3 ms·

Once you send that over the wire to their system, you've committed a crime. Whether that's simple theft of services or something worse is up to the prosecution

Once you send that over the wire to their system, you've committed a crime. Whether that's simple theft of services or something worse is up to the prosecution. Considering you altered a company's website to have it send malformed data for the express purposes of getting an unauthorized discount, computer/wire fraud might be on the table. But don't sit there and pretend that you can say, "well, they let me do it because some of the code ran client side." No, that's not how it works. Changing the price of a $100 service to $10 on a website, is like taking a bar code from a $10 product and slapping it on $100 product. The biggest difference is, since it involves computers, there are even more crimes committed.

henriquez 5y ago
That’s just… like, your opinion, man.
mbreese 5y ago
Obviously IANAL, but it is an interesting thought exercise. Would changing price (and having it accepted) be a financial crime (wire fraud, etc), or a negotiation? It isn’t like you are going into the ATT database and changing your bill. Would it be more like saying, I’m willing to pay X for plan Z? And if they accept, is this the result of digital haggling? Because, this is possible when you are physically talking to a rep (in person or on the phone). I doubt a “reasonable” person would think of it like the latter case, but for people who think about software agents, it’s interesting to think about. Disclaimer: don’t try this at home…
- dahfizz 5y ago
  I think the critical difference is that their backend API is not meant for public use. The situation is akin to forging an internal email to your customer service rep, tricking them into changing your bill.
  - lupire 5y ago
    The backend API literally responds to calls from the public, intentionally. It's not using DRM for secure communications with its remote client.
    - dahfizz 5y ago
      It responds to calls from their frontend code, by necessity. It is not meant for public use. Just because you are technically capable to interact with it yourself does not mean you legally can. Just because you can physically enter a strangers house does not shield you from trespassing charges. Society / the legal system is not code. There is all sorts of nuance and morals and subjectivity involved beyond the "bits on the wire", so to speak. You can go to prison for accessing a website you know you shouldn't, even if the HTTP response code is 200.
postalrat 5y ago
It would probably be a crime if you manipulated their computers to accept the $10 price. But if you submit you want a plan for $10 and their servers just accept it then what crime could I have committed?
- mywittyname 5y ago
  You've still committed a crime even if the other party doesn't actively prevent you from doing so. You can walk into a store, and walk out the front door with a television and probably nobody will stop you. Additionally, you can walk into a bank and demand that they give you money, and they will give it to you. In none of these cases are the companies condoning or supporting your actions. You can try the argument that the bank teller gave you the money and that it's bank policy to do so. But it probably won't work. It's strange to see people bending over backwards to deny that this is a crime. Surely if someone manipulated your bank's computers to wire transfer your entire balance to another account, you wouldn't be asking, "what crime could [they] have committed?" You'd feel like somebody stole from you.
  - postalrat 5y ago
    I think the reason people are denying this is a crime is because it's happening on their machine, not a remote server. And the remote server is presumable accepting the request. Using your store analogy it would be like bringing a television to the cashier and telling them you will pay $10 and they accept.
BeFlatXIII 5y ago
> since it involves computers, there are even more crimes committed. This is why educating the public about jury nullification is so important.
- lupire 5y ago
  Why? The jury doesn't need to nullify to decide that fraud and abuse did not happen.

henriquez 5y ago

That’s just… like, your opinion, man.

mbreese 5y ago

Obviously IANAL, but it is an interesting thought exercise. Would changing price (and having it accepted) be a financial crime (wire fraud, etc), or a negotiation? It isn’t like you are going into the ATT database and changing your bill. Would it be more like saying, I’m willing to pay X for plan Z? And if they accept, is this the result of digital haggling? Because, this is possible when you are physically talking to a rep (in person or on the phone). I doubt a “reasonable” person would think of it like the latter case, but for people who think about software agents, it’s interesting to think about. Disclaimer: don’t try this at home…

dahfizz 5y ago
I think the critical difference is that their backend API is not meant for public use. The situation is akin to forging an internal email to your customer service rep, tricking them into changing your bill.
- lupire 5y ago
  The backend API literally responds to calls from the public, intentionally. It's not using DRM for secure communications with its remote client.
  - dahfizz 5y ago
    It responds to calls from their frontend code, by necessity. It is not meant for public use. Just because you are technically capable to interact with it yourself does not mean you legally can. Just because you can physically enter a strangers house does not shield you from trespassing charges. Society / the legal system is not code. There is all sorts of nuance and morals and subjectivity involved beyond the "bits on the wire", so to speak. You can go to prison for accessing a website you know you shouldn't, even if the HTTP response code is 200.

postalrat 5y ago

It would probably be a crime if you manipulated their computers to accept the $10 price. But if you submit you want a plan for $10 and their servers just accept it then what crime could I have committed?

mywittyname 5y ago
You've still committed a crime even if the other party doesn't actively prevent you from doing so. You can walk into a store, and walk out the front door with a television and probably nobody will stop you. Additionally, you can walk into a bank and demand that they give you money, and they will give it to you. In none of these cases are the companies condoning or supporting your actions. You can try the argument that the bank teller gave you the money and that it's bank policy to do so. But it probably won't work. It's strange to see people bending over backwards to deny that this is a crime. Surely if someone manipulated your bank's computers to wire transfer your entire balance to another account, you wouldn't be asking, "what crime could [they] have committed?" You'd feel like somebody stole from you.
- postalrat 5y ago
  I think the reason people are denying this is a crime is because it's happening on their machine, not a remote server. And the remote server is presumable accepting the request. Using your store analogy it would be like bringing a television to the cashier and telling them you will pay $10 and they accept.

BeFlatXIII 5y ago

> since it involves computers, there are even more crimes committed. This is why educating the public about jury nullification is so important.

lupire 5y ago
Why? The jury doesn't need to nullify to decide that fraud and abuse did not happen.