- pavon 8y ago
  Turning the question around, if you did discover that you were able access a site, and it concerned you enough that you felt obliged to report it as a security problem, then by your own judgement you have decided you shouldn't have had access. So this creates a bad situation where responsibly reporting security holes provides evidence that you knew the access was not authorized, regardless of your intent.
- deleted 8y ago
  [deleted]
tptacek 8y ago
The MBTA case is in a bunch of ways analogous to cases where people have gotten in trouble for probing websites. The real target of the MBTA hack isn't the cards themselves, but the centralized MBTA fare collection system. You can probably do whatever you want to a card you own (in particular: you can conduct whatever research you like involving reading the cards), but once you're interacting with the fare collection system, you're communicating with a computer system you do not own or operate, and are back in CFAA country. For that reason, I don't think the MBTA hack is a great counterexample to the parent's (well-reasoned) argument. You'll have a difficult time building a case against the CFAA based on Aurenheimer's actions, since the prosecution was able to demonstrate with his own words that he knew he wasn't authorized to take the records. In fact, his appeal against the CFAA conviction failed with a citation to his pre-arrest appeal to the media to have him explain "the method of [his] theft".

by Meist1 8y ago

crankylinuxuser 8y ago

Ive always wanted to know, using CFAA logic, how does one know if someone is offering a service to be used online? Is there a standard service that announces available services? If not, how do I know if I'm 'allowed' to use Google.com:80 ? Where is that fact delineated?

snowwrestler 8y ago
In the terms of service. For Google, that's: https://policies.google.com/terms https://policies.google.com/terms
- crankylinuxuser 8y ago
  That's fine you gave me a link and a path... How do I know I'm allowed to go there?
  - snowwrestler 8y ago
    How did you know that you're allowed to come here? And yet, here you are. I don't think you actually believe what you're trying to argue here.
    - lscharen 8y ago
      I think you're missing the (subtle) point that is trying to be made. I can go to google.com or HN because I type the URL into a browser and the page is displayed -- I didn't need to go through an approval process or present a security token or anything else to gain access. Now, what if I type in a URL into my browser that happens to look like company.com/users/12345/purchases and it displays a page of information. Did I "circumvent" anything in this case? Did I "exceed" my authorized access? If so, what is the fundamental difference between accessing google.com and this hypothetical URL?
      - Filligree 8y ago
        > If so, what is the fundamental difference between accessing google.com and this hypothetical URL? Your intention. It matters.
    - deleted 8y ago
      [deleted]
    - _jal 8y ago
      The point isn't what people believe about thought experiments, the point is the uncertainty in the law. Yes, it is reductio ad absurdum to question hitting port 80 on a public site. Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? Note that there are people here claiming that the last bit is 'hacking' under the law, and in some cases they are right. So now we can't change URLs without hacking, but only when doing so knowingly exceeds authorization. Well, what does that mean? Let me offer an example: Someone uses the dumb disable-right-click Javascript to stop people from downloading their images. I disable JS and save an image. Put aside copyright and focus on the CFAA: Have I broken it? If so, does this seem to be the sort of thing that should be a felony to you?
      - pvg 8y ago
        Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? That's why we have trials and juries and so on. 'Working a little harder' and trying to find trivial logical gotchas in law is a pointless thing to do and discuss because it's very much not how the legal system works. The law is not a program interpreted once by some literalist, implacable CPU.
  - rayiner 8y ago
    The test under the CFAA is the opposite: there is only liability if you know that you’re not allowed to go there.
rayiner 8y ago
> knowingly accessed a computer without authorization or exceeding authorized access The CFAA requires knowingly exceeding authorized access or doing so intentionally. If, in fact, you don’t know access is unauthorized, you’re not liable for a CFAA violation. So you can go blissfully through life doing what you, in good faith, may reasonably guess the web site owner intends you to do. You don’t need the rules “deliniated” just like for any other kind of property. However, there is what you say about what you knew, and what a jury may reasonably infer about what you knew. If you say you didn’t know accessing port 80 was unauthorized, the jury will probably buy it, because port 80 is expected to host publicly available web services. However, if you take a URL and start manually fiddling with numbers, and you see that it yields credit card information, the jury probably won’t believe you if you say you didn’t know that access was unauthorized.[1] Similarly if you access a resource, and the web site owner tells you not to do it, or bans your IP, now you know. CFAA prosecutions are almost invariably based on a scenario where it is abundantly clear that someone knew she wasn’t supposed to be doing what she was doing. [1] But, say you’re accessing a page programatically and there is a bug in your code and you access some URL that yields credit card information, which you promptly delete because you are acting in good faith. There is no CFAA violation because you had neither knowledge or intent. And to my knowledge, nobody has been convicted of violating the CFAA in such a situation.
- angersock 8y ago
  The problem comes when we've normalized the idea of exploring public endpoints as "yeah, this is probably exceeding authorized access".
  - harryh 8y ago
    The problem comes when we've normalized the idea of exploring buildings with unlicked doors as "yeah, this is probably exceeding authorized access". People on here talk all the time about how their digital possessions are just as important as their physical possessions (if not more-so). Given that it seems perfectly reasonable to have the same cultural norms about exploring digital spaces as physical ones.
pavon 8y ago
Turning the question around, if you did discover that you were able access a site, and it concerned you enough that you felt obliged to report it as a security problem, then by your own judgement you have decided you shouldn't have had access. So this creates a bad situation where responsibly reporting security holes provides evidence that you knew the access was not authorized, regardless of your intent.
deleted 8y ago
[deleted]

tptacek 8y ago

The MBTA case is in a bunch of ways analogous to cases where people have gotten in trouble for probing websites. The real target of the MBTA hack isn't the cards themselves, but the centralized MBTA fare collection system. You can probably do whatever you want to a card you own (in particular: you can conduct whatever research you like involving reading the cards), but once you're interacting with the fare collection system, you're communicating with a computer system you do not own or operate, and are back in CFAA country. For that reason, I don't think the MBTA hack is a great counterexample to the parent's (well-reasoned) argument. You'll have a difficult time building a case against the CFAA based on Aurenheimer's actions, since the prosecution was able to demonstrate with his own words that he knew he wasn't authorized to take the records. In fact, his appeal against the CFAA conviction failed with a citation to his pre-arrest appeal to the media to have him explain "the method of [his] theft".