4 ms·

Yes, of course. This is an illegal hack. Edit: I should add, it would be under the CFAA. Edit #2: I could be wrong, it looks like they used Parler's APIs, and

Yes, of course. This is an illegal hack. Edit: I should add, it would be under the CFAA. Edit #2: I could be wrong, it looks like they used Parler's APIs, and didn't bypass any auth. I really shouldn't have even called this a hack, it's more just archiving. But weev went to jail for the same thing, so I'd say there's a chance of prosecution, would come down to a court case. If I was the person who did this, I would never step foot in America, just to be safe.

ceejayoz 6y ago
Is it? The article indicates at least some of this comes from merely incrementing an integer in the video URLs. > I am now crawling URLs of all videos uploaded to Parler. Sequentially from latest to oldest. VIDXXX.txt files coming up, 50k chunks, there will be 1.1M URLs total...
- dragontamer 6y ago
  I believe from a legal standpoint, all that matters is whether the user intended it to be private or not. It is a felony to open a mail envelope addressed to someone else. It doesn't matter that a butterknife can cut open the envelope, the intent is clear.
  - andromeduck 6y ago
    This is more a postcard than a letter.
    - dragontamer 6y ago
      The public posts are probably allowed to be accessed (like a postcard). The issue comes with the posts that were deleted: they arguably have an expectation of privacy. EDIT: And direct messages, if they work like Twitter, DEFINITELY have an expectation of privacy. If Parler has a DM-like system, they are probably illegal to access.
- lmkg 6y ago
  At least one person has already been prosecuted for "hacking" for incrementing integers in a URL.
  - deleted 6y ago
    [deleted]
- bgentry 6y ago
  People have been sent to prison before for nothing more than fetching publicly available web pages by incrementing numbers in a URL: https://en.wikipedia.org/wiki/Weev https://en.wikipedia.org/wiki/Weev
  - ceejayoz 6y ago
    We tend to think that's bad and an incorrect definition of cracking that should be overturned around here, right? > the conviction was vacated by a higher court > While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.
    - deleted 6y ago
      [deleted]
  - Eupolemos 6y ago
    I don't know how it works "over there", but where I'm from "URL-hacking" is not considered hacking, but data publicly available.
    - rob74 6y ago
      ...and you are 100% sure that if this got before a court, the decision would go your way?
      - Eupolemos 6y ago
        No, I am not a lawyer. I did some reasearch though, and indeed there seems to be an untried case where, if it is obvious that the owner of the data wants to keep it secret, it isn't okay. It is in danish so you'll likely need som google translate or somesuch, search for URL hacking: https://projekter.aau.dk/projekter/files/305754822/Speciale___Straffelovens___263__stk._1.pdf https://projekter.aau.dk/projekter/files/305754822/Speciale_... But as a rule, it is on par with an email sent to a wrong recipient. https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacking-ikke-hacking-1076182 https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacki...
- Miner49er 6y ago
  Weev when to jail for the exact same thing under the CFAA.
  - ceejayoz 6y ago
    Weev's conviction was vacated.
    - Miner49er 6y ago
      On a technicality because of where he was charged, not because of the law. I don't think he should have ever been convicted under the CFAA, but he was.
      - ceejayoz 6y ago
        From Wiki on his case: > While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained. It's a pity it didn't make it to full review on appeal to get a solid ruling on this.
- deleted 6y ago
  [deleted]
- rvz 6y ago
  Well if I were to do the same to any social network, I would have to request their permission first on the basis of security research according to their Terms of Service. In this case it is still an unauthorised hack.

ceejayoz 6y ago

Is it? The article indicates at least some of this comes from merely incrementing an integer in the video URLs. > I am now crawling URLs of all videos uploaded to Parler. Sequentially from latest to oldest. VIDXXX.txt files coming up, 50k chunks, there will be 1.1M URLs total...

dragontamer 6y ago
I believe from a legal standpoint, all that matters is whether the user intended it to be private or not. It is a felony to open a mail envelope addressed to someone else. It doesn't matter that a butterknife can cut open the envelope, the intent is clear.
- andromeduck 6y ago
  This is more a postcard than a letter.
  - dragontamer 6y ago
    The public posts are probably allowed to be accessed (like a postcard). The issue comes with the posts that were deleted: they arguably have an expectation of privacy. EDIT: And direct messages, if they work like Twitter, DEFINITELY have an expectation of privacy. If Parler has a DM-like system, they are probably illegal to access.
lmkg 6y ago
At least one person has already been prosecuted for "hacking" for incrementing integers in a URL.
- deleted 6y ago
  [deleted]
bgentry 6y ago
People have been sent to prison before for nothing more than fetching publicly available web pages by incrementing numbers in a URL: https://en.wikipedia.org/wiki/Weev https://en.wikipedia.org/wiki/Weev
- ceejayoz 6y ago
  We tend to think that's bad and an incorrect definition of cracking that should be overturned around here, right? > the conviction was vacated by a higher court > While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.
  - deleted 6y ago
    [deleted]
- Eupolemos 6y ago
  I don't know how it works "over there", but where I'm from "URL-hacking" is not considered hacking, but data publicly available.
  - rob74 6y ago
    ...and you are 100% sure that if this got before a court, the decision would go your way?
    - Eupolemos 6y ago
      No, I am not a lawyer. I did some reasearch though, and indeed there seems to be an untried case where, if it is obvious that the owner of the data wants to keep it secret, it isn't okay. It is in danish so you'll likely need som google translate or somesuch, search for URL hacking: https://projekter.aau.dk/projekter/files/305754822/Speciale___Straffelovens___263__stk._1.pdf https://projekter.aau.dk/projekter/files/305754822/Speciale_... But as a rule, it is on par with an email sent to a wrong recipient. https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacking-ikke-hacking-1076182 https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacki...
Miner49er 6y ago
Weev when to jail for the exact same thing under the CFAA.
- ceejayoz 6y ago
  Weev's conviction was vacated.
  - Miner49er 6y ago
    On a technicality because of where he was charged, not because of the law. I don't think he should have ever been convicted under the CFAA, but he was.
    - ceejayoz 6y ago
      From Wiki on his case: > While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained. It's a pity it didn't make it to full review on appeal to get a solid ruling on this.
deleted 6y ago
[deleted]
rvz 6y ago
Well if I were to do the same to any social network, I would have to request their permission first on the basis of security research according to their Terms of Service. In this case it is still an unauthorised hack.