7 ms·

Ive always wanted to know, using CFAA logic, how does one know if someone is offering a service to be used online? Is there a standard service that announces a

Ive always wanted to know, using CFAA logic, how does one know if someone is offering a service to be used online? Is there a standard service that announces available services? If not, how do I know if I'm 'allowed' to use Google.com:80 ? Where is that fact delineated?

snowwrestler 8y ago
In the terms of service. For Google, that's: https://policies.google.com/terms https://policies.google.com/terms
- crankylinuxuser 8y ago
  That's fine you gave me a link and a path... How do I know I'm allowed to go there?
  - snowwrestler 8y ago
    How did you know that you're allowed to come here? And yet, here you are. I don't think you actually believe what you're trying to argue here.
    - lscharen 8y ago
      I think you're missing the (subtle) point that is trying to be made. I can go to google.com or HN because I type the URL into a browser and the page is displayed -- I didn't need to go through an approval process or present a security token or anything else to gain access. Now, what if I type in a URL into my browser that happens to look like company.com/users/12345/purchases and it displays a page of information. Did I "circumvent" anything in this case? Did I "exceed" my authorized access? If so, what is the fundamental difference between accessing google.com and this hypothetical URL?
      - Filligree 8y ago
        > If so, what is the fundamental difference between accessing google.com and this hypothetical URL? Your intention. It matters.
    - deleted 8y ago
      [deleted]
    - _jal 8y ago
      The point isn't what people believe about thought experiments, the point is the uncertainty in the law. Yes, it is reductio ad absurdum to question hitting port 80 on a public site. Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? Note that there are people here claiming that the last bit is 'hacking' under the law, and in some cases they are right. So now we can't change URLs without hacking, but only when doing so knowingly exceeds authorization. Well, what does that mean? Let me offer an example: Someone uses the dumb disable-right-click Javascript to stop people from downloading their images. I disable JS and save an image. Put aside copyright and focus on the CFAA: Have I broken it? If so, does this seem to be the sort of thing that should be a felony to you?
      - pvg 8y ago
        Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? That's why we have trials and juries and so on. 'Working a little harder' and trying to find trivial logical gotchas in law is a pointless thing to do and discuss because it's very much not how the legal system works. The law is not a program interpreted once by some literalist, implacable CPU.
      - CJefferson 8y ago
        How do you know you can walk into a shop and start picking things up, but not the open door to someone's house? The law has dealt with these kinds of things for hundreds of years. Intent matters.
        _jal 8y ago
        Yes, the law is great at reaching decisions. Not always good ones, but one is sure to be reached. If that is all that matters to you, you're thinking like a legal academic, not a security researcher. The point I am making is about uncertainty before you get to a formal legal setting. Or is everything else you do in business do-first, hope you don't get busted later? Legal uncertainty about edge cases is real, and a thing that dissuades people from doing thing things. Saying the law will figure it out is how we got here with the CFAA, not a solution to it.
  - rayiner 8y ago
    The test under the CFAA is the opposite: there is only liability if you know that you’re not allowed to go there.
rayiner 8y ago
> knowingly accessed a computer without authorization or exceeding authorized access The CFAA requires knowingly exceeding authorized access or doing so intentionally. If, in fact, you don’t know access is unauthorized, you’re not liable for a CFAA violation. So you can go blissfully through life doing what you, in good faith, may reasonably guess the web site owner intends you to do. You don’t need the rules “deliniated” just like for any other kind of property. However, there is what you say about what you knew, and what a jury may reasonably infer about what you knew. If you say you didn’t know accessing port 80 was unauthorized, the jury will probably buy it, because port 80 is expected to host publicly available web services. However, if you take a URL and start manually fiddling with numbers, and you see that it yields credit card information, the jury probably won’t believe you if you say you didn’t know that access was unauthorized.[1] Similarly if you access a resource, and the web site owner tells you not to do it, or bans your IP, now you know. CFAA prosecutions are almost invariably based on a scenario where it is abundantly clear that someone knew she wasn’t supposed to be doing what she was doing. [1] But, say you’re accessing a page programatically and there is a bug in your code and you access some URL that yields credit card information, which you promptly delete because you are acting in good faith. There is no CFAA violation because you had neither knowledge or intent. And to my knowledge, nobody has been convicted of violating the CFAA in such a situation.
- angersock 8y ago
  The problem comes when we've normalized the idea of exploring public endpoints as "yeah, this is probably exceeding authorized access".
  - harryh 8y ago
    The problem comes when we've normalized the idea of exploring buildings with unlicked doors as "yeah, this is probably exceeding authorized access". People on here talk all the time about how their digital possessions are just as important as their physical possessions (if not more-so). Given that it seems perfectly reasonable to have the same cultural norms about exploring digital spaces as physical ones.
pavon 8y ago
Turning the question around, if you did discover that you were able access a site, and it concerned you enough that you felt obliged to report it as a security problem, then by your own judgement you have decided you shouldn't have had access. So this creates a bad situation where responsibly reporting security holes provides evidence that you knew the access was not authorized, regardless of your intent.
deleted 8y ago
[deleted]

snowwrestler 8y ago

In the terms of service. For Google, that's: https://policies.google.com/terms https://policies.google.com/terms

crankylinuxuser 8y ago
That's fine you gave me a link and a path... How do I know I'm allowed to go there?
- snowwrestler 8y ago
  How did you know that you're allowed to come here? And yet, here you are. I don't think you actually believe what you're trying to argue here.
  - lscharen 8y ago
    I think you're missing the (subtle) point that is trying to be made. I can go to google.com or HN because I type the URL into a browser and the page is displayed -- I didn't need to go through an approval process or present a security token or anything else to gain access. Now, what if I type in a URL into my browser that happens to look like company.com/users/12345/purchases and it displays a page of information. Did I "circumvent" anything in this case? Did I "exceed" my authorized access? If so, what is the fundamental difference between accessing google.com and this hypothetical URL?
    - Filligree 8y ago
      > If so, what is the fundamental difference between accessing google.com and this hypothetical URL? Your intention. It matters.
  - deleted 8y ago
    [deleted]
  - _jal 8y ago
    The point isn't what people believe about thought experiments, the point is the uncertainty in the law. Yes, it is reductio ad absurdum to question hitting port 80 on a public site. Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? Note that there are people here claiming that the last bit is 'hacking' under the law, and in some cases they are right. So now we can't change URLs without hacking, but only when doing so knowingly exceeds authorization. Well, what does that mean? Let me offer an example: Someone uses the dumb disable-right-click Javascript to stop people from downloading their images. I disable JS and save an image. Put aside copyright and focus on the CFAA: Have I broken it? If so, does this seem to be the sort of thing that should be a felony to you?
    - pvg 8y ago
      Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? That's why we have trials and juries and so on. 'Working a little harder' and trying to find trivial logical gotchas in law is a pointless thing to do and discuss because it's very much not how the legal system works. The law is not a program interpreted once by some literalist, implacable CPU.
    - CJefferson 8y ago
      How do you know you can walk into a shop and start picking things up, but not the open door to someone's house? The law has dealt with these kinds of things for hundreds of years. Intent matters.
      - _jal 8y ago
        Yes, the law is great at reaching decisions. Not always good ones, but one is sure to be reached. If that is all that matters to you, you're thinking like a legal academic, not a security researcher. The point I am making is about uncertainty before you get to a formal legal setting. Or is everything else you do in business do-first, hope you don't get busted later? Legal uncertainty about edge cases is real, and a thing that dissuades people from doing thing things. Saying the law will figure it out is how we got here with the CFAA, not a solution to it.
- rayiner 8y ago
  The test under the CFAA is the opposite: there is only liability if you know that you’re not allowed to go there.

rayiner 8y ago

> knowingly accessed a computer without authorization or exceeding authorized access The CFAA requires knowingly exceeding authorized access or doing so intentionally. If, in fact, you don’t know access is unauthorized, you’re not liable for a CFAA violation. So you can go blissfully through life doing what you, in good faith, may reasonably guess the web site owner intends you to do. You don’t need the rules “deliniated” just like for any other kind of property. However, there is what you say about what you knew, and what a jury may reasonably infer about what you knew. If you say you didn’t know accessing port 80 was unauthorized, the jury will probably buy it, because port 80 is expected to host publicly available web services. However, if you take a URL and start manually fiddling with numbers, and you see that it yields credit card information, the jury probably won’t believe you if you say you didn’t know that access was unauthorized.[1] Similarly if you access a resource, and the web site owner tells you not to do it, or bans your IP, now you know. CFAA prosecutions are almost invariably based on a scenario where it is abundantly clear that someone knew she wasn’t supposed to be doing what she was doing. [1] But, say you’re accessing a page programatically and there is a bug in your code and you access some URL that yields credit card information, which you promptly delete because you are acting in good faith. There is no CFAA violation because you had neither knowledge or intent. And to my knowledge, nobody has been convicted of violating the CFAA in such a situation.

angersock 8y ago
The problem comes when we've normalized the idea of exploring public endpoints as "yeah, this is probably exceeding authorized access".
- harryh 8y ago
  The problem comes when we've normalized the idea of exploring buildings with unlicked doors as "yeah, this is probably exceeding authorized access". People on here talk all the time about how their digital possessions are just as important as their physical possessions (if not more-so). Given that it seems perfectly reasonable to have the same cultural norms about exploring digital spaces as physical ones.

pavon 8y ago

Turning the question around, if you did discover that you were able access a site, and it concerned you enough that you felt obliged to report it as a security problem, then by your own judgement you have decided you shouldn't have had access. So this creates a bad situation where responsibly reporting security holes provides evidence that you knew the access was not authorized, regardless of your intent.

deleted 8y ago

[deleted]