4 ms·

At what point would (if any) would the liability change? What if the data was on a hidden URL that required no auth, would that still be considered a "hack"? A

by kypro 4y ago

At what point would (if any) would the liability change? What if the data was on a hidden URL that required no auth, would that still be considered a "hack"? After all the URL wasn't suppose to be known, even if it was in public sight. And and even more extreme example would be what if the information was mistakenly published? Is it still illegal to download it? There must be some line here right? Is it just that there needs to be a reasonable assumption that the data is public?

lamontcg 4y ago
If you're jiggling doorknobs and one opens for you, that is generally illegal. So if there's a URL that isn't normally accessed by the public which has no auth on it, and you stumble across it as part of scanning of the api, then accessing that information is very likely illegal. If you try to use that information to publicly embarrass the company, you may wind up getting arrested for it. For the information to be made public, to have a defense you probably need to show that somebody in the company deliberately pressed some kind of "make it public" button. If there's a folder with 999 other documents which the company intended to be public but one of them shouldn't have been included then you've got a lot better leg to stand on. Your freedom may very well come down to which analogy lawyers can convince a judge to apply. Don't expect the law to act like a computer program with definitive inputs and outputs. You very well may get treated as guilty if you "act guilty". And the bigger risk here is that if you find something like a document which was errantly made public that you may get treated like someone who went jiggling doorknobs and found one that opened for you. There is no definitive line, there is only what a prosecutor can convince a judge. The defense of "but they had crappy security, I'm just doing a public service letting the public know how bad they are" never flies, and there's a constant trickle of "security researchers" who get charged with hacking crimes for stuff like this.

by kypro 4y ago

lamontcg 4y ago

If you're jiggling doorknobs and one opens for you, that is generally illegal. So if there's a URL that isn't normally accessed by the public which has no auth on it, and you stumble across it as part of scanning of the api, then accessing that information is very likely illegal. If you try to use that information to publicly embarrass the company, you may wind up getting arrested for it. For the information to be made public, to have a defense you probably need to show that somebody in the company deliberately pressed some kind of "make it public" button. If there's a folder with 999 other documents which the company intended to be public but one of them shouldn't have been included then you've got a lot better leg to stand on. Your freedom may very well come down to which analogy lawyers can convince a judge to apply. Don't expect the law to act like a computer program with definitive inputs and outputs. You very well may get treated as guilty if you "act guilty". And the bigger risk here is that if you find something like a document which was errantly made public that you may get treated like someone who went jiggling doorknobs and found one that opened for you. There is no definitive line, there is only what a prosecutor can convince a judge. The defense of "but they had crappy security, I'm just doing a public service letting the public know how bad they are" never flies, and there's a constant trickle of "security researchers" who get charged with hacking crimes for stuff like this.