3 ms·

Finding a key on the floor and then using that key to break into a building is illegal, and for good reason.

judge2020 3y ago
It's more like you're given a keycard to a building that says "Floor 20" but then find out it has access to all the floors and telling the building security about it. All they did was 'open' the 'elevator door' here revealing the access they mistakenly had. It doesn't sound like they snooped through other customers' data or downloaded anything.
- User3456335 3y ago
  You're not really given it though. You found it and even though nobody ever asked you to use the key card you used it on the floor that nobody ever asked you to go to.
  - hooverd 3y ago
    They weren't not allowed either, though.
  - feanaro 3y ago
    Your machine regularly uses that key to access what's behind the door on your behalf; there is no reason you shouldn't be able to access it yourself. If you don't find the key and realise it's actually a lost one, leading to a potentially dangerous place, someone else will and they won't be benevolent.
Almondsetat 3y ago
If you don't know what the key does who are you reporting it to?
- contravariant 3y ago
  If that's unclear the answer is simple, destroy the key. Otherwise you can try to be a good neighbour and let them know. You do not get to just open random doors and see what's going on. The real issue here is whether this instance is comparable, not whether opening doors with lost and found keys is a bad thing. The real difference is whether they 'found' the key or if they were handed it. In this case I'd argue they were handed the key, as there was no plausible protection mechanism preventing them from accessing the key. It wasn't lying around somewhere forgotten or secret, it was in plain sight. And frankly we need some good Samaritan laws for cases where someone responsibly disclose a vulnerability without doing further harm, even if what they did was illegal on its own it certainly should not be in light of the fact that they responsibly disclosed the vulnerability.
  - feanaro 3y ago
    It's not a "lost" key if it's found hardcoded in an easily available place (e.g. an application). It's a negligently placed key leading to a vulnerable place that is going to get into the hands of a malicious person.
adrr 3y ago
Its not finding a random key on the floor unless the key was in his house sending data back to a 3rd party server. Closest paradigm using technology terms is finding an S3 key in a 3rd party library and then browsing the the S3 bucket to see whats in it. Authorization was granted by providing the developer the library, they literally sent him a username and password. If the code was unique to each client would the person been charged?
fn-mote 3y ago
US law: > If you did not have permission to enter [...] the likely charge is a misdemeanor charge of illegal entry (also known as entry without permission). [1] https://www.avvo.com/legal-answers/is-it-breaking-and-entering-if-you-have-a-key-and--776901.html#qa-answer-count-header https://www.avvo.com/legal-answers/is-it-breaking-and-enteri...
- axus 3y ago
  Yep, what the guy did here seems at worst a misdemeanor, and only because a company's feelings were hurt. The vendor brought charges against an employee of their customer, someone who was paying to use their product.

judge2020 3y ago

It's more like you're given a keycard to a building that says "Floor 20" but then find out it has access to all the floors and telling the building security about it. All they did was 'open' the 'elevator door' here revealing the access they mistakenly had. It doesn't sound like they snooped through other customers' data or downloaded anything.

User3456335 3y ago
You're not really given it though. You found it and even though nobody ever asked you to use the key card you used it on the floor that nobody ever asked you to go to.
- hooverd 3y ago
  They weren't not allowed either, though.
- feanaro 3y ago
  Your machine regularly uses that key to access what's behind the door on your behalf; there is no reason you shouldn't be able to access it yourself. If you don't find the key and realise it's actually a lost one, leading to a potentially dangerous place, someone else will and they won't be benevolent.

Almondsetat 3y ago

If you don't know what the key does who are you reporting it to?

contravariant 3y ago
If that's unclear the answer is simple, destroy the key. Otherwise you can try to be a good neighbour and let them know. You do not get to just open random doors and see what's going on. The real issue here is whether this instance is comparable, not whether opening doors with lost and found keys is a bad thing. The real difference is whether they 'found' the key or if they were handed it. In this case I'd argue they were handed the key, as there was no plausible protection mechanism preventing them from accessing the key. It wasn't lying around somewhere forgotten or secret, it was in plain sight. And frankly we need some good Samaritan laws for cases where someone responsibly disclose a vulnerability without doing further harm, even if what they did was illegal on its own it certainly should not be in light of the fact that they responsibly disclosed the vulnerability.
- feanaro 3y ago
  It's not a "lost" key if it's found hardcoded in an easily available place (e.g. an application). It's a negligently placed key leading to a vulnerable place that is going to get into the hands of a malicious person.

adrr 3y ago

Its not finding a random key on the floor unless the key was in his house sending data back to a 3rd party server. Closest paradigm using technology terms is finding an S3 key in a 3rd party library and then browsing the the S3 bucket to see whats in it. Authorization was granted by providing the developer the library, they literally sent him a username and password. If the code was unique to each client would the person been charged?

fn-mote 3y ago

US law: > If you did not have permission to enter [...] the likely charge is a misdemeanor charge of illegal entry (also known as entry without permission). [1] https://www.avvo.com/legal-answers/is-it-breaking-and-entering-if-you-have-a-key-and--776901.html#qa-answer-count-header https://www.avvo.com/legal-answers/is-it-breaking-and-enteri...

axus 3y ago
Yep, what the guy did here seems at worst a misdemeanor, and only because a company's feelings were hurt. The vendor brought charges against an employee of their customer, someone who was paying to use their product.