3 ms·

It doesn't matter what he thought was in the database or what it was for. He knew it was hosted and provided by a third party for use with that third party's so

by hnbad 3y ago

It doesn't matter what he thought was in the database or what it was for. He knew it was hosted and provided by a third party for use with that third party's software which his client was using. His crime wasn't accessing the data. His crime was accessing the data in a way he had not been authorized to do. As far as he was concerned, the investigation should have stopped at "there are hardcoded plaintext credentials here". But not only did he then also try if those credentials were correct, he also used those credentials to go spelunking. That's trespass even if he had reason to believe there were no other customers' data on that server.

qwertox 3y ago
Was the client not authorized to access their data with the use of the password, which the application managed for them? The password should have been a per-client password intended to protect the client's data from any foreign access, a key given from the service provider to the client in form of an easily usable application in order for the client to make use of the service.
- hnbad 3y ago
  > The password should have been a per-client password intended to protect the client's data from any foreign access, a key given from the service provider to the client in form of an easily usable application in order for the client to make use of the service. What should have been is irrelevant to the discussion. Yes, the security practices by the vendor were abhorrent and this jeopardized their customers' users privacy and they should be fined by the data protection agency for that. But that has no impact on what the contractor did. > Was the client not authorized to access their data with the use of the password, which the application managed for them? The client was authorized to use the software which accessed the data using the password. The client was clearly not authorized to extract the password, use it to connect to the database manually or through their own software and go spelunking. How could you possibly think that was authorized? Implicit authorization can always only be interpreted in the most limited way. It doesn't matter what he expected to find, it only matters HOW he accessed it. That's just how laws work.

by hnbad 3y ago

qwertox 3y ago

Was the client not authorized to access their data with the use of the password, which the application managed for them? The password should have been a per-client password intended to protect the client's data from any foreign access, a key given from the service provider to the client in form of an easily usable application in order for the client to make use of the service.

hnbad 3y ago
> The password should have been a per-client password intended to protect the client's data from any foreign access, a key given from the service provider to the client in form of an easily usable application in order for the client to make use of the service. What should have been is irrelevant to the discussion. Yes, the security practices by the vendor were abhorrent and this jeopardized their customers' users privacy and they should be fined by the data protection agency for that. But that has no impact on what the contractor did. > Was the client not authorized to access their data with the use of the password, which the application managed for them? The client was authorized to use the software which accessed the data using the password. The client was clearly not authorized to extract the password, use it to connect to the database manually or through their own software and go spelunking. How could you possibly think that was authorized? Implicit authorization can always only be interpreted in the most limited way. It doesn't matter what he expected to find, it only matters HOW he accessed it. That's just how laws work.