4 ms·

As well it should. Comparable activity: let's ride around the neighborhood and see who hides a key under a rock. Then let ourselves in and look around.

dsfyu404ed 8y ago
Physical analogies for security like the one you just made are useless because they don't reflect how the computers and the internet work. You can't just ping a rock and ask it if it's got a key. The rock isn't expected to exist in a world where some script kiddie in China is going to ask it if is has a key every 5min. The analogy simply falls flat on its face once you try to use it to reason about anything because existing as an internet connected device is far different than existing on private (but easily accessible) property.
- cabaalis 8y ago
  If you'll refer to what I was replying to, I wasn't talking about physical security being analagous to digital security. I was saying it is illegal to attempt to open and access property that you do not own.
vorpalhex 8y ago
"Let's ride around the neighborhood and see who left all their belongings in their front yard" would be a closer example. Imagine if your Doctor left your personal medical records lying on the ground in front of their office...
nkrisc 8y ago
That's an absurd analogy. How are you supposed to know if a completely unauthenticated URL is meant to be private or not? If we're going to try to force physical analogies to represent the digital, I would say it's more like every store, house, and public building looks exactly the same and you don't know if the door is locked or what's inside it until you try to open it.
- cabaalis 8y ago
  I wholeheartedly disagree, despite the down votes in this community. The act of attempting to open it is what is illegal, in both situations. You have a person cruising for keys to a house and a person cruising for keys to databases. They own neither.
  - nkrisc 8y ago
    But if a database is unsecured, how do you know it's not meant to be publicly accessible?
    - cabaalis 8y ago
      Your point is good of course, but I think the question has already been answered in society. If you aren't explicitly allowed into someone else's property, you aren't allowed.
      - c22 8y ago
        It's not analogous because in internet protocols the server has to actively send the "property" in response to a specific request to access it. If a request is made and a response freely given with no further authentication required then it is a stretch to compare this to coming onto someone's property without invitation. Perhaps if one is accessing unauthenticated services on a private network this analogy would sort of work, but the assumption is that if you run a service that responds to random requests on the public internet you intended the responses to be public. It is more like an owner hiring someone to stand on their property and invite people in then complaining that they gave their employee poor directions and faulting the public for trespass.
      - beatgammit 8y ago
        I'm allowed to look at property from the street. There's nothing stopping me from walking around the neighborhood looking into everyone's property. I can even walk up to the house in most cases, and peering into windows is usually legal as well. I would even argue that trying the doors is also legal, though entering is probably illegal in most areas. Accessing a URL is like walking around the neighborhood looking from the street. Trying different URLs is like peering into windows. Trying the door is like testing default credentials. To make something a crime, you need to prove some kind of loss as well as intent. If there's no intent, it's likely a civil case to get restitution (e.g. you won't arrested for breaking something in a store accidentally). Likewise, you could get arrested for intent without loss (e.g. tried to break something in a store, but failed). IMO, it should only be illegal if there's intent to harm. Likewise, if you accidentally harm something without intent (e.g. accidentally DOS a server), you should be expected to make restitution. Both need to be proven in a court of law, criminal if there's intent, civil if there isn't, and if there's no harm or intent, there's no crime.

dsfyu404ed 8y ago

Physical analogies for security like the one you just made are useless because they don't reflect how the computers and the internet work. You can't just ping a rock and ask it if it's got a key. The rock isn't expected to exist in a world where some script kiddie in China is going to ask it if is has a key every 5min. The analogy simply falls flat on its face once you try to use it to reason about anything because existing as an internet connected device is far different than existing on private (but easily accessible) property.

cabaalis 8y ago
If you'll refer to what I was replying to, I wasn't talking about physical security being analagous to digital security. I was saying it is illegal to attempt to open and access property that you do not own.

vorpalhex 8y ago

"Let's ride around the neighborhood and see who left all their belongings in their front yard" would be a closer example. Imagine if your Doctor left your personal medical records lying on the ground in front of their office...

nkrisc 8y ago

That's an absurd analogy. How are you supposed to know if a completely unauthenticated URL is meant to be private or not? If we're going to try to force physical analogies to represent the digital, I would say it's more like every store, house, and public building looks exactly the same and you don't know if the door is locked or what's inside it until you try to open it.

cabaalis 8y ago
I wholeheartedly disagree, despite the down votes in this community. The act of attempting to open it is what is illegal, in both situations. You have a person cruising for keys to a house and a person cruising for keys to databases. They own neither.
- nkrisc 8y ago
  But if a database is unsecured, how do you know it's not meant to be publicly accessible?
  - cabaalis 8y ago
    Your point is good of course, but I think the question has already been answered in society. If you aren't explicitly allowed into someone else's property, you aren't allowed.
    - c22 8y ago
      It's not analogous because in internet protocols the server has to actively send the "property" in response to a specific request to access it. If a request is made and a response freely given with no further authentication required then it is a stretch to compare this to coming onto someone's property without invitation. Perhaps if one is accessing unauthenticated services on a private network this analogy would sort of work, but the assumption is that if you run a service that responds to random requests on the public internet you intended the responses to be public. It is more like an owner hiring someone to stand on their property and invite people in then complaining that they gave their employee poor directions and faulting the public for trespass.
    - beatgammit 8y ago
      I'm allowed to look at property from the street. There's nothing stopping me from walking around the neighborhood looking into everyone's property. I can even walk up to the house in most cases, and peering into windows is usually legal as well. I would even argue that trying the doors is also legal, though entering is probably illegal in most areas. Accessing a URL is like walking around the neighborhood looking from the street. Trying different URLs is like peering into windows. Trying the door is like testing default credentials. To make something a crime, you need to prove some kind of loss as well as intent. If there's no intent, it's likely a civil case to get restitution (e.g. you won't arrested for breaking something in a store accidentally). Likewise, you could get arrested for intent without loss (e.g. tried to break something in a store, but failed). IMO, it should only be illegal if there's intent to harm. Likewise, if you accidentally harm something without intent (e.g. accidentally DOS a server), you should be expected to make restitution. Both need to be proven in a court of law, criminal if there's intent, civil if there isn't, and if there's no harm or intent, there's no crime.