4 ms·

If the Javascript code is running on your own computer then you by definition have authorized access. By the same token, AT&Ts malicious pricing malware runnin

If the Javascript code is running on your own computer then you by definition have authorized access. By the same token, AT&Ts malicious pricing malware running in your browser could be construed of "unauthorized access" of your own computer, thus AT&T would be violating CFAA.

dahfizz 5y ago
You could argue that you have access to their JS. But as soon as you modify that JS to do something they don't want to their backend servers, that's most likely unlawful.
- elldoubleyew 5y ago
  When I was in college my friend figured out a major fast food chain had a flaw in its API with the way it validated coupon codes. The server validated that the coupon code was legitimate, but the actual discount value of the coupon code was validated client side in JS for some reason. So he could turn any 10% off coupon into a 100% off coupon by modifying the API requests during the checkout flow. I'm sure this was illegal but he ate a lot of free fast food before they ever fixed it.
- bialpio 5y ago
  Let's run with this thought experiment even further: what if I use a very obscure browser that happens to interpret their JS in a very specific (and beneficial to me) way?
mywittyname 5y ago
Once you send that over the wire to their system, you've committed a crime. Whether that's simple theft of services or something worse is up to the prosecution. Considering you altered a company's website to have it send malformed data for the express purposes of getting an unauthorized discount, computer/wire fraud might be on the table. But don't sit there and pretend that you can say, "well, they let me do it because some of the code ran client side." No, that's not how it works. Changing the price of a $100 service to $10 on a website, is like taking a bar code from a $10 product and slapping it on $100 product. The biggest difference is, since it involves computers, there are even more crimes committed.
- henriquez 5y ago
  That’s just… like, your opinion, man.
- mbreese 5y ago
  Obviously IANAL, but it is an interesting thought exercise. Would changing price (and having it accepted) be a financial crime (wire fraud, etc), or a negotiation? It isn’t like you are going into the ATT database and changing your bill. Would it be more like saying, I’m willing to pay X for plan Z? And if they accept, is this the result of digital haggling? Because, this is possible when you are physically talking to a rep (in person or on the phone). I doubt a “reasonable” person would think of it like the latter case, but for people who think about software agents, it’s interesting to think about. Disclaimer: don’t try this at home…
  - dahfizz 5y ago
    I think the critical difference is that their backend API is not meant for public use. The situation is akin to forging an internal email to your customer service rep, tricking them into changing your bill.
    - lupire 5y ago
      The backend API literally responds to calls from the public, intentionally. It's not using DRM for secure communications with its remote client.
      - dahfizz 5y ago
        It responds to calls from their frontend code, by necessity. It is not meant for public use. Just because you are technically capable to interact with it yourself does not mean you legally can. Just because you can physically enter a strangers house does not shield you from trespassing charges. Society / the legal system is not code. There is all sorts of nuance and morals and subjectivity involved beyond the "bits on the wire", so to speak. You can go to prison for accessing a website you know you shouldn't, even if the HTTP response code is 200.

dahfizz 5y ago

You could argue that you have access to their JS. But as soon as you modify that JS to do something they don't want to their backend servers, that's most likely unlawful.

elldoubleyew 5y ago
When I was in college my friend figured out a major fast food chain had a flaw in its API with the way it validated coupon codes. The server validated that the coupon code was legitimate, but the actual discount value of the coupon code was validated client side in JS for some reason. So he could turn any 10% off coupon into a 100% off coupon by modifying the API requests during the checkout flow. I'm sure this was illegal but he ate a lot of free fast food before they ever fixed it.
bialpio 5y ago
Let's run with this thought experiment even further: what if I use a very obscure browser that happens to interpret their JS in a very specific (and beneficial to me) way?

mywittyname 5y ago

Once you send that over the wire to their system, you've committed a crime. Whether that's simple theft of services or something worse is up to the prosecution. Considering you altered a company's website to have it send malformed data for the express purposes of getting an unauthorized discount, computer/wire fraud might be on the table. But don't sit there and pretend that you can say, "well, they let me do it because some of the code ran client side." No, that's not how it works. Changing the price of a $100 service to $10 on a website, is like taking a bar code from a $10 product and slapping it on $100 product. The biggest difference is, since it involves computers, there are even more crimes committed.

henriquez 5y ago
That’s just… like, your opinion, man.
mbreese 5y ago
Obviously IANAL, but it is an interesting thought exercise. Would changing price (and having it accepted) be a financial crime (wire fraud, etc), or a negotiation? It isn’t like you are going into the ATT database and changing your bill. Would it be more like saying, I’m willing to pay X for plan Z? And if they accept, is this the result of digital haggling? Because, this is possible when you are physically talking to a rep (in person or on the phone). I doubt a “reasonable” person would think of it like the latter case, but for people who think about software agents, it’s interesting to think about. Disclaimer: don’t try this at home…
- dahfizz 5y ago
  I think the critical difference is that their backend API is not meant for public use. The situation is akin to forging an internal email to your customer service rep, tricking them into changing your bill.
  - lupire 5y ago
    The backend API literally responds to calls from the public, intentionally. It's not using DRM for secure communications with its remote client.
    - dahfizz 5y ago
      It responds to calls from their frontend code, by necessity. It is not meant for public use. Just because you are technically capable to interact with it yourself does not mean you legally can. Just because you can physically enter a strangers house does not shield you from trespassing charges. Society / the legal system is not code. There is all sorts of nuance and morals and subjectivity involved beyond the "bits on the wire", so to speak. You can go to prison for accessing a website you know you shouldn't, even if the HTTP response code is 200.