4 ms·
Also in the US, where you can be sentenced to 41 months in prison for browsing a public URL at AT&T, and where the the Governor of Missouri wants to make it ill
by jacobsenscott 5y ago
Also in the US, where you can be sentenced to 41 months in prison for browsing a public URL at AT&T, and where the the Governor of Missouri wants to make it illegal to view the html source of a web page (because some state web site leaked all the SSNs of their teachers in some hidden html or something).
If I found something like this on a site I don't think I would notify anyone. Too risky. Maybe over TOR if they have a contact page or something. But it is hard to be anonymous these days.
- legalcorrection 5y agoweev didn’t just “browse a public url at AT&T”. That is dishonestly reductionist. He noticed the bug and then used it to retrieve and make public the private data of over a hundred thousand people.
- aspenmayer 5y agoThe data was already publicly available. Didn’t he just publicize the url?
- deleted 5y ago[deleted]
- jacobsenscott 5y agoMy understanding was they just sent random icc-id codes as a query parameter to a public url, and if you hit a valid id it returned an email address. It was working as "designed", and not a bug.
- getcrunk 5y agoYou are equivocating. Iirc this bug you refer too WAS the public urls
- legalcorrection 5y agoSo? You access a few accounts that way, realize you're accessing people's private info, and then stop. No one is gonna charge you for that. Write a script and download a hundred thousand people's private data, that's a whole different thing.