4 ms·

It does beg the question, does changing a user's password without their consent violate the CFAA?

techdevangelist 7y ago
At the very least I smell potential fraud with the trip wire limits then associated messages saying no more screen times and password resets. CFAA could potentially be applied but I think since it’s their platform and done by an authorized agent it may be a stretch. But some state AGs could read into these actions and open wider lines of investigation, and compel other evidence. If this is what they are okay talking about, think of the other dirty deeds that were kept hush hush..
- deleted 7y ago
  [deleted]
em-bee 7y ago
it's just one way to lock a user out. on my server i can set a flag that blocks login instead. (that flag is normally set until a user is verified) so the question is not: am i allowed to reset your password. but am i allowed to limit your access to my service. the problem is not what they did and why, but how they did it and how it affected the users.
- londons_explore 7y ago
  > am i allowed to limit your access to my service. And the clear answer to me is 'yes'. And the customer can try to sue for non-delivery of service if they like, but probably won't get back much more than the $10 subscription fee.
  - tinus_hn 7y ago
    The problem is not locking out users, it’s allowing yourself or someone else to impersonate them.
    - PeterisP 7y ago
      It's your system, you're free to design it as you wish. The accounts aren't "property" of users, they're instruments you use to provide some service - if you allow your employees to impersonate these accounts, then that's authorised access. You're generally liable for the consequences of that access - e.g. if Twitter would have their employees take over Trump's account and post "I'm a doo doo head" every five minutes, then that might result in some legal challenges; or if a PayPal employee made payments impersonating your account, then those payments would constitute fraud; but, in general, your employees accessing user accounts and altering data in them is not prohibited by any laws. [edit] It would be nice if the downvoters could provide some argumentation why they disagree - I can accept that users should have some rights, but according to the current laws they don't. CFAA protects the owner of the system, who gets to decide what access is authorised and what not.
    - freehunter 7y ago
      Yes, this is the important point. Changing someone's password is not just locking them out, it's allowing you to log in as them. I have control of a user database for my site. I cannot log in as my users since I don't know their password and the database is hashed. But if I log into the database and change their password, now I know what their password is. And now I can log in as them.
      - em-bee 7y ago
        depends on how it's done. i could randomize the password in such a way that i don't know what it is. better yet, since the password should be stored in hashed form, just changing that string would change the password to one that is unknown or even impossible. that's how i lock unix accounts.
PeterisP 7y ago
It depends whether they had permission from the owner of the system. An employee who tampers with passwords may violate the CFAA but if the system owner (MoviePass) authorised it it's fine and dandy, the users have no particular rights there.

At the very least I smell potential fraud with the trip wire limits then associated messages saying no more screen times and password resets. CFAA could potentially be applied but I think since it’s their platform and done by an authorized agent it may be a stretch. But some state AGs could read into these actions and open wider lines of investigation, and compel other evidence. If this is what they are okay talking about, think of the other dirty deeds that were kept hush hush..

deleted 7y ago
[deleted]

em-bee 7y ago

it's just one way to lock a user out. on my server i can set a flag that blocks login instead. (that flag is normally set until a user is verified) so the question is not: am i allowed to reset your password. but am i allowed to limit your access to my service. the problem is not what they did and why, but how they did it and how it affected the users.

londons_explore 7y ago
> am i allowed to limit your access to my service. And the clear answer to me is 'yes'. And the customer can try to sue for non-delivery of service if they like, but probably won't get back much more than the $10 subscription fee.
- tinus_hn 7y ago
  The problem is not locking out users, it’s allowing yourself or someone else to impersonate them.
  - PeterisP 7y ago
    It's your system, you're free to design it as you wish. The accounts aren't "property" of users, they're instruments you use to provide some service - if you allow your employees to impersonate these accounts, then that's authorised access. You're generally liable for the consequences of that access - e.g. if Twitter would have their employees take over Trump's account and post "I'm a doo doo head" every five minutes, then that might result in some legal challenges; or if a PayPal employee made payments impersonating your account, then those payments would constitute fraud; but, in general, your employees accessing user accounts and altering data in them is not prohibited by any laws. [edit] It would be nice if the downvoters could provide some argumentation why they disagree - I can accept that users should have some rights, but according to the current laws they don't. CFAA protects the owner of the system, who gets to decide what access is authorised and what not.
  - freehunter 7y ago
    Yes, this is the important point. Changing someone's password is not just locking them out, it's allowing you to log in as them. I have control of a user database for my site. I cannot log in as my users since I don't know their password and the database is hashed. But if I log into the database and change their password, now I know what their password is. And now I can log in as them.
    - em-bee 7y ago
      depends on how it's done. i could randomize the password in such a way that i don't know what it is. better yet, since the password should be stored in hashed form, just changing that string would change the password to one that is unknown or even impossible. that's how i lock unix accounts.

PeterisP 7y ago

It depends whether they had permission from the owner of the system. An employee who tampers with passwords may violate the CFAA but if the system owner (MoviePass) authorised it it's fine and dandy, the users have no particular rights there.