14 ms·

I don't know, that sounds like a pretty valid response given that you "shopped a few other companies to see how our plans compared".

• klyrs 5y ago
  If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?
  • kamkazemoose 5y ago
    Say you are invited to your friends apartment in an apartment building, but none of the apartments have locks. So you decide to open up some other random apartments and look through their things, who is responsible?
    • the_arun 5y ago
      I think in this example both are equally responsible: 1. People who kept their doors unlocked 2. Person who randomly entered doors & found things. We need to take care of security of our properties, though stealing is wrong.
      • klyrs 5y ago
        Nope, opening an unlocked door is still considered break&enter. AFAIK, the "unlocked door" can even be a beaded curtain. Turns out that the legal definition of "break" in this context is extremely old and doesn't correspond to lay usage anymore. But I think that a better analogy would be asking the apartment manager to see your payment history and getting handed the entire apartment building's ledger.
    • frumper 5y ago
      the web isn't a collection of personal apartments
    • blisse 5y ago
      A closer analogy might be if none of the apartments had doors, would you be allowed to step inside.
    • Miner49er 5y ago
      That's not even close to the same analogy though. This would be like knocking on the door, asking if you can come in, and the person living there letting you in. Then getting mad about it later even though they let you in.
      • ModernMech 5y ago
        I think that's a valid response if the person letting you in wasn't expecting you and didn't want you there. Like, what are you doing knocking on random doors and going into random places just to look around? That's not honest behavior. Honest behavior is that if you know you're not supposed to have access to a thing, you shouldn't obtain access to the thing even if you technically can. I think it's pretty clear that you shouldn't have access to another company's healthcare plans. The first one is a mistake, maybe. The subsequent browsing and comparison shopping of restricted materials is definitely not okay though, and the harsh, suspicious response was warranted.
        • jaywalk 5y ago
          >if the person letting you in wasn't expecting you and didn't want you there. Then they shouldn't have let you in. How are you completely absolving them of responsibility when all they had to do was say "Who the hell are you? No, you can't come in."
          • ModernMech 5y ago
            Well, to go with the analogy more: I leave my door unlocked because I'm expecting someone. There's a knock at my door and I yell "Come in" without looking at who is at the door. Not an unreasonable thing, happens all the time. When I finally look, I find you in my house, going through all of my things, for no reason other than you wanted to gain insight on my financial situation. Do I bear responsibility for letting you in? Yes. Should you be there? No. Should you have knocked on the door? No. Should you have tried the same at my neighbor's house and every house on my block? No. In this metaphor and in the original context, everyone is acting with honest intent except the actor knowingly trying to access obviously confidential documents.
    • dzhiurgis 5y ago
      More like - you go to supermarket bathroom, checking each stall and find one person is pooping without doors locked
    • pwillia7 5y ago
      I was thinking of a similar analogy but I don't think it holds. The right analogy would be if I was in the apartment complex and I said to a door not mine "I'm home open up!" If the door opened and I did it intentionally, am I liable? I still feel like yes but since you have to request the document and receive it I think it's different than just checking locks.
      • Keyframe 5y ago
        I think we're all gronw-ups here and don't need analogies here.
        • fshbbdssbbgdd 5y ago
          People of all ages suffer from confirmation bias. Analogies can be useful because they allow someone to appreciate the logic of an argument while temporarily dissociating from strongly-held opinions. After the framing moves back to the question under debate, the logic might stick. At least all parties might understand everyone’s perspective better after a few analogies are exchanged.
          • sodality2 5y ago
            Not if everyone constantly shifts the analogy so their argument still works ;)
            • bee_rider 5y ago
              Indeed -- it is like if arguments were things to transport, and analogies were cars... wait, no, they are railroad cars. So the argument is a heist occurring on a train, so we've got the thing that we're trying to heist (which would be our point) and then we're shifting it from one car to another. And some of the analogies here are clearly like passenger coaches, but others are more like those... coal transporting car, whatever they are called... and at some point we move to the inappropriate railroad car and drop the point in the coal which obscures it. Anyway, the point is that at some point you really just hope that some conventional train robbers will show up and derail the whole thing because it has gotten too convoluted to follow.
    • jerf 5y ago
      Analogies are never helpful for things like this. We don't need to reach for analogies to observe that while the theoretical ideal is to report it after just one false access, that no significant damage was done by accessing just a few more via human manipulation of the browser URL, with no recording or sharing of the results. From a human perspective, no damage was done. Whether that legally crosses a line involves a whole lot of details that few, if any people here, will be able to speak to, because of the complication of the law, and HN's conclusion as to the legality is of marginal interest even if someone competent were to give an opinion. We can speak to the fact that even if it does technically cross a line, a prosecutor really ought to use their discretion to not prosecute since nobody was hurt. We can say that because that's just an opinion. I expect we don't have very many people here who actually want the book thrown here (though, as always, enough read this that it's probably non-zero).
      • kelnos 5y ago
        I don't think quantifiable significant damage should be the bar we use, though that should act to moderate the consequences. OP admitted to continue changing URLs in order to check out what plans other companies were getting and what they cost. That means OP downloaded lists of employee names, ages, SSNs, and other data. If I were an employee at one of these other companies, I'd be pissed at OP for that. I'd be even more pissed at the people who built the marketplace website for making the rookie security mistake that allowed it, but it's absolutely not ok to download other people's information when you shouldn't have access to it, and use that to your own advantage. Sure, I don't think this is something that should be prosecuted as a CFAA violation with big fines and jail time. That's not a proportionate response. But I also don't think we should signal that it's ok to look at (and use!) other people's data just because someone else forgot to lock it up properly. I think, for example, something on the level of a parking ticket would be appropriate here. If OP had changed the URL once, found the vulnerability, and then immediately closed the page and reported the problem, I would see nothing bad in what they did. But they didn't merely do that, and IMO crossed the line in their subsequent actions.
      • mcguire 5y ago
        There's no evidence from the original comment that anyone invoked any legal lines. Instead, they seem to be upset that the person they reported the incident to asked them questions about exactly what they did rather than being effusively grateful.
  • kelnos 5y ago
    Accessing data that you are not authorized to view is still wrong. The fact that someone has misconfigured the access controls doesn't change that. I might forget to lock my front door one day, but that doesn't make it ok for you to wander into my house and look at all my stuff.
    • jjk166 5y ago
      Well in this case I'm knocking on your door and you're opening the door saying "Come right on in!" Requesting access (ie knocking on a door/typing a url) is not illegal. If you grant that request (ie invite me in/serving a webpage), I am under no obligation to psychically infer that you didn't mean to and refuse your invitation.
      • epicide 5y ago
        Unfortunately, it's never that simple. So much of it is about intent. If I could simply use the excuse "well, the computer gave me the information", then there would be no such thing as hacking. It's always a case of the computer sending the information to you.
        • jjk166 5y ago
          It's not about intent, it's about authority. If I have the authority to access something, it's legal for me to access it, regardless of my intent. I may be breaking other laws depending on what my intent is, but it's not hacking. Compare to a restaurant: simply walking into a restaurant is not illegal, but an owner can restrict access and ban someone from their restaurant. It takes no technical skill to break into the restaurant, the door is wide open, but without authority it is trespassing. However, it is on the owner of the restaurant to actually ban someone. For a public space, be it a restaurant or a webpage, by default you are permitted access. Attempting to enter a restaurant you've never been to before is not breaking and entering, nor is accessing a URL hacking. If a website has some user agreement saying you will not access certain portions, or even if there is just a notice on a website saying this site is not public, then they have done all they need to do to revoke someone's authority, even though they would be incredibly easy to "hack." But as laid out under Van Buren v US, you don't lose authority to access things simply because you possess some intent undesirable to the owner. If you invite me into your home and I sleep with your wife, I haven't trespassed; if you tell me to get out and I don't leave then I have. Further, there's a distinction between accessing something by normal, legal means and accessing something by other methods. For example if you invite me into your home only after I give you a false identity, I'm trespassing because I was never legitimately given authority to enter. Likewise if you hack a system with say a stolen password, you don't have authority to access the system no matter how easy it was. But if you grant authority to someone without them having to do anything nefarious, then they have authority regardless of whether you should have done it or not. If you have something sensitive, don't put it in a place (in the real world or online) where authority to access is granted automatically and without oversight.
  • bawolff 5y ago
    In real life, if you do it under false pretenses, you are. In this analogy the real-world version would be considered fraud.
    • dragonwriter 5y ago
      > In real life, if you do it under false pretenses, you are. Sure, but how is that relevant? What material false representation was made which was relied on in deciding to provide the data?
      • Spivak 5y ago
        Because servers don't decide anything. They're autonomous systems imperfectly carrying out the will of humans who make the actual authorization decisions. If a computer system erroneously prints an extra 0 on a check mailed out to you that doesn't mean you get to keep the money because the computer isn't the entity that decides how much money you're owed.
        • dragonwriter 5y ago
          > Because servers don't decide anything. If there was no decision, much less one based on materially false information, there can be no charge related to false pretenses. Your argument against decisionmaking is an argument against your claim of false pretenses. > If a computer system erroneously prints an extra 0 on a check mailed out to you that doesn't mean you get to keep the money because the computer isn't the entity that decides how much money you're owed. That's neither entirely true nor at all relevant to your false pretenses claim.
    • Dylan16807 5y ago
      Asking for the next file isn't false pretenses. I don't know if this analogy works quite right. Even rifling through a file cabinet wouldn't be false pretenses, it would be something else. And you have to cause injury for it to be fraud. Is "Help I was too honest to a customer." a valid injury claim?
  • Muromec 5y ago
    It's not the point. Of course they built stupidly insecure system, and of course sending people to jail for finding out such holes is wrong, but on the other hand ethical person should stop their access to personal data which they are not supposed to see after confirming that vulnerability exists and not make copies of said data.
  • mcguire 5y ago
    Because you can do a thing does not mean you should do a thing. If the security system is broken and you do exactly what it should be preventing, then you report it and get upset because they ask questions about you doing exactly what you did?
• solveit 5y ago
  Being wary of the guy, sure. But it's a terrible response in general. The correct response is to take the site down! Monitoring IP addresses? Really? First, it's trivial to just use a different IP address. Second, even if you could track people perfectly, which you can't, who the hell thinks it's okay for data to get leaked as long as you know who it gets leaked to?
  • throwaway894345 5y ago
    It’s not a nice response, but IT needs to be able to answer questions about the extent of a given breach (what info was accessed by whom and when). This is a legal requirement in the case of health information. Ideally people could be courteous while fulfilling their legal obligations, but IT folks aren’t generally chosen for their public relations or customer service skills.
    • vageli 5y ago
      In those situations you get a third-party in for forensics, you don't typically ask the people who breached how large the breach is (why would you take them at their word anyway? aren't they incentivized to downplay, etc).
    • frumper 5y ago
      If he can monitor ip addresses to make sure this guy isn't browsing anymore, then he should be able to check those same logs to answer his own question. If you want people that have zero obligation to help you then you should probably be nice to them. The nefarious criminal isn't going to report things like this to you.
      • throwaway894345 5y ago
        I already agreed that this doesn’t warrant unkindness.
    • marcus0x62 5y ago
      Yes, and they need to do that based on the forensic data available to them, even if the answer is “we don’t know, it could be everything.”. Asking the person who caused the breach to explain the extent of your data loss is not an acceptable, or reliable, practice.