3 ms·

> accessing someone else's voice mail is no less a crime if they don't have a PIN set. So by extension, you're saying if I setup a directory on my website call

> accessing someone else's voice mail is no less a crime if they don't have a PIN set. So by extension, you're saying if I setup a directory on my website called /admin and don't password protect it, then you could be committing a criminal offense if you decide to access it? Personally I think there is a difference. If there is NO security, then it could be argued that it was intended to be public. If there is security, but it is bypassed, then obviously that is a violation. So I'm with you that the difficulty of hacking isn't related to the severity. But in the particular case of having no PIN, no password protection, there is no hacking taking place. So it's a moot point IMHO.

glenjamin 15y ago
IANAL, but in the UK, according to the computer misuse act - yes that would be a criminal offence as the access is unauthorized, regardless of how access was gained. (guessing URL, phising, guessing password etc) http://en.wikipedia.org/wiki/Computer_Misuse_Act_1990#The_Computer_Misuse_Act http://en.wikipedia.org/wiki/Computer_Misuse_Act_1990#The_Co...
DrJokepu 15y ago
Yes, if someone goes to /admin on your site and starts to mess around even if it's not password protected, that's a naughty thing and should be (and will be) punished even if you should have known better and ensured that it's well protected. Just like stealing a car is a crime even if the owner left the key inside the car. Or burglarizing someone's home even if occupier has accidentally left the front door unlocked. Don't you agree?
- jrockway 15y ago
  What if someone stores their wallet in a public trashcan?
  - tptacek 15y ago
    Then, like you, that person is trolling.
    - jrockway 15y ago
      I'm not trolling, I was merely adding another analogy to the OP's selective list of things-that-are-like-browsing-directories-on-a-website. Like my profile says: "I'm not trolling; I actually think that."
  - willyt 15y ago
    If you find someones wallet in the street. Take the cash then give it back. If it can be proven you took the money, you can be charged with theft. The famous saying 'possession is 9/10ths of the law' relates to proving who's possession something is, not what your rights are once you have it.
  - DrJokepu 15y ago
    The laws regarding found property greatly vary between countries. In some places, if you find something and you it's not possible to determine who the owner is, the founder can keep the found property. In other places, if you cannot determine the ownership of a found property, you have to hand it over to the police, otherwise you could be charged with theft. It's a complicated matter. However, generally, if you find, say for instance, a wallet in a public thrash can and you can determine the identity of the owner (because, for example, there is a driving license in it), you cannot keep it.
- jbooth 15y ago
  At some point the analogy breaks down.. what if I typo "admin" trying to get to another page? Or, more realistically, what about spiders? What if it's linked and a human clicks the link?
  - tptacek 15y ago
    You cannot be charged for most crimes if you lack any criminal intent.
    - jbooth 15y ago
      Ok, sure, I'm just saying that the analogy breaks down. Now the debate is over intent, whereas it's nearly impossible to accidentally break and enter.
      - tptacek 15y ago
        I don't think the analogy breaks down. I think most of the people arguing here need to go re-read Wikipedia on mens rea vs. actus rea. Most of the counter-analogies seem to boil down to things like, "but then Google could one day decide nobody's authorized to visit WWW.GOOGLE.COM and half the US would become felons!"
        jbooth 15y ago
        I think we're talking at different points, I was saying that we don't have like literal robots walking the streets who might accidentally wander into your house, and you can't misclick your way into sticking up a liquor store. Certainly if you have a whole set of willful misconduct associated with the act, like in this case, then it's illegal/wrong even if the page was wide open and prominently linked. I guess I was just saying that you couldn't just hold someone culpable for a hit in the access log like you could for being in the wrong kitchen. The bar to prove bad intent is higher.
        tptacek 15y ago
jasonlotito 15y ago
No, it doesn't work like that. Leaving your door unlocked doesn't mean your home is suddenly open to the public who can wander in. Leaving your computer without a password doesn't mean it's legal for someone to hack into it and use it for what they will. It also doesn't mean if you forget to password protect your FTP server that anyone and everyone are free to use it as they will. There is a reasonable expectation of privacy in these cases. The actual severity might be different depending on the circumstances, but it's still fairly obvious if what you are doing is wrong or not. Obviously, their are grey areas. Does a husband have the right to access his wife's voice mail? What about her computer? What if they share a computer or accounts? A good example I've always heard concerns banking on public computers. If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to then transfer money to their account and keep it? No hacking was involved. No security was breached.
- khafra 15y ago
  > If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to then transfer money to their account and keep it? No hacking was involved. No security was breached. That's not hacking, but it is theft. How about this: If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to glance at the screen, see your account balances, and log you out?
  - tptacek 15y ago
    It depends. If it can be established that you accessed someone else's bank balance purposefully or knowingly, understanding it was meant to be private, you can be on the hook for a crime. A classic nerd mistake here is to look only at the computer-related act in isolation; a real prosecution looks at the totality of circumstances. What did you do with the information? What prompted you to access it?
    - shasta 15y ago
      I think it's a stretch to call reading something "access". If someone leaves their private banking documents face up on a table, I'd expect it to be legal to read them.
tptacek 15y ago
Yes. If you browse to /admin and find it non-password-protected, and then deliberately use it to manipulate an application or gain access to information you reasonably know you shouldn't have access to, nobody making a prosecution decision is going to care about your nerdy protestation that there was no password. You will be afforded the opportunity to argue that /admin was "intended to be public" in court. Depending on what you do with /admin, a judge or jury may even listen to you.

glenjamin 15y ago

IANAL, but in the UK, according to the computer misuse act - yes that would be a criminal offence as the access is unauthorized, regardless of how access was gained. (guessing URL, phising, guessing password etc) http://en.wikipedia.org/wiki/Computer_Misuse_Act_1990#The_Computer_Misuse_Act http://en.wikipedia.org/wiki/Computer_Misuse_Act_1990#The_Co...

DrJokepu 15y ago

Yes, if someone goes to /admin on your site and starts to mess around even if it's not password protected, that's a naughty thing and should be (and will be) punished even if you should have known better and ensured that it's well protected. Just like stealing a car is a crime even if the owner left the key inside the car. Or burglarizing someone's home even if occupier has accidentally left the front door unlocked. Don't you agree?

jrockway 15y ago
What if someone stores their wallet in a public trashcan?
- tptacek 15y ago
  Then, like you, that person is trolling.
  - jrockway 15y ago
    I'm not trolling, I was merely adding another analogy to the OP's selective list of things-that-are-like-browsing-directories-on-a-website. Like my profile says: "I'm not trolling; I actually think that."
- willyt 15y ago
  If you find someones wallet in the street. Take the cash then give it back. If it can be proven you took the money, you can be charged with theft. The famous saying 'possession is 9/10ths of the law' relates to proving who's possession something is, not what your rights are once you have it.
- DrJokepu 15y ago
  The laws regarding found property greatly vary between countries. In some places, if you find something and you it's not possible to determine who the owner is, the founder can keep the found property. In other places, if you cannot determine the ownership of a found property, you have to hand it over to the police, otherwise you could be charged with theft. It's a complicated matter. However, generally, if you find, say for instance, a wallet in a public thrash can and you can determine the identity of the owner (because, for example, there is a driving license in it), you cannot keep it.
jbooth 15y ago
At some point the analogy breaks down.. what if I typo "admin" trying to get to another page? Or, more realistically, what about spiders? What if it's linked and a human clicks the link?
- tptacek 15y ago
  You cannot be charged for most crimes if you lack any criminal intent.
  - jbooth 15y ago
    Ok, sure, I'm just saying that the analogy breaks down. Now the debate is over intent, whereas it's nearly impossible to accidentally break and enter.
    - tptacek 15y ago
      I don't think the analogy breaks down. I think most of the people arguing here need to go re-read Wikipedia on mens rea vs. actus rea. Most of the counter-analogies seem to boil down to things like, "but then Google could one day decide nobody's authorized to visit WWW.GOOGLE.COM and half the US would become felons!"
      - jbooth 15y ago
        I think we're talking at different points, I was saying that we don't have like literal robots walking the streets who might accidentally wander into your house, and you can't misclick your way into sticking up a liquor store. Certainly if you have a whole set of willful misconduct associated with the act, like in this case, then it's illegal/wrong even if the page was wide open and prominently linked. I guess I was just saying that you couldn't just hold someone culpable for a hit in the access log like you could for being in the wrong kitchen. The bar to prove bad intent is higher.
        tptacek 15y ago

jasonlotito 15y ago

No, it doesn't work like that. Leaving your door unlocked doesn't mean your home is suddenly open to the public who can wander in. Leaving your computer without a password doesn't mean it's legal for someone to hack into it and use it for what they will. It also doesn't mean if you forget to password protect your FTP server that anyone and everyone are free to use it as they will. There is a reasonable expectation of privacy in these cases. The actual severity might be different depending on the circumstances, but it's still fairly obvious if what you are doing is wrong or not. Obviously, their are grey areas. Does a husband have the right to access his wife's voice mail? What about her computer? What if they share a computer or accounts? A good example I've always heard concerns banking on public computers. If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to then transfer money to their account and keep it? No hacking was involved. No security was breached.

khafra 15y ago
> If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to then transfer money to their account and keep it? No hacking was involved. No security was breached. That's not hacking, but it is theft. How about this: If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to glance at the screen, see your account balances, and log you out?
- tptacek 15y ago
  It depends. If it can be established that you accessed someone else's bank balance purposefully or knowingly, understanding it was meant to be private, you can be on the hook for a crime. A classic nerd mistake here is to look only at the computer-related act in isolation; a real prosecution looks at the totality of circumstances. What did you do with the information? What prompted you to access it?
  - shasta 15y ago
    I think it's a stretch to call reading something "access". If someone leaves their private banking documents face up on a table, I'd expect it to be legal to read them.

tptacek 15y ago

Yes. If you browse to /admin and find it non-password-protected, and then deliberately use it to manipulate an application or gain access to information you reasonably know you shouldn't have access to, nobody making a prosecution decision is going to care about your nerdy protestation that there was no password. You will be afforded the opportunity to argue that /admin was "intended to be public" in court. Depending on what you do with /admin, a judge or jury may even listen to you.