3 ms·

> If someone leaves a pile of private records on a park bench, and I poke around with access I know I shouldn't have, that's not a felony, is it? CFAA covers u

by rosndo 5y ago

> If someone leaves a pile of private records on a park bench, and I poke around with access I know I shouldn't have, that's not a felony, is it? CFAA covers unauthorized access to protected computers, not piles of records on park benches.

tannedNerd 5y ago
The key being protected, seems like the the bar is trying to blame a misconfigured DB on a "vulnerability"
- rosndo 5y ago
  “Protected computer” has a specific legal definition which has nothing to do with technical protections, but legal protections.
Dylan16807 5y ago
Obviously. But I was responding to a particular argument. Why is "knowingly accessing records that you know you shouldn't have access to" so different in this case? There's no trespassing or equivalent; the computer itself was set up for public access. And "protected computer" is basically all computers. Imagine if the records were on a kindle; that shouldn't change the legality and if the CFAA does so that's a bad thing.
- rosndo 5y ago
  > that shouldn't change the legality and if the CFAA does so that's a bad thing. Is it really though? What harm may come from legislation preventing you from rifling through somebody’s phone that they left on a park bench? I’m not saying CFAA isn’t problematic, but I’m very unconvinced that this is the problematic part.
  - Dylan16807 5y ago
    A phone is a personal device and I'd like that to be treated differently in many ways. A public web server doesn't have such direct privacy issues. When it comes to records on a bench vs. a non-personal kindle on a bench, I think they should have equal and low protection. Abusing the data should face penalties, but not poking around.
    - rosndo 5y ago
      Why should you have any right to “poke around” a kindle you find on a park bench? Beyond any general rights you might have permitting you to take ownership of lost property, that is. I don’t see any obvious reason as to why this should be allowed, but it’s trivial to come up with a whole plethora of reasons for why you shouldn’t be allowed to poke around such devices.

by rosndo 5y ago

tannedNerd 5y ago

The key being protected, seems like the the bar is trying to blame a misconfigured DB on a "vulnerability"

rosndo 5y ago
“Protected computer” has a specific legal definition which has nothing to do with technical protections, but legal protections.

Dylan16807 5y ago

Obviously. But I was responding to a particular argument. Why is "knowingly accessing records that you know you shouldn't have access to" so different in this case? There's no trespassing or equivalent; the computer itself was set up for public access. And "protected computer" is basically all computers. Imagine if the records were on a kindle; that shouldn't change the legality and if the CFAA does so that's a bad thing.

rosndo 5y ago
> that shouldn't change the legality and if the CFAA does so that's a bad thing. Is it really though? What harm may come from legislation preventing you from rifling through somebody’s phone that they left on a park bench? I’m not saying CFAA isn’t problematic, but I’m very unconvinced that this is the problematic part.
- Dylan16807 5y ago
  A phone is a personal device and I'd like that to be treated differently in many ways. A public web server doesn't have such direct privacy issues. When it comes to records on a bench vs. a non-personal kindle on a bench, I think they should have equal and low protection. Abusing the data should face penalties, but not poking around.
  - rosndo 5y ago
    Why should you have any right to “poke around” a kindle you find on a park bench? Beyond any general rights you might have permitting you to take ownership of lost property, that is. I don’t see any obvious reason as to why this should be allowed, but it’s trivial to come up with a whole plethora of reasons for why you shouldn’t be allowed to poke around such devices.