10 ms·

If they are calculating the price in JS then maybe it is worth me spending a few minutes with the console open on their website to try and bring down my monthly

If they are calculating the price in JS then maybe it is worth me spending a few minutes with the console open on their website to try and bring down my monthly bill. Yes, I would like to switch to the new $10 plan!

rossdavidh 5y ago
Can the number of refreshes be set to a negative number, perhaps?
mywittyname 5y ago
This might be computer fraud & abuse.
- henriquez 5y ago
  If the Javascript code is running on your own computer then you by definition have authorized access. By the same token, AT&Ts malicious pricing malware running in your browser could be construed of "unauthorized access" of your own computer, thus AT&T would be violating CFAA.
  - dahfizz 5y ago
    You could argue that you have access to their JS. But as soon as you modify that JS to do something they don't want to their backend servers, that's most likely unlawful.
    - elldoubleyew 5y ago
      When I was in college my friend figured out a major fast food chain had a flaw in its API with the way it validated coupon codes. The server validated that the coupon code was legitimate, but the actual discount value of the coupon code was validated client side in JS for some reason. So he could turn any 10% off coupon into a 100% off coupon by modifying the API requests during the checkout flow. I'm sure this was illegal but he ate a lot of free fast food before they ever fixed it.
    - bialpio 5y ago
      Let's run with this thought experiment even further: what if I use a very obscure browser that happens to interpret their JS in a very specific (and beneficial to me) way?
  - mywittyname 5y ago
    Once you send that over the wire to their system, you've committed a crime. Whether that's simple theft of services or something worse is up to the prosecution. Considering you altered a company's website to have it send malformed data for the express purposes of getting an unauthorized discount, computer/wire fraud might be on the table. But don't sit there and pretend that you can say, "well, they let me do it because some of the code ran client side." No, that's not how it works. Changing the price of a $100 service to $10 on a website, is like taking a bar code from a $10 product and slapping it on $100 product. The biggest difference is, since it involves computers, there are even more crimes committed.
    - henriquez 5y ago
      That’s just… like, your opinion, man.
    - mbreese 5y ago
      Obviously IANAL, but it is an interesting thought exercise. Would changing price (and having it accepted) be a financial crime (wire fraud, etc), or a negotiation? It isn’t like you are going into the ATT database and changing your bill. Would it be more like saying, I’m willing to pay X for plan Z? And if they accept, is this the result of digital haggling? Because, this is possible when you are physically talking to a rep (in person or on the phone). I doubt a “reasonable” person would think of it like the latter case, but for people who think about software agents, it’s interesting to think about. Disclaimer: don’t try this at home…
      - dahfizz 5y ago
        I think the critical difference is that their backend API is not meant for public use. The situation is akin to forging an internal email to your customer service rep, tricking them into changing your bill.
        lupire 5y ago
        The backend API literally responds to calls from the public, intentionally. It's not using DRM for secure communications with its remote client.
- juanani 5y ago
- dylan604 5y ago
  If someone is doing these kinds of calculations client side, then they are pretty much begging someone to take advantage of them like this. After all, it is code running on my computer that you've given me control of by doing critical decisions client side. I've just decided to make that critical decision myself using the same code that has been provided to me. Don't ever do critical calculations like this client side. It's just dumber than dumb.
  - mywittyname 5y ago
    Taking advantage of poor design decisions for financial gain is still a crime.
    - dylan604 5y ago
      So is exceeding the speed limit. However, catching speeders is much easier to do than proving someone intentionally manipulated the data client side and that it wasn't a bug somewhere else in the shittily designed system.
    - swagasaurus-rex 5y ago
      What's the specific crime being committed?
      - dylan604 5y ago
        Using client side javascript to do critical monetary decisions?
- ______-_-______ 5y ago
  What if a company sends me an order form on physical paper: [ ] Plan X $30 [ ] Plan Y $50 [ ] Plan Z $70 And I pencil in "Plan W $10" at the top with a checkmark and mail it back. Is that illegal?
  - hyperdimension 5y ago
    Honestly, given the way the CFAA has been (ab)used in the past, it might just come down to whether they "use a computer" to scan the page and see what's checked...
  - Crosseye_Jack 5y ago
    Is doing so illegal? No. Can you demand the company accept Plan W? Also no. You are basically just giving a counter offer, the company can choose to accept or reject that offer. There have been cases (cba to google them right now, just going off my memory) where customers have done what you have suggested, the company have blindly accepted the "counter offer" and have had to honour the amended contract they agreed to. EDIT: The problems happen when trying to enforce such amended contracts, trying to prove the company agreed to such changes. For me when I'm negotiating my annual broadband contract I record the phone call (granted I'm in the UK, recording calls as an indivial is legal) just to make sure I have a record of what was agreed. But my current provider has always followed up with a updated contract after the phone call with the new terms, so it would be easy for me to prove that my provider agreed to those terms. My current provider agreed to a price which is £1 per month cheaper than the cheapest like fore like competitor I could find at the time and also agreed to waive any cancelation charges if I choice to cancel before the end of the 12 month contract. However a) been pretty happy with their service todate so unless the shit hits the fan I have no plans to leaving them unless b) my local area finally gets FTTP but if that does happen I will prob use my current provider as my FTTP provider. So they really don't have any risk of myu cancelling during the current contract.
    - deleted 5y ago
      [deleted]
    - bumby 5y ago
- imglorp 5y ago
  Everyone on this thread debating legality of "it's running on my computer already" needs to remember the infinite stupidity field flux density emitted from certain offices. It doesn't matter if it's legal if your legal defense bankrupts you. Eg the F12 debacle: https://www.theverge.com/2021/12/31/22861188/missouri-governor-mike-parson-hack-website-source-code https://www.theverge.com/2021/12/31/22861188/missouri-govern...
- albrewer 5y ago
  If I submit a form stating I'd like to pay $10 a month for service and AT&T accepts that, how is that fraud?
  - staticassertion 5y ago
    The same way that if a company puts pages you can access at `www.example.com/1` and you then access `www.example.com/2`, which you should not access, you're violating the CFAA. I haven't read the CFAA in a while but it is extremely broad. It boiled down to "if you access a system in a way you should not, illegal". Or how accessing the same page a billion times per second, a page you have every right to access a few times, is illegal. Or if you dial into a nuclear arms facility with your phone.
    - albrewer 5y ago
      So if I access it with a non-compliant browser that, say, doesn't run validation javascript when I submit a form, it's abuse? I think even the most tech illiterate judge would agree that, if I fill out a paper form and give it to someone at a company, it's on them to validate the information in it before executing a contract with the information inside it.
      - staticassertion 5y ago
        I'm not a lawyer. I'm just saying that the CFAA is extremely broad.
- BeFlatXIII 5y ago
  Hopefully a jury nullifies whatever nonsense Congress wanted to push in that law.
- swalsh 5y ago
  I call it negotiating
nitwit005 5y ago
If that worked, I'd be more curious about what would happen if you signed up for a monthly plan with a cost of Number.MAX_VALUE.
- _Algernon_ 5y ago
  Why not go crazy? Negative values.

rossdavidh 5y ago

Can the number of refreshes be set to a negative number, perhaps?

mywittyname 5y ago

This might be computer fraud & abuse.

henriquez 5y ago
If the Javascript code is running on your own computer then you by definition have authorized access. By the same token, AT&Ts malicious pricing malware running in your browser could be construed of "unauthorized access" of your own computer, thus AT&T would be violating CFAA.
- dahfizz 5y ago
  You could argue that you have access to their JS. But as soon as you modify that JS to do something they don't want to their backend servers, that's most likely unlawful.
  - elldoubleyew 5y ago
    When I was in college my friend figured out a major fast food chain had a flaw in its API with the way it validated coupon codes. The server validated that the coupon code was legitimate, but the actual discount value of the coupon code was validated client side in JS for some reason. So he could turn any 10% off coupon into a 100% off coupon by modifying the API requests during the checkout flow. I'm sure this was illegal but he ate a lot of free fast food before they ever fixed it.
  - bialpio 5y ago
    Let's run with this thought experiment even further: what if I use a very obscure browser that happens to interpret their JS in a very specific (and beneficial to me) way?
- mywittyname 5y ago
  Once you send that over the wire to their system, you've committed a crime. Whether that's simple theft of services or something worse is up to the prosecution. Considering you altered a company's website to have it send malformed data for the express purposes of getting an unauthorized discount, computer/wire fraud might be on the table. But don't sit there and pretend that you can say, "well, they let me do it because some of the code ran client side." No, that's not how it works. Changing the price of a $100 service to $10 on a website, is like taking a bar code from a $10 product and slapping it on $100 product. The biggest difference is, since it involves computers, there are even more crimes committed.
  - henriquez 5y ago
    That’s just… like, your opinion, man.
  - mbreese 5y ago
    Obviously IANAL, but it is an interesting thought exercise. Would changing price (and having it accepted) be a financial crime (wire fraud, etc), or a negotiation? It isn’t like you are going into the ATT database and changing your bill. Would it be more like saying, I’m willing to pay X for plan Z? And if they accept, is this the result of digital haggling? Because, this is possible when you are physically talking to a rep (in person or on the phone). I doubt a “reasonable” person would think of it like the latter case, but for people who think about software agents, it’s interesting to think about. Disclaimer: don’t try this at home…
    - dahfizz 5y ago
      I think the critical difference is that their backend API is not meant for public use. The situation is akin to forging an internal email to your customer service rep, tricking them into changing your bill.
      - lupire 5y ago
        The backend API literally responds to calls from the public, intentionally. It's not using DRM for secure communications with its remote client.
juanani 5y ago
dylan604 5y ago
If someone is doing these kinds of calculations client side, then they are pretty much begging someone to take advantage of them like this. After all, it is code running on my computer that you've given me control of by doing critical decisions client side. I've just decided to make that critical decision myself using the same code that has been provided to me. Don't ever do critical calculations like this client side. It's just dumber than dumb.
- mywittyname 5y ago
  Taking advantage of poor design decisions for financial gain is still a crime.
  - dylan604 5y ago
    So is exceeding the speed limit. However, catching speeders is much easier to do than proving someone intentionally manipulated the data client side and that it wasn't a bug somewhere else in the shittily designed system.
  - swagasaurus-rex 5y ago
    What's the specific crime being committed?
    - dylan604 5y ago
      Using client side javascript to do critical monetary decisions?
______-_-______ 5y ago
What if a company sends me an order form on physical paper: [ ] Plan X $30 [ ] Plan Y $50 [ ] Plan Z $70 And I pencil in "Plan W $10" at the top with a checkmark and mail it back. Is that illegal?
- hyperdimension 5y ago
  Honestly, given the way the CFAA has been (ab)used in the past, it might just come down to whether they "use a computer" to scan the page and see what's checked...
- Crosseye_Jack 5y ago
  Is doing so illegal? No. Can you demand the company accept Plan W? Also no. You are basically just giving a counter offer, the company can choose to accept or reject that offer. There have been cases (cba to google them right now, just going off my memory) where customers have done what you have suggested, the company have blindly accepted the "counter offer" and have had to honour the amended contract they agreed to. EDIT: The problems happen when trying to enforce such amended contracts, trying to prove the company agreed to such changes. For me when I'm negotiating my annual broadband contract I record the phone call (granted I'm in the UK, recording calls as an indivial is legal) just to make sure I have a record of what was agreed. But my current provider has always followed up with a updated contract after the phone call with the new terms, so it would be easy for me to prove that my provider agreed to those terms. My current provider agreed to a price which is £1 per month cheaper than the cheapest like fore like competitor I could find at the time and also agreed to waive any cancelation charges if I choice to cancel before the end of the 12 month contract. However a) been pretty happy with their service todate so unless the shit hits the fan I have no plans to leaving them unless b) my local area finally gets FTTP but if that does happen I will prob use my current provider as my FTTP provider. So they really don't have any risk of myu cancelling during the current contract.
  - deleted 5y ago
    [deleted]
  - bumby 5y ago
imglorp 5y ago
Everyone on this thread debating legality of "it's running on my computer already" needs to remember the infinite stupidity field flux density emitted from certain offices. It doesn't matter if it's legal if your legal defense bankrupts you. Eg the F12 debacle: https://www.theverge.com/2021/12/31/22861188/missouri-governor-mike-parson-hack-website-source-code https://www.theverge.com/2021/12/31/22861188/missouri-govern...
albrewer 5y ago
If I submit a form stating I'd like to pay $10 a month for service and AT&T accepts that, how is that fraud?
- staticassertion 5y ago
  The same way that if a company puts pages you can access at `www.example.com/1` and you then access `www.example.com/2`, which you should not access, you're violating the CFAA. I haven't read the CFAA in a while but it is extremely broad. It boiled down to "if you access a system in a way you should not, illegal". Or how accessing the same page a billion times per second, a page you have every right to access a few times, is illegal. Or if you dial into a nuclear arms facility with your phone.
  - albrewer 5y ago
    So if I access it with a non-compliant browser that, say, doesn't run validation javascript when I submit a form, it's abuse? I think even the most tech illiterate judge would agree that, if I fill out a paper form and give it to someone at a company, it's on them to validate the information in it before executing a contract with the information inside it.
    - staticassertion 5y ago
      I'm not a lawyer. I'm just saying that the CFAA is extremely broad.
BeFlatXIII 5y ago
Hopefully a jury nullifies whatever nonsense Congress wanted to push in that law.
swalsh 5y ago
I call it negotiating

nitwit005 5y ago

If that worked, I'd be more curious about what would happen if you signed up for a monthly plan with a cost of Number.MAX_VALUE.

_Algernon_ 5y ago
Why not go crazy? Negative values.