4 ms·
I wasn't aware companies could, by fiat, declare certain publicly available endpoints private, thereby compelling everyone by force of law to pretend they don't
by Veen 3y ago
I wasn't aware companies could, by fiat, declare certain publicly available endpoints private, thereby compelling everyone by force of law to pretend they don't exist.
- spzb 3y agoMy bank's website is publicly available. That doesn't mean anyone is free to access my bank account. Just 'cause something is accessible on the internet doesn't mean you have the right to access it. Case law and statute goes back at least to the 1980s on this point.
- berkle4455 3y agoThe aforementioned tools do nothing whatsoever to grant to access accounts which aren’t theirs.
- spzb 3y agoI know. That’s not what I said.
- deleted 3y ago[deleted]
- berkle4455 3y ago> That doesn't mean anyone is free to access my bank account.
- s17n 3y agoThey can. Now you know.
- Veen 3y agoSo, if I create a cat GIF API, but announce that it's a private cat GIF API only I am allowed to use, I can sue anyone else who uses it to retrieve a cat GIF?
- deleted 3y ago[deleted]
- drusepth 3y agoLegally and literally: yes. Knowingly using a private API without authorization can fall under CFAA, contract law, copyright law, trespass to chattel, etc -- and you can issue a C&D and/or sue for whatever is relevant.
- woogley 3y agoPeople have gone to prison over guessable GET parameters https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_email_address_leak https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai... https://www.praetorianprefect.com/2010/06/114000-ipad-owners-the-script-that-harvested-their-e-mail-addresses/ https://www.praetorianprefect.com/2010/06/114000-ipad-owners...
- dragonwriter 3y agoCiting convictions overturned on appeal probably isn't the strongest evidence of illegality. (Because they were overturned on threshold issues that didn’t involve inquiry into the substantive merits of the charges, its not evidence against illegality, either, but...)
- woogley 3y agoMy point is people have gone to prison over GET parameters, not the legality of the it. DOJ has CFAA. Abusing private APIs is flying close to the sun. Even if you do get out of prison eventually
- dragonwriter 3y ago> My point is people have gone to prison over GET parameters, not the legality of the it. DOJ has CFAA. And CFAA is limited by Van Buren.