7 ms·

Isn't this fraud and an open admission of guilty?

by davidchua 15y ago

Luyt 15y ago
How is changing your UserAgent string fraud?
- luca-giovanni 15y ago
  It isn't!
- rmc 15y ago
  You are implying you are something you are not.
  - icebraining 15y ago
    If that was enough for fraud, our whole society would have to be jailed.
  - Gravityloss 15y ago
    "You are"? It's just a browser "identification". It's widely known to be approximate, random and unreliable. It's common to try different agents because the web is full of bad pages which try to use it for something inappropriate. That's why user agent switching is a feature in all these browsers in the first place. It's like disabling CSS. Is it fraud to use a battery charger or electrical plug with an adapter? After all, the particular plug is a way of "identification", even when easily circumvented. How about using aftermarket parts for your car or camera. They are implying by their similarly spaced and shaped connections that they are genuine parts after all... What about console cartridge identification chips? These are somewhat interesting questions, if the HN crowd could have other opinions between "fraud" and "not fraud".
    - TylerE 15y ago
      A restaurant offers a 25% discount to seniors (65+), but you're only 60. You copy your friend's AARP card, changing the name, and present the cloned card to receive the discount. Is this fraud?
      - Gravityloss 15y ago
        Probably. It's interesting to think when a hack becomes a fraud or stealing.
        mindslight 15y ago
        When they get your identifying information and feel like hassling you. The only immoral thing here is the wifi provider increasing the complexity of the transaction to extract as much money as possible. Should one be required to tell the supermarket their net worth so they can be charged "appropriately" for their food? Anonymity is the basis for a shared existence. Two parties whose sole interaction consists of sending signals back and forth certainly don't need the outside law to mediate between them - if one party finds the relationship unfavorable, simply stop talking. It's a shame that people have been so brainwashed into thinking it's their responsibility to enforce someone else's desired business rules.
        TylerE 15y ago
        I find it a bit amusing that someone on this site, where so much of the content is about optimization and business models, is acting so morally offended by the concept of price differentiation.
        mindslight 15y ago
        So many of the articles are about business model optimization because it's not the primary nature of hackers - they need to be reminded. The major difference is that the businesses here are new and the market and product are uncertain (inherently complex); Internet access, by definition, is a solved commodity.
    - rmc 15y ago
      It's common to try different agents No, it's common for highly technical web developers to do this. For 99.99% of the internet population, they do not even know what "user agent string" is or how to change it, or what to put in.
luca-giovanni 15y ago
Is it legal to charge people different rates for the same service on different devices? I would argue it certainly isn't moral. Switching user agent is perfectly legal.
- mooism2 15y ago
  It's legal to price discriminate based on age (discounted cinema tickets for children and pensioners), gender (free entry to certain nightclubs for women), occupation (teachers get educational discounts on some software, even when they only use it at home), not to mention the tricks aeroplane/train companies pull. So why not legal to price discriminate net access based on the device you're accessing it with?
  - luca-giovanni 15y ago
    I guess it probably isn't but in any case it isn't a robust discrimination method as this guy has shown ;-)
  - pbhjpbhj 15y ago
    >occupation (teachers get educational discounts on some software, even when they only use it at home) // Suppose they say "teachers" and you have a teaching license but aren't currently teaching. You present your teaching license and say "is this acceptable" and they say yes, you only need a teaching license to get the discount. That seems pretty analogous to the current situation. You possess the token they request and that they subsequently use to give you a lower price. You've not committed fraud because you're legally allowed to use that UA string. It's up to the provider to decide if their requirement is "passes us this UA string" or "declares ownership of this device" (I don't consider those things identical by a long stretch). Now if they say when you pass a particular UA string "do you confirm you're owner of $deviceType" or "this service is only for users of $deviceType" then I think things switch around in the direction of [rather minor] fraud.
  - gmac 15y ago
    Actually, not all of these are legal everywhere. In the UK, price discrimination by gender (e.g. by nightclubs) is illegal: see http://www.equalityhumanrights.com/advice-and-guidance/your-rights/gender/sex-discrimination-as-a-consumer/sex-discrimination-as-a-consumer-your-rights/ http://www.equalityhumanrights.com/advice-and-guidance/your-...
MattBearman 15y ago
The wifi network never asked him what device type he was using, it just made an assumption based on something as unreliable as a user agent string. How is it fraud?
- Fizzer 15y ago
  He knowingly manipulated their device detection system. Yes, it's true their device detection system is trivial to manipulate, but that doesn't change the legality. If a bank forgets to lock their vault, you still wouldn't want to clean them out and admit to it on your blog.
  - luca-giovanni 15y ago
    What if you just choose to change your user agent to something different because you prefer the experience? If you then get different offers as a result you can't be held liable.
    - ugh 15y ago
      It's plausible deniability, nothing more. Illegal stays illegal.
      - ktizo 15y ago
        If there were an expensive nightclub which had a cheaper bar round the corner that only admitted people with the first name of "Dan", who then get full access to the nightclub and cheaper drinks all night, would it be criminal fraud to lie about your name to the doorstaff?
        no-downloads 15y ago
        As someone named Dan I feel compelled to point out that such policies are really good and absolutely fair :-)
    - function_seven 15y ago
wladimir 15y ago
There is no law that you have to send any user agent at all, or indeed a valid one that matches your device/browser. It is just a hint for the server. Edit: and IMO, it's toxic to the hacker spirit to be too quick in condemning ideas as illegal or immoral
- deleted 15y ago
  [deleted]
A1kmm 15y ago
Disclaimer: IANAL, this is not legal advice. The article mentions it is in the UK. Relevant fraud statute appears to be this: http://www.legislation.gov.uk/ukpga/2006/35/section/2 http://www.legislation.gov.uk/ukpga/2006/35/section/2 It looks like all the criteria for it to be fraud are met. However, it also looks like legislation in the UK disallows (and renders void) concerted practices which may affect trade within the United Kingdom, and have as their effect the distortion of competition within the United Kingdom, applying, in particular to practices which apply dissimilar conditions to equivalent transactions with other trading parties, thereby placing them at a competitive disadvantage. See http://www.legislation.gov.uk/ukpga/1998/41/section/2 http://www.legislation.gov.uk/ukpga/1998/41/section/2 A concerted practice of charging the owners of well-known brands of smartphones less than the owners of less-known brands for an equivalent transaction would have the effect of lessening competition, because people might eschew a lesser known smartphone (increasing the barriers of entry to the smartphone market in the UK). So there appears to be a good defence that price discrimination practices like this are illegal and void, and therefore circumventing it is not fraudulent. Of course, out of an abundance of caution, I don't think it would be wise to volunteer to be a test case for this.
Jach 15y ago
If anything this just seems like a violation of Terms of Service, the harshest punishment that should be allowed is them denying him internet.

Isn't this fraud and an open admission of guilty?

Luyt 15y ago

How is changing your UserAgent string fraud?

luca-giovanni 15y ago
It isn't!
rmc 15y ago
You are implying you are something you are not.
- icebraining 15y ago
  If that was enough for fraud, our whole society would have to be jailed.
- Gravityloss 15y ago
  "You are"? It's just a browser "identification". It's widely known to be approximate, random and unreliable. It's common to try different agents because the web is full of bad pages which try to use it for something inappropriate. That's why user agent switching is a feature in all these browsers in the first place. It's like disabling CSS. Is it fraud to use a battery charger or electrical plug with an adapter? After all, the particular plug is a way of "identification", even when easily circumvented. How about using aftermarket parts for your car or camera. They are implying by their similarly spaced and shaped connections that they are genuine parts after all... What about console cartridge identification chips? These are somewhat interesting questions, if the HN crowd could have other opinions between "fraud" and "not fraud".
  - TylerE 15y ago
    A restaurant offers a 25% discount to seniors (65+), but you're only 60. You copy your friend's AARP card, changing the name, and present the cloned card to receive the discount. Is this fraud?
    - Gravityloss 15y ago
      Probably. It's interesting to think when a hack becomes a fraud or stealing.
      - mindslight 15y ago
        When they get your identifying information and feel like hassling you. The only immoral thing here is the wifi provider increasing the complexity of the transaction to extract as much money as possible. Should one be required to tell the supermarket their net worth so they can be charged "appropriately" for their food? Anonymity is the basis for a shared existence. Two parties whose sole interaction consists of sending signals back and forth certainly don't need the outside law to mediate between them - if one party finds the relationship unfavorable, simply stop talking. It's a shame that people have been so brainwashed into thinking it's their responsibility to enforce someone else's desired business rules.
        TylerE 15y ago
        I find it a bit amusing that someone on this site, where so much of the content is about optimization and business models, is acting so morally offended by the concept of price differentiation.
        mindslight 15y ago
        So many of the articles are about business model optimization because it's not the primary nature of hackers - they need to be reminded. The major difference is that the businesses here are new and the market and product are uncertain (inherently complex); Internet access, by definition, is a solved commodity.
  - rmc 15y ago
    It's common to try different agents No, it's common for highly technical web developers to do this. For 99.99% of the internet population, they do not even know what "user agent string" is or how to change it, or what to put in.

luca-giovanni 15y ago

Is it legal to charge people different rates for the same service on different devices? I would argue it certainly isn't moral. Switching user agent is perfectly legal.

mooism2 15y ago
It's legal to price discriminate based on age (discounted cinema tickets for children and pensioners), gender (free entry to certain nightclubs for women), occupation (teachers get educational discounts on some software, even when they only use it at home), not to mention the tricks aeroplane/train companies pull. So why not legal to price discriminate net access based on the device you're accessing it with?
- luca-giovanni 15y ago
  I guess it probably isn't but in any case it isn't a robust discrimination method as this guy has shown ;-)
- pbhjpbhj 15y ago
  >occupation (teachers get educational discounts on some software, even when they only use it at home) // Suppose they say "teachers" and you have a teaching license but aren't currently teaching. You present your teaching license and say "is this acceptable" and they say yes, you only need a teaching license to get the discount. That seems pretty analogous to the current situation. You possess the token they request and that they subsequently use to give you a lower price. You've not committed fraud because you're legally allowed to use that UA string. It's up to the provider to decide if their requirement is "passes us this UA string" or "declares ownership of this device" (I don't consider those things identical by a long stretch). Now if they say when you pass a particular UA string "do you confirm you're owner of $deviceType" or "this service is only for users of $deviceType" then I think things switch around in the direction of [rather minor] fraud.
- gmac 15y ago
  Actually, not all of these are legal everywhere. In the UK, price discrimination by gender (e.g. by nightclubs) is illegal: see http://www.equalityhumanrights.com/advice-and-guidance/your-rights/gender/sex-discrimination-as-a-consumer/sex-discrimination-as-a-consumer-your-rights/ http://www.equalityhumanrights.com/advice-and-guidance/your-...

MattBearman 15y ago

The wifi network never asked him what device type he was using, it just made an assumption based on something as unreliable as a user agent string. How is it fraud?

Fizzer 15y ago
He knowingly manipulated their device detection system. Yes, it's true their device detection system is trivial to manipulate, but that doesn't change the legality. If a bank forgets to lock their vault, you still wouldn't want to clean them out and admit to it on your blog.
- luca-giovanni 15y ago
  What if you just choose to change your user agent to something different because you prefer the experience? If you then get different offers as a result you can't be held liable.
  - ugh 15y ago
    It's plausible deniability, nothing more. Illegal stays illegal.
    - ktizo 15y ago
      If there were an expensive nightclub which had a cheaper bar round the corner that only admitted people with the first name of "Dan", who then get full access to the nightclub and cheaper drinks all night, would it be criminal fraud to lie about your name to the doorstaff?
      - no-downloads 15y ago
        As someone named Dan I feel compelled to point out that such policies are really good and absolutely fair :-)
  - function_seven 15y ago

wladimir 15y ago

There is no law that you have to send any user agent at all, or indeed a valid one that matches your device/browser. It is just a hint for the server. Edit: and IMO, it's toxic to the hacker spirit to be too quick in condemning ideas as illegal or immoral

deleted 15y ago
[deleted]

A1kmm 15y ago

Disclaimer: IANAL, this is not legal advice. The article mentions it is in the UK. Relevant fraud statute appears to be this: http://www.legislation.gov.uk/ukpga/2006/35/section/2 http://www.legislation.gov.uk/ukpga/2006/35/section/2 It looks like all the criteria for it to be fraud are met. However, it also looks like legislation in the UK disallows (and renders void) concerted practices which may affect trade within the United Kingdom, and have as their effect the distortion of competition within the United Kingdom, applying, in particular to practices which apply dissimilar conditions to equivalent transactions with other trading parties, thereby placing them at a competitive disadvantage. See http://www.legislation.gov.uk/ukpga/1998/41/section/2 http://www.legislation.gov.uk/ukpga/1998/41/section/2 A concerted practice of charging the owners of well-known brands of smartphones less than the owners of less-known brands for an equivalent transaction would have the effect of lessening competition, because people might eschew a lesser known smartphone (increasing the barriers of entry to the smartphone market in the UK). So there appears to be a good defence that price discrimination practices like this are illegal and void, and therefore circumventing it is not fraudulent. Of course, out of an abundance of caution, I don't think it would be wise to volunteer to be a test case for this.

Jach 15y ago

If anything this just seems like a violation of Terms of Service, the harshest punishment that should be allowed is them denying him internet.