4 ms·

>Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthoriz

>Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthorized--you lied to someone. If you use a computer virus, it's unauthorized--you lied to the computer to get it to execute that code, probably misrepresenting it as some other type of data. If they set the permissions wrong or it's just an AUP thing, it's not unauthorized access. Though, as here, it might be against the law for some other reason (violation of privacy or whatever). Interesting test. What if you set your user agent to chrome instead of firefox and that grants you access to a website?

aidenn0 5y ago
That would arguably be wire-fraud (you lied over an electronic network in order to get some material gain).
Natsu 5y ago
Yeah, cases like this are a bit harder. Part of the idea is how important the lie is to gaining access. It is difficult to distinguish a relatively harmless lie like this, or claiming to have actually read the 1,000,000 page AUP, to someone impersonating another.
a1369209993 5y ago
> What if you set your user agent to chrome instead of firefox and that grants you access to a website? The website is at fault. This is no different than lying about your religion to bypass a discriminatory shop owner.
- haswell 5y ago
  But where do you draw the line re: which type of "lie" matters? A naive generalization might say that "lying" by setting a header = illegal. But clearly there is a difference between setting the Authorization header and setting the User-Agent header. But what about headers that are not so well-defined? What about custom headers? I'm not disagreeing with you, but these are the first questions that come to mind. It seems that a judge would have to carefully consider the design of the system, and whether the vector that granted access was something that was clearly negligent on the part of the site owner, or was truly an attack vector and deemed illegal. But it seems difficult to formulate a universal test for this.
  - a1369209993 5y ago
    > But clearly there is a difference between setting the Authorization header and setting the User-Agent header. No. If you falsify information indicating that you have authorization to access the site, it doesn't matter what header it's in. Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in. You are either authorized to access the site (or URL, or whatever) or you are not. What tools you use to do so are only relevant if they cause you to generate accesses (eg network requests) that you are not authorized to make. By construction, configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized.
    - haswell 5y ago
      > Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in. Ahh, but here's where things get tricky. Who decides that the information has no bearing on whether you have authorization to access the site? Imagine a situation where a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents. This is obviously a horrible design, but if the intent of the developer was to authorize access to a specific set of internal clients, identified by a unique/non-standard user-agent, how would you classify the act of changing one's browser settings to send the accepted agent? User Agent is a great example of something that has a pretty well-defined purpose (and that purpose has nothing to do with authorization), but has also been misused by naive or lazy developers to control access to sites.
      - hunter2_ 5y ago
        I think the tail end of GP's comment answers your question: > configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized. Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent. On the other hand, is it really a secret if the agent tells it to every server that the agent connects to? At some point it's not a secret if little care is taken to protect it (and the name of the header has some bearing on what care is taken, for example whether it ends up stored in clear text in access logs...).
- agency 5y ago
  I would not say “no different.” Religion is a protected class[1], web browser preference is not. The law does not treat all kinds of discrimination equivalently. [1] https://en.m.wikipedia.org/wiki/Protected_group https://en.m.wikipedia.org/wiki/Protected_group
  - yissp 5y ago
    I don't know... some people are pretty fanatical about their web browser preferences.
curryst 5y ago
The CFAA requires you to have effective security measures, or something of the sort. I'm dubious a User-Agent filter qualifies, especially so if it's only filtering for the largest browser by market share. Fwiw, from my readings of similar cases, this seems similar to how the courts read the law. Any access you can achieve without material deception is valid. There was a case on here a while back where a couple of reporters filed a FOIA request and the city accidentally put records not meant for release in the Dropbox folder. Reporters downloaded the accidentally-added files, city sued. The city ended up settling because it looked like the court was going to rule against them. The court's logic was basically that by allowing access to the information, you have de facto authorized the user to access it. It would be impossible to tell whether you can legally access any information if the counterparty can give you access and then decide you shouldn't have seen it when you do access it.

aidenn0 5y ago

That would arguably be wire-fraud (you lied over an electronic network in order to get some material gain).

Natsu 5y ago

Yeah, cases like this are a bit harder. Part of the idea is how important the lie is to gaining access. It is difficult to distinguish a relatively harmless lie like this, or claiming to have actually read the 1,000,000 page AUP, to someone impersonating another.

a1369209993 5y ago

> What if you set your user agent to chrome instead of firefox and that grants you access to a website? The website is at fault. This is no different than lying about your religion to bypass a discriminatory shop owner.

haswell 5y ago
But where do you draw the line re: which type of "lie" matters? A naive generalization might say that "lying" by setting a header = illegal. But clearly there is a difference between setting the Authorization header and setting the User-Agent header. But what about headers that are not so well-defined? What about custom headers? I'm not disagreeing with you, but these are the first questions that come to mind. It seems that a judge would have to carefully consider the design of the system, and whether the vector that granted access was something that was clearly negligent on the part of the site owner, or was truly an attack vector and deemed illegal. But it seems difficult to formulate a universal test for this.
- a1369209993 5y ago
  > But clearly there is a difference between setting the Authorization header and setting the User-Agent header. No. If you falsify information indicating that you have authorization to access the site, it doesn't matter what header it's in. Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in. You are either authorized to access the site (or URL, or whatever) or you are not. What tools you use to do so are only relevant if they cause you to generate accesses (eg network requests) that you are not authorized to make. By construction, configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized.
  - haswell 5y ago
    > Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in. Ahh, but here's where things get tricky. Who decides that the information has no bearing on whether you have authorization to access the site? Imagine a situation where a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents. This is obviously a horrible design, but if the intent of the developer was to authorize access to a specific set of internal clients, identified by a unique/non-standard user-agent, how would you classify the act of changing one's browser settings to send the accepted agent? User Agent is a great example of something that has a pretty well-defined purpose (and that purpose has nothing to do with authorization), but has also been misused by naive or lazy developers to control access to sites.
    - hunter2_ 5y ago
      I think the tail end of GP's comment answers your question: > configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized. Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent. On the other hand, is it really a secret if the agent tells it to every server that the agent connects to? At some point it's not a secret if little care is taken to protect it (and the name of the header has some bearing on what care is taken, for example whether it ends up stored in clear text in access logs...).
agency 5y ago
I would not say “no different.” Religion is a protected class[1], web browser preference is not. The law does not treat all kinds of discrimination equivalently. [1] https://en.m.wikipedia.org/wiki/Protected_group https://en.m.wikipedia.org/wiki/Protected_group
- yissp 5y ago
  I don't know... some people are pretty fanatical about their web browser preferences.

curryst 5y ago

The CFAA requires you to have effective security measures, or something of the sort. I'm dubious a User-Agent filter qualifies, especially so if it's only filtering for the largest browser by market share. Fwiw, from my readings of similar cases, this seems similar to how the courts read the law. Any access you can achieve without material deception is valid. There was a case on here a while back where a couple of reporters filed a FOIA request and the city accidentally put records not meant for release in the Dropbox folder. Reporters downloaded the accidentally-added files, city sued. The city ended up settling because it looked like the court was going to rule against them. The court's logic was basically that by allowing access to the information, you have de facto authorized the user to access it. It would be impossible to tell whether you can legally access any information if the counterparty can give you access and then decide you shouldn't have seen it when you do access it.