3 ms·

As a "hack" I'll agree it is pretty weak. But the credentials were stolen and used to access information that was supposed to be private (even if keys are left

As a "hack" I'll agree it is pretty weak. But the credentials were stolen and used to access information that was supposed to be private (even if keys are left lying on the ground, you can't just take the car that they open like its yours). All of the legal liability of having broken the law, while very little street cred of having done anything particularly novel.

kypro 4y ago
At what point would (if any) would the liability change? What if the data was on a hidden URL that required no auth, would that still be considered a "hack"? After all the URL wasn't suppose to be known, even if it was in public sight. And and even more extreme example would be what if the information was mistakenly published? Is it still illegal to download it? There must be some line here right? Is it just that there needs to be a reasonable assumption that the data is public?
- lamontcg 4y ago
  If you're jiggling doorknobs and one opens for you, that is generally illegal. So if there's a URL that isn't normally accessed by the public which has no auth on it, and you stumble across it as part of scanning of the api, then accessing that information is very likely illegal. If you try to use that information to publicly embarrass the company, you may wind up getting arrested for it. For the information to be made public, to have a defense you probably need to show that somebody in the company deliberately pressed some kind of "make it public" button. If there's a folder with 999 other documents which the company intended to be public but one of them shouldn't have been included then you've got a lot better leg to stand on. Your freedom may very well come down to which analogy lawyers can convince a judge to apply. Don't expect the law to act like a computer program with definitive inputs and outputs. You very well may get treated as guilty if you "act guilty". And the bigger risk here is that if you find something like a document which was errantly made public that you may get treated like someone who went jiggling doorknobs and found one that opened for you. There is no definitive line, there is only what a prosecutor can convince a judge. The defense of "but they had crappy security, I'm just doing a public service letting the public know how bad they are" never flies, and there's a constant trickle of "security researchers" who get charged with hacking crimes for stuff like this.
PeterisP 4y ago
It does matter what information was leaked, not just "information that was supposed to be private". If I read "Data from Atlassian dumped online" the obvious inference is that it would be the primary data from Atlassian, i.e. the customer data about customer projects which Atlassian is hosting as the key part of their business. This is not it, this is something much less sensitive that affects much less people - while this is bad, this is absolutely insignificant compared to the level of badness that the title implies.

kypro 4y ago

At what point would (if any) would the liability change? What if the data was on a hidden URL that required no auth, would that still be considered a "hack"? After all the URL wasn't suppose to be known, even if it was in public sight. And and even more extreme example would be what if the information was mistakenly published? Is it still illegal to download it? There must be some line here right? Is it just that there needs to be a reasonable assumption that the data is public?

lamontcg 4y ago
If you're jiggling doorknobs and one opens for you, that is generally illegal. So if there's a URL that isn't normally accessed by the public which has no auth on it, and you stumble across it as part of scanning of the api, then accessing that information is very likely illegal. If you try to use that information to publicly embarrass the company, you may wind up getting arrested for it. For the information to be made public, to have a defense you probably need to show that somebody in the company deliberately pressed some kind of "make it public" button. If there's a folder with 999 other documents which the company intended to be public but one of them shouldn't have been included then you've got a lot better leg to stand on. Your freedom may very well come down to which analogy lawyers can convince a judge to apply. Don't expect the law to act like a computer program with definitive inputs and outputs. You very well may get treated as guilty if you "act guilty". And the bigger risk here is that if you find something like a document which was errantly made public that you may get treated like someone who went jiggling doorknobs and found one that opened for you. There is no definitive line, there is only what a prosecutor can convince a judge. The defense of "but they had crappy security, I'm just doing a public service letting the public know how bad they are" never flies, and there's a constant trickle of "security researchers" who get charged with hacking crimes for stuff like this.

PeterisP 4y ago

It does matter what information was leaked, not just "information that was supposed to be private". If I read "Data from Atlassian dumped online" the obvious inference is that it would be the primary data from Atlassian, i.e. the customer data about customer projects which Atlassian is hosting as the key part of their business. This is not it, this is something much less sensitive that affects much less people - while this is bad, this is absolutely insignificant compared to the level of badness that the title implies.