> If a badly configured NSA server displays confidential data on your screen, you're still a criminal if you make use of that to access data. If a badly config

> If a badly configured NSA server displays confidential data on your screen, you're still a criminal if you make use of that to access data. If a badly configured NSA server gives you data, intentionally accessing it (and/or then misusing the data) would be the crime. I don't think it matters whether you view that data in a browser, a terminal or some third-party client. Here, the third-party client is accessing the exact same data the official client is. It's not bypassing any access control, in fact it needs your credentials to be able to access the data you're authorized to view. > According to? That's an ethical stance one can take, but it isn't how our laws work. I'm not even sure if a law has been broken here? Breach of ToS != crime. As far as I know there is no unauthorized access taking place - the unofficial client is using your credentials to legitimately access the same API as the official one does; it's not giving you any extra data that the official client doesn't.