8 ms·

I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly con

I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscriber data just sitting there on an unlisted webpage. Don't remember which way it went, but I think the guy went out of his way there to get all the data he could get, which isn't the case here.

xeromal 3y ago
What's with the _ in your sentences?
- oidar 3y ago
  Not the GP, but that is a common way of bolding words between the underscores in markdown syntax.
- jjtheblunt 3y ago
  i think it's supposed to look like start and stop of underlines.
- wpietri 3y ago
  They represent underlining.
- deleted 3y ago
  [deleted]
- rictic 3y ago
  Ascii convention to emphasize text, similar to doing the same thing with asterisks. Markdown later used this syntax for italics and bold, which popularized it further.
dahfizz 3y ago
IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security measures" is not a valid defense. These researchers were not authorized to access this computer, regardless of whether they were technically able to obtain access. Leaving your door unlocked does not give burglars permission to burgle you. [1] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
- jrockway 3y ago
  That's my understanding of the law. Even the "merge this PR without review using your administrator privileges" is potentially a crime if the company policy doesn't allow you to take that action. Basically, what the code does or intends is not a factor at all, only the potentially-implicit authorization policy controls. If I tell you "the password on the postgres account at postgres.jrock.us is blahblah42" and you read the database, it could be argued that you're exceeding your authorized access. The reason people don't tell you their database password on Hacker News is because of countries that don't have that law, I assume.
  - yebyen 3y ago
    > The reason people don't tell you their database password on Hacker News is because of countries that don't have that law, I assume. That's silly, the reason people protect themselves is so that they are protected. Legal protection is another different kind of protection, but I think it's a deep stretch to argue that one can remove all the technical protections and still keep access to the CFAA and obtain meaningful protection from the law. > protected computer If you're suggesting that the CFAA itself protects the computer by definition, then you've excluded the possibility of a such thing as an "unprotected computer" which renders the extra word unnecessary. I don't think that's the intention, that all computers gain the implicit protection, I think there actually needs to be a policy or standard enforced, or ownership made clear. In the tradition of US property law, I think you need to do the bare minimum of posting "NO TRESPASSING" signs at the border so anyone that walks by them can be said to have observed the difference between your space and the public spaces surrounding it (which they are permitted to be in, just like your private property so long as it's unprotected and they haven't been asked to leave before...)
dgunay 3y ago
Not a lawyer ofc, but I would not expect that line of reasoning to hold up in court as I wouldn't expect "the door was unlocked, your honor" to excuse trespassing.
- darkarmani 3y ago
  So every URL is a trespass unless you have explicit permission? If you say the protocol determines authorization, then the Fizz protocol granted them authorization. I don't have a clear answer here because it is messy.
  - tptacek 3y ago
    It depends on how you uncovered the URL and what's behind it: your intent, which is most of what matters here.
  - dahfizz 3y ago
    Its not all or nothing. The law is literally decided on a case by case basis. Going to the home page of a public website is clearly authorized access. Creating admin users for yourself on someone else's server without permission is clearly unauthorized access. Any judge or jury would agree.
- deleted 3y ago
  [deleted]
tptacek 3y ago
It reminds me of the case where AT&T had their iPad data subscriber data just sitting there on an unlisted webpage. Don't remember which way it went He ended up in prison. (The conviction was later overturned on a jurisdictional detail, but I think he spent several months in federal prison.)
cryptonector 3y ago
That's not how CFAA works. Under CFAA if there was anything to indicate that permission is required to access the system, then that's enough even if no actual security features were implemented.

xeromal 3y ago

What's with the _ in your sentences?

oidar 3y ago
Not the GP, but that is a common way of bolding words between the underscores in markdown syntax.
jjtheblunt 3y ago
i think it's supposed to look like start and stop of underlines.
wpietri 3y ago
They represent underlining.
deleted 3y ago
[deleted]
rictic 3y ago
Ascii convention to emphasize text, similar to doing the same thing with asterisks. Markdown later used this syntax for italics and bold, which popularized it further.

dahfizz 3y ago

IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security measures" is not a valid defense. These researchers were not authorized to access this computer, regardless of whether they were technically able to obtain access. Leaving your door unlocked does not give burglars permission to burgle you. [1] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030

jrockway 3y ago
That's my understanding of the law. Even the "merge this PR without review using your administrator privileges" is potentially a crime if the company policy doesn't allow you to take that action. Basically, what the code does or intends is not a factor at all, only the potentially-implicit authorization policy controls. If I tell you "the password on the postgres account at postgres.jrock.us is blahblah42" and you read the database, it could be argued that you're exceeding your authorized access. The reason people don't tell you their database password on Hacker News is because of countries that don't have that law, I assume.
- yebyen 3y ago
  > The reason people don't tell you their database password on Hacker News is because of countries that don't have that law, I assume. That's silly, the reason people protect themselves is so that they are protected. Legal protection is another different kind of protection, but I think it's a deep stretch to argue that one can remove all the technical protections and still keep access to the CFAA and obtain meaningful protection from the law. > protected computer If you're suggesting that the CFAA itself protects the computer by definition, then you've excluded the possibility of a such thing as an "unprotected computer" which renders the extra word unnecessary. I don't think that's the intention, that all computers gain the implicit protection, I think there actually needs to be a policy or standard enforced, or ownership made clear. In the tradition of US property law, I think you need to do the bare minimum of posting "NO TRESPASSING" signs at the border so anyone that walks by them can be said to have observed the difference between your space and the public spaces surrounding it (which they are permitted to be in, just like your private property so long as it's unprotected and they haven't been asked to leave before...)

dgunay 3y ago

Not a lawyer ofc, but I would not expect that line of reasoning to hold up in court as I wouldn't expect "the door was unlocked, your honor" to excuse trespassing.

darkarmani 3y ago
So every URL is a trespass unless you have explicit permission? If you say the protocol determines authorization, then the Fizz protocol granted them authorization. I don't have a clear answer here because it is messy.
- tptacek 3y ago
  It depends on how you uncovered the URL and what's behind it: your intent, which is most of what matters here.
- dahfizz 3y ago
  Its not all or nothing. The law is literally decided on a case by case basis. Going to the home page of a public website is clearly authorized access. Creating admin users for yourself on someone else's server without permission is clearly unauthorized access. Any judge or jury would agree.
deleted 3y ago
[deleted]

tptacek 3y ago

It reminds me of the case where AT&T had their iPad data subscriber data just sitting there on an unlisted webpage. Don't remember which way it went He ended up in prison. (The conviction was later overturned on a jurisdictional detail, but I think he spent several months in federal prison.)

cryptonector 3y ago

That's not how CFAA works. Under CFAA if there was anything to indicate that permission is required to access the system, then that's enough even if no actual security features were implemented.