10 ms·

That's fine you gave me a link and a path... How do I know I'm allowed to go there?

snowwrestler 8y ago
How did you know that you're allowed to come here? And yet, here you are. I don't think you actually believe what you're trying to argue here.
- lscharen 8y ago
  I think you're missing the (subtle) point that is trying to be made. I can go to google.com or HN because I type the URL into a browser and the page is displayed -- I didn't need to go through an approval process or present a security token or anything else to gain access. Now, what if I type in a URL into my browser that happens to look like company.com/users/12345/purchases and it displays a page of information. Did I "circumvent" anything in this case? Did I "exceed" my authorized access? If so, what is the fundamental difference between accessing google.com and this hypothetical URL?
  - Filligree 8y ago
    > If so, what is the fundamental difference between accessing google.com and this hypothetical URL? Your intention. It matters.
- deleted 8y ago
  [deleted]
- _jal 8y ago
  The point isn't what people believe about thought experiments, the point is the uncertainty in the law. Yes, it is reductio ad absurdum to question hitting port 80 on a public site. Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? Note that there are people here claiming that the last bit is 'hacking' under the law, and in some cases they are right. So now we can't change URLs without hacking, but only when doing so knowingly exceeds authorization. Well, what does that mean? Let me offer an example: Someone uses the dumb disable-right-click Javascript to stop people from downloading their images. I disable JS and save an image. Put aside copyright and focus on the CFAA: Have I broken it? If so, does this seem to be the sort of thing that should be a felony to you?
  - pvg 8y ago
    Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? That's why we have trials and juries and so on. 'Working a little harder' and trying to find trivial logical gotchas in law is a pointless thing to do and discuss because it's very much not how the legal system works. The law is not a program interpreted once by some literalist, implacable CPU.
  - CJefferson 8y ago
    How do you know you can walk into a shop and start picking things up, but not the open door to someone's house? The law has dealt with these kinds of things for hundreds of years. Intent matters.
    - _jal 8y ago
      Yes, the law is great at reaching decisions. Not always good ones, but one is sure to be reached. If that is all that matters to you, you're thinking like a legal academic, not a security researcher. The point I am making is about uncertainty before you get to a formal legal setting. Or is everything else you do in business do-first, hope you don't get busted later? Legal uncertainty about edge cases is real, and a thing that dissuades people from doing thing things. Saying the law will figure it out is how we got here with the CFAA, not a solution to it.
rayiner 8y ago
The test under the CFAA is the opposite: there is only liability if you know that you’re not allowed to go there.

How did you know that you're allowed to come here? And yet, here you are. I don't think you actually believe what you're trying to argue here.

lscharen 8y ago
I think you're missing the (subtle) point that is trying to be made. I can go to google.com or HN because I type the URL into a browser and the page is displayed -- I didn't need to go through an approval process or present a security token or anything else to gain access. Now, what if I type in a URL into my browser that happens to look like company.com/users/12345/purchases and it displays a page of information. Did I "circumvent" anything in this case? Did I "exceed" my authorized access? If so, what is the fundamental difference between accessing google.com and this hypothetical URL?
- Filligree 8y ago
  > If so, what is the fundamental difference between accessing google.com and this hypothetical URL? Your intention. It matters.
deleted 8y ago
[deleted]
_jal 8y ago
The point isn't what people believe about thought experiments, the point is the uncertainty in the law. Yes, it is reductio ad absurdum to question hitting port 80 on a public site. Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? Note that there are people here claiming that the last bit is 'hacking' under the law, and in some cases they are right. So now we can't change URLs without hacking, but only when doing so knowingly exceeds authorization. Well, what does that mean? Let me offer an example: Someone uses the dumb disable-right-click Javascript to stop people from downloading their images. I disable JS and save an image. Put aside copyright and focus on the CFAA: Have I broken it? If so, does this seem to be the sort of thing that should be a felony to you?
- pvg 8y ago
  Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL? That's why we have trials and juries and so on. 'Working a little harder' and trying to find trivial logical gotchas in law is a pointless thing to do and discuss because it's very much not how the legal system works. The law is not a program interpreted once by some literalist, implacable CPU.
- CJefferson 8y ago
  How do you know you can walk into a shop and start picking things up, but not the open door to someone's house? The law has dealt with these kinds of things for hundreds of years. Intent matters.
  - _jal 8y ago
    Yes, the law is great at reaching decisions. Not always good ones, but one is sure to be reached. If that is all that matters to you, you're thinking like a legal academic, not a security researcher. The point I am making is about uncertainty before you get to a formal legal setting. Or is everything else you do in business do-first, hope you don't get busted later? Legal uncertainty about edge cases is real, and a thing that dissuades people from doing thing things. Saying the law will figure it out is how we got here with the CFAA, not a solution to it.

rayiner 8y ago

The test under the CFAA is the opposite: there is only liability if you know that you’re not allowed to go there.