4 ms·

At what point does all this surveillance capitalism tech become “unauthorized access?” Port scanning with no user consent seems borderline malicious to me. Sin

At what point does all this surveillance capitalism tech become “unauthorized access?” Port scanning with no user consent seems borderline malicious to me. Since the late 1990s I’ve seen language in ISP acceptable use policies banning port scanning hosts without consent. If this is widely considered malicious by industry norms for decades then how can this be considered ethical for a random website to do against a user’s machine?

Lammy 6y ago
No, see, you are the Client. They are the Server. You are Consuming their Content and this is a flow they only think about in one direction.
- dnautics 6y ago
  If you want an interesting challenge, embed an agreement into your client headers, and then sue the pants off of these companies.
mindslight 6y ago
Never, because unilateral contracts and a negotiation imbalance bless it as being authorized. It's similar to how artists can end up not owning the rights to their own songs. Any legal protection that is transferable ends up as a liability to the individual, as the market will strongly incentivize trading it away. The Coase theorem applies to your personal life.
- baybal2 6y ago
  Things are a bit different when they use Javascripts to scan your own machine. Apparently, the language "deliberate circumvention" makes a big difference in the context of US CFAA because of some precedent.
matheusmoreira 6y ago
The only difference is a terms of service nobody reads which "allows" them to do what they want, no matter how abusive.
- cgriswald 6y ago
  In some of the cases there’s no chance to agree with the TOS or leave before you are scanned. > For example, Citibank, Ameriprise, and TIAA-CREF immediately port scanned our computers when visiting the main page of the site.
  - elliekelly 6y ago
    Perhaps EFF could bring a private cause of action under the Computer Fraud and Abuse Act.
  - HenryBemis 6y ago
    NatWest App on Android also tries to connect to ThreatMetrix. I use NoRoot Firewall to block it (Global Filters).
  - matheusmoreira 6y ago
    Yes. Most if not all websites with typical "by continuing to use the site you agree to..." terms will drop cookies and fingerprint the user on their first visit, breaching their own contract. They do it even if lack of consent is made explicit by including Do Not Track in the HTTP headers. These terms are obviously an attempt to get away with questionable behavior. Instead of simply not doing bad things, they insist and point people to the legalese when they complain as if it excused everything.
    - MereInterest 6y ago
      Exactly. It's very easy to be compliant with privacy law if you aren't stalking your users in the first place. The best example I've seen for doing it right was from godbolt.org, whose GDPR notice is refreshingly direct. > The Compiler Explorer team believes the Compiler Explorer site is compliant with the EU's General Data Protection Regulation (GDPR). Specifically, we store no personally identifying information, we anonymise the little data that we do have and we do not permanently store any user data.
- Silhouette 6y ago
salawat 6y ago
The hairyness there is that there are legitimate reasons to port scan. Think of it like checking locks or oiling hinges on doors and windows. Totally benign in your own home; gets awkward elsewhere right? I still do it though occasionally when I arrive at a new place if the signage is bad though. Now, what about when your friend comes over, bringing the "house" of their laptop with them. It's on your network; seems like you should be in safe waters to do that port checking since it's in line with what you'd normally do, but their stuff isn't yours. Solution? "Hey, mind if I..." or, "Here's the guest network password". Where I draw the absolute line is where you start to get this implied consent nonsense where that interaction never takes place, or in a form where the entity doing it never has to make the fact they are consciously up front to the User in question, and provides no alternative if the user doesn't agree. Of course they implicitly do... Just don't use the website, which I practice. However it is becoming increasingly pervasive enough that I think we need to recognize the positive utility of integrating this sort of meta-layer concern into our basic social protocols in some way.
lostmyoldone 6y ago
It's not impossible they are breaking Swedish law, as our computer security laws essentially requires you to have an explicit right to do something with regards to someone elses computing resources to be allowed to do so. As far as I understand it, there doesn't have to be any circumvention of technical protections for the possibility of a crime to occur, but only accessing computing resources having lack of some equivalent of explicit authorization. I'm unsure of a TOS that mentioned it would hold up, I would assume no as it's not something the average consumer would a) expect b) easily understand c) might not even be in the position to accept, ie when accessing a site from a computer they don't own, they might not have the authority to allow a port scan.
- VWWHFSfQ 6y ago
  This also likely violates the Computer Fraud and Abuse Act is USA.

Lammy 6y ago

No, see, you are the Client. They are the Server. You are Consuming their Content and this is a flow they only think about in one direction.

dnautics 6y ago
If you want an interesting challenge, embed an agreement into your client headers, and then sue the pants off of these companies.

mindslight 6y ago

Never, because unilateral contracts and a negotiation imbalance bless it as being authorized. It's similar to how artists can end up not owning the rights to their own songs. Any legal protection that is transferable ends up as a liability to the individual, as the market will strongly incentivize trading it away. The Coase theorem applies to your personal life.

baybal2 6y ago
Things are a bit different when they use Javascripts to scan your own machine. Apparently, the language "deliberate circumvention" makes a big difference in the context of US CFAA because of some precedent.

matheusmoreira 6y ago

The only difference is a terms of service nobody reads which "allows" them to do what they want, no matter how abusive.

cgriswald 6y ago
In some of the cases there’s no chance to agree with the TOS or leave before you are scanned. > For example, Citibank, Ameriprise, and TIAA-CREF immediately port scanned our computers when visiting the main page of the site.
- elliekelly 6y ago
  Perhaps EFF could bring a private cause of action under the Computer Fraud and Abuse Act.
- HenryBemis 6y ago
  NatWest App on Android also tries to connect to ThreatMetrix. I use NoRoot Firewall to block it (Global Filters).
- matheusmoreira 6y ago
  Yes. Most if not all websites with typical "by continuing to use the site you agree to..." terms will drop cookies and fingerprint the user on their first visit, breaching their own contract. They do it even if lack of consent is made explicit by including Do Not Track in the HTTP headers. These terms are obviously an attempt to get away with questionable behavior. Instead of simply not doing bad things, they insist and point people to the legalese when they complain as if it excused everything.
  - MereInterest 6y ago
    Exactly. It's very easy to be compliant with privacy law if you aren't stalking your users in the first place. The best example I've seen for doing it right was from godbolt.org, whose GDPR notice is refreshingly direct. > The Compiler Explorer team believes the Compiler Explorer site is compliant with the EU's General Data Protection Regulation (GDPR). Specifically, we store no personally identifying information, we anonymise the little data that we do have and we do not permanently store any user data.
Silhouette 6y ago

salawat 6y ago

The hairyness there is that there are legitimate reasons to port scan. Think of it like checking locks or oiling hinges on doors and windows. Totally benign in your own home; gets awkward elsewhere right? I still do it though occasionally when I arrive at a new place if the signage is bad though. Now, what about when your friend comes over, bringing the "house" of their laptop with them. It's on your network; seems like you should be in safe waters to do that port checking since it's in line with what you'd normally do, but their stuff isn't yours. Solution? "Hey, mind if I..." or, "Here's the guest network password". Where I draw the absolute line is where you start to get this implied consent nonsense where that interaction never takes place, or in a form where the entity doing it never has to make the fact they are consciously up front to the User in question, and provides no alternative if the user doesn't agree. Of course they implicitly do... Just don't use the website, which I practice. However it is becoming increasingly pervasive enough that I think we need to recognize the positive utility of integrating this sort of meta-layer concern into our basic social protocols in some way.

lostmyoldone 6y ago

It's not impossible they are breaking Swedish law, as our computer security laws essentially requires you to have an explicit right to do something with regards to someone elses computing resources to be allowed to do so. As far as I understand it, there doesn't have to be any circumvention of technical protections for the possibility of a crime to occur, but only accessing computing resources having lack of some equivalent of explicit authorization. I'm unsure of a TOS that mentioned it would hold up, I would assume no as it's not something the average consumer would a) expect b) easily understand c) might not even be in the position to accept, ie when accessing a site from a computer they don't own, they might not have the authority to allow a port scan.

VWWHFSfQ 6y ago
This also likely violates the Computer Fraud and Abuse Act is USA.