7 ms·

How does this not apply to stuff like trackers bypassing anti-fingerprinting browser protections?

by bobcostas55 7y ago

pmorici 7y ago
Because a prosecutor hasn't tried to use it in that way.
- mindslight 7y ago
  Which highlights a fundamental truth to law - it's only enforced to backstop the status quo. Routing around a wifi paywall rocks the boat, performing invasive surveillance on website visitors doesn't. So practically yes, let's be aware that the author could indeed be persecuted under the CFAA. But let's not grandstand and pretend that following that law is some sort of moral imperative that benefits everyone. The common individual will be the target of the same attacks with or without that law.
  - tidepod12 7y ago
    Following the law may not be a moral imperative, but let's not pretend like the author did anything moral here. He knowingly and with intent stole services from the airline. It not only was illegal, it's blatantly immoral.
    - SomeOldThrow 7y ago
      It’s also immoral to force bad pricing down customer throats. And yet that is the definition of the inflight wifi business. EDIT: I’m fairly sure at current prices a single flight could pay for a month’s service for a single plane, probably several times over. The profit margins (& I imagine some the cut to the airline) must be enormous, & there is no pretense of fair terms at sale time because a single corporation can entirely monopolize your attention.
      - nordsieck 7y ago
        > It’s also immoral to force bad pricing down customer throats. And yet that is the definition of the inflight wifi business. In what bizarro world are people being forced to buy inflight wifi?
        deleted 7y ago
        [deleted]
      - asdfasgasdgasdg 7y ago
        The profit margin for luxury addons is always insane. That doesn't make them unethical. In fact, there's a very good argument to be made that luxury pricing is positively ethical, as it allows the base experience to be offered for a lower price to more price-sensitive customers.
        SomeOldThrow 7y ago
        > In fact, there's a very good argument to be made that luxury pricing is positively ethical, as it allows the base experience to be offered for a lower price to more price-sensitive customers. How come that isn't happening here? Anyway, it's a commodity. The positioning of it as a luxury service amounts to theft.
    - mindslight 7y ago
      The thing about morals is that we can disagree. Just because this scenario fits your definition of "stole" does not mean it fits mine. My perspective is that a fundamental aspect of the Internet and the digital world is that the software-codified rules are basically authoritative. While constructive behavior still does matter - eg knowingly turning off a hospital ventilator is still murder - the only gain here was temporarily obtaining some transit. The real remedy is for the provider to fix their systems.
      - nordsieck 7y ago
        > My perspective is that a fundamental aspect of the Internet and the digital world is that the software-codified rules are basically authoritative. Do you think that hacking per se is ever immoral?
        mindslight 7y ago
        I suspect you're still associating hacking with other actions that can be facilitated by hacking. But the very next thing I wrote was "knowingly turning off a hospital ventilator is still murder", so it only makes sense to answer as if you strongly intend the "per se". In isolation, why would finding a hole in someone else's ruleset be immoral? If hacking per se were immoral, then there could be no such thing as a "white hat".
        nordsieck 7y ago
        > I suspect you're still associating hacking with other actions that can be facilitated by hacking. I specifically wrote "per se", so no - I'm not. > If hacking per se were immoral, then there could be no such thing as a "white hat". White hat hacking it typically specifically authorized (e.g. red teams). That is not the case with the example from the article. In the locksport community there is a pretty strong norm to only pick locks you own or have specific authorization to pick. Computer security not the same thing, but it's also not that different.
        7y ago
novok 7y ago
You could say the same about adblock then, so lets not open that can of worms
- eslaught 7y ago
  Is it though? The adblocker runs locally on your own computer; it certainly prevents the ads from doing what the designer intended, but it doesn't make the designer's computer (or any computer controlled by the ad network) do anything. Versus tracking does actually do something on your computer (e.g. running JS to discover fonts). Arguably that is a circumvention of the intentions of the user on their own hardware.
  - novok 7y ago
    You're accessing the other sites computer in a way they did not intend, which is with adblock.
    - hdfbdtbcdg 7y ago
      If they track me they are accessing my computer in a way I did not intend. I even provided them with a DNT header to make my wishes clear.
  - MereInterest 7y ago
    The problem is that the phrase "exceeds authorized access" does not distinguish between the access increasing beyond the authorization and the authorization decreasing below the current access. Suppose I put in my Terms of Service the phrase "Access to this system is contingent on running the delivered webpage, including all first-party and third-party Javascript, without modification." Now, whether or not the HTTP request to the server is authorized depends on what you do with the payload. This is why the CFAA is such a horribly written law. It takes the ToS, something that should be squarely under civil law, and elevates them to being a felony under federal law.
    - pmontra 7y ago
somethingnot 7y ago
His attack is active, privacy plugins are passive, even if they report back false fingerprints. Offense versus defense.
- Nextgrid 7y ago
  Not sure if the attack is active. He’s not actively talking to the filtering equipment to try and mess up its configuration or disable it. He’s just sending out packets hoping to reach the internet (a perfectly valid thing to do considering the system is designed to let you access the internet). It just so happens that certain packets manage to slip through the poorly designed filter.
  - somethingnot 7y ago
    How is this different from trying a door handle to see if it's open.
    - Nextgrid 7y ago
      In this case the “door handle” is marked with “pull to access the internet”, and he is pulling on it. The handle is supposed to have a mechanism to demand payment before opening but in this case it failed and opened right away. Not saying this is ethical (although selling WiFi for 12$ per hour isn’t either) but I wouldn’t go as far as calling this an attack.
      - kortilla 7y ago
        >although selling WiFi for 12$ per hour isn’t either Care to elaborate on this? WiFi on a plane isn’t any kind of thing people are dependent on to survive and satellites are pretty expensive. Airplane WiFi is entirely a luxury good. Do you feel that charging $12 to watch a movie in a theatre is unethical as well? How about $150k for a Porsche?
        vengefulduck 7y ago

How does this not apply to stuff like trackers bypassing anti-fingerprinting browser protections?

pmorici 7y ago

Because a prosecutor hasn't tried to use it in that way.

mindslight 7y ago
Which highlights a fundamental truth to law - it's only enforced to backstop the status quo. Routing around a wifi paywall rocks the boat, performing invasive surveillance on website visitors doesn't. So practically yes, let's be aware that the author could indeed be persecuted under the CFAA. But let's not grandstand and pretend that following that law is some sort of moral imperative that benefits everyone. The common individual will be the target of the same attacks with or without that law.
- tidepod12 7y ago
  Following the law may not be a moral imperative, but let's not pretend like the author did anything moral here. He knowingly and with intent stole services from the airline. It not only was illegal, it's blatantly immoral.
  - SomeOldThrow 7y ago
    It’s also immoral to force bad pricing down customer throats. And yet that is the definition of the inflight wifi business. EDIT: I’m fairly sure at current prices a single flight could pay for a month’s service for a single plane, probably several times over. The profit margins (& I imagine some the cut to the airline) must be enormous, & there is no pretense of fair terms at sale time because a single corporation can entirely monopolize your attention.
    - nordsieck 7y ago
      > It’s also immoral to force bad pricing down customer throats. And yet that is the definition of the inflight wifi business. In what bizarro world are people being forced to buy inflight wifi?
      - deleted 7y ago
        [deleted]
    - asdfasgasdgasdg 7y ago
      The profit margin for luxury addons is always insane. That doesn't make them unethical. In fact, there's a very good argument to be made that luxury pricing is positively ethical, as it allows the base experience to be offered for a lower price to more price-sensitive customers.
      - SomeOldThrow 7y ago
        > In fact, there's a very good argument to be made that luxury pricing is positively ethical, as it allows the base experience to be offered for a lower price to more price-sensitive customers. How come that isn't happening here? Anyway, it's a commodity. The positioning of it as a luxury service amounts to theft.
  - mindslight 7y ago
    The thing about morals is that we can disagree. Just because this scenario fits your definition of "stole" does not mean it fits mine. My perspective is that a fundamental aspect of the Internet and the digital world is that the software-codified rules are basically authoritative. While constructive behavior still does matter - eg knowingly turning off a hospital ventilator is still murder - the only gain here was temporarily obtaining some transit. The real remedy is for the provider to fix their systems.
    - nordsieck 7y ago
      > My perspective is that a fundamental aspect of the Internet and the digital world is that the software-codified rules are basically authoritative. Do you think that hacking per se is ever immoral?
      - mindslight 7y ago
        I suspect you're still associating hacking with other actions that can be facilitated by hacking. But the very next thing I wrote was "knowingly turning off a hospital ventilator is still murder", so it only makes sense to answer as if you strongly intend the "per se". In isolation, why would finding a hole in someone else's ruleset be immoral? If hacking per se were immoral, then there could be no such thing as a "white hat".
        nordsieck 7y ago
        > I suspect you're still associating hacking with other actions that can be facilitated by hacking. I specifically wrote "per se", so no - I'm not. > If hacking per se were immoral, then there could be no such thing as a "white hat". White hat hacking it typically specifically authorized (e.g. red teams). That is not the case with the example from the article. In the locksport community there is a pretty strong norm to only pick locks you own or have specific authorization to pick. Computer security not the same thing, but it's also not that different.
        7y ago

novok 7y ago

You could say the same about adblock then, so lets not open that can of worms

eslaught 7y ago
Is it though? The adblocker runs locally on your own computer; it certainly prevents the ads from doing what the designer intended, but it doesn't make the designer's computer (or any computer controlled by the ad network) do anything. Versus tracking does actually do something on your computer (e.g. running JS to discover fonts). Arguably that is a circumvention of the intentions of the user on their own hardware.
- novok 7y ago
  You're accessing the other sites computer in a way they did not intend, which is with adblock.
  - hdfbdtbcdg 7y ago
    If they track me they are accessing my computer in a way I did not intend. I even provided them with a DNT header to make my wishes clear.
- MereInterest 7y ago
  The problem is that the phrase "exceeds authorized access" does not distinguish between the access increasing beyond the authorization and the authorization decreasing below the current access. Suppose I put in my Terms of Service the phrase "Access to this system is contingent on running the delivered webpage, including all first-party and third-party Javascript, without modification." Now, whether or not the HTTP request to the server is authorized depends on what you do with the payload. This is why the CFAA is such a horribly written law. It takes the ToS, something that should be squarely under civil law, and elevates them to being a felony under federal law.
  - pmontra 7y ago

somethingnot 7y ago

His attack is active, privacy plugins are passive, even if they report back false fingerprints. Offense versus defense.

Nextgrid 7y ago
Not sure if the attack is active. He’s not actively talking to the filtering equipment to try and mess up its configuration or disable it. He’s just sending out packets hoping to reach the internet (a perfectly valid thing to do considering the system is designed to let you access the internet). It just so happens that certain packets manage to slip through the poorly designed filter.
- somethingnot 7y ago
  How is this different from trying a door handle to see if it's open.
  - Nextgrid 7y ago
    In this case the “door handle” is marked with “pull to access the internet”, and he is pulling on it. The handle is supposed to have a mechanism to demand payment before opening but in this case it failed and opened right away. Not saying this is ethical (although selling WiFi for 12$ per hour isn’t either) but I wouldn’t go as far as calling this an attack.
    - kortilla 7y ago
      >although selling WiFi for 12$ per hour isn’t either Care to elaborate on this? WiFi on a plane isn’t any kind of thing people are dependent on to survive and satellites are pretty expensive. Airplane WiFi is entirely a luxury good. Do you feel that charging $12 to watch a movie in a theatre is unethical as well? How about $150k for a Porsche?
      - vengefulduck 7y ago