4 ms·

This is an old, old interpretation, and it is correct. You can't base law on a sliding scale like entropy. The value of the password is symbolic, not that it's

This is an old, old interpretation, and it is correct. You can't base law on a sliding scale like entropy. The value of the password is symbolic, not that it's easy or difficult - anything beyond a password is clearly private. I don't love metaphors very much, but doing anything other than that opens the door to absurd defenses like "your honor, he left his wallet on the table when he went to the bathroom, it's obvious anybody can legally pick it up". Not to mention a cop favorite which is unfortunately in use: if you dare report a robbery, they'll fine you for not having your security system up to date. Yes, it's a thing. Does wonders for their closure rates. It's not the height of the fence that makes it theft - it's that there is a fence at all.

milesskorpen 3y ago
If you hire someone to store your valuables, walk over to visit them, and see a closed door, I don't think it is unreasonable to try the door knob to check if it's locked or even give the door a good push to see if it feels solid. And if the door swings open, it's further not unreadable to poke your head in to see if your valuables are secured inside.
- radu_floricica 3y ago
  1. He was not hired by them, but by a third party. Otherwise it would have been breach of contract, not unauthorized access. 2. There's a big difference between the door of a room once you're inside the house, and the front door. No, it's not ok to just open front doors to take a look around. 3. The valuables in this case are information. "Taking a look" is all you can do.
  - BobaFloutist 3y ago
    No no, he wasn't hired by them, they were hired by him (or, rather, his org). His org had keys to the front door. His team had reported that their designated closet seemed to have a bunch of other people's stuff in it. He walked in, and instead of walls, the closet had curtains. He stuck his head through the curtain and saw other people's shit, then pulled his head out and reported it. Then he got fined.
    - radu_floricica 3y ago
      This is why I don't like metaphors :)) In any case, password or not is not the problem. EU law actually has protections for white hat hackers, even when they actually hack. I do have a friend who does this regularly, he's been in the press, he's been sued, he knows the drill. There are a number of steps to follow, and a 3-day wait period is patently absurd. A proper process looks absolutely nothing like this. Amongst other things, my friend is actually contacting the authorities before even considering public disclosure. The point of a white hat hacker is to help, not to make things worse.
ColoursofOSINT 3y ago
"You can't base law on a sliding scale like entropy." I would disagree. Courts decide on the sliding scale. I am no lawyer, but in Canada and the USA you have a "A Reasonable Expectation of Privacy" [1]. For example, see thermal imaging use by police[2]. [1]: https://www.cwilson.com/a-reasonable-expectation-of-privacy/ https://www.cwilson.com/a-reasonable-expectation-of-privacy/ [2]:https://en.wikipedia.org/wiki/Kyllo_v._United_States https://en.wikipedia.org/wiki/Kyllo_v._United_States
- radu_floricica 3y ago
  First link is actually extending privacy outside the house. So it's very much not making fences fuzzy. The second link is basically about the wavelength you use when looking at the outside of the house. Not surprisingly, it doesn't matter. This is common sense, not a revelation. A challenge to my comment would be if a house had a picket fence, somebody came by and took a hoe from the yard, and a judge said "nah, it's not theft, the fence was too low, all he had to do was reach out and take it". That would be a proper counter-argument.
  - ColoursofOSINT 3y ago
    What an interesting response. You say essentially state that my information is not a “proper counter-argument.”, while in the same response argue that I am wrong because this is “this is common sense”, rather than any real response. The court recognized there was a fence for privacy, but that is was applicable to certain situations, for example, the purpose of the recording. So it would be fine to record someone if they were in the background of your picture, but not if was for sexual purposes. Hence the numerous criteria to be considered. So its very much about making fences fuzzy, since they only apply to certain types of filming, the purpose, personal attributes....etc. Thermal imaging and its effects on the fourth are not common sense. Thermal imaging was initially ruled to be fine, then appealed, ruled fine, then it ruled to not be fine, but only with a 5 - 4 ruling. With the dissenting opinion including “Heat waves, like aromas that are generated in a kitchen, or in a laboratory or opium den, enter the public domain if and when they leave a building.” All you would have to do is read the Wikipedia article I gave to see that “Scalia's phrases "sense-enhancing technology" and "device that is not in general public use" in the Kyllo ruling have become influential in later rulings on police search procedures, but in an inconsistent fashion.[22] Several scholars and legal analysts noted the ambiguity in Scalia's use of those phrases. To use your example, a police officer could “reach over” and see the illegal activity with his own eyes through a hole in your fence and that is legal. However, they could not use binoculars to get over your fence from a public area. https://www.ojp.gov/ncjrs/virtual-library/abstracts/telescopes-binoculars-and-fourth-amendment https://www.ojp.gov/ncjrs/virtual-library/abstracts/telescop...
danpalmer 3y ago
I see your point, but I think maybe I didn't make my point very well. To follow your fence analogy, they've ruled that any fence is important, but ignored brick walls and rope tied between posts – i.e. they've picked something overly specific, but poorly fit to the behaviour they are actually trying to classify. While I'm sure that ruling against fences doesn't rule out a future ruling against walls or ropes, it probably complicates getting those rulings in the future, as one could use a defence of "if they wanted to protect it they should have built a fence" to imply security.
- radu_floricica 3y ago
  An edge case would be a hidden URL. Publicly accessible, but not publicly available. That's more or less the same as a rope tied between posts, with the posts maybe felled by the wind. It's a good argument that it's a misunderstanding whether it's private property or not. A password is not that. (and to be frank, to anybody in the know even a passwordless phpmyadmin is clearly private)
  - TheNewsIsHere 3y ago
    I assume that this situation is why government systems will often have a notice that says something like “absence of access controls is not authorization for access.”

milesskorpen 3y ago

If you hire someone to store your valuables, walk over to visit them, and see a closed door, I don't think it is unreasonable to try the door knob to check if it's locked or even give the door a good push to see if it feels solid. And if the door swings open, it's further not unreadable to poke your head in to see if your valuables are secured inside.

radu_floricica 3y ago
1. He was not hired by them, but by a third party. Otherwise it would have been breach of contract, not unauthorized access. 2. There's a big difference between the door of a room once you're inside the house, and the front door. No, it's not ok to just open front doors to take a look around. 3. The valuables in this case are information. "Taking a look" is all you can do.
- BobaFloutist 3y ago
  No no, he wasn't hired by them, they were hired by him (or, rather, his org). His org had keys to the front door. His team had reported that their designated closet seemed to have a bunch of other people's stuff in it. He walked in, and instead of walls, the closet had curtains. He stuck his head through the curtain and saw other people's shit, then pulled his head out and reported it. Then he got fined.
  - radu_floricica 3y ago
    This is why I don't like metaphors :)) In any case, password or not is not the problem. EU law actually has protections for white hat hackers, even when they actually hack. I do have a friend who does this regularly, he's been in the press, he's been sued, he knows the drill. There are a number of steps to follow, and a 3-day wait period is patently absurd. A proper process looks absolutely nothing like this. Amongst other things, my friend is actually contacting the authorities before even considering public disclosure. The point of a white hat hacker is to help, not to make things worse.

ColoursofOSINT 3y ago

"You can't base law on a sliding scale like entropy." I would disagree. Courts decide on the sliding scale. I am no lawyer, but in Canada and the USA you have a "A Reasonable Expectation of Privacy" [1]. For example, see thermal imaging use by police[2]. [1]: https://www.cwilson.com/a-reasonable-expectation-of-privacy/ https://www.cwilson.com/a-reasonable-expectation-of-privacy/ [2]:https://en.wikipedia.org/wiki/Kyllo_v._United_States https://en.wikipedia.org/wiki/Kyllo_v._United_States

radu_floricica 3y ago
First link is actually extending privacy outside the house. So it's very much not making fences fuzzy. The second link is basically about the wavelength you use when looking at the outside of the house. Not surprisingly, it doesn't matter. This is common sense, not a revelation. A challenge to my comment would be if a house had a picket fence, somebody came by and took a hoe from the yard, and a judge said "nah, it's not theft, the fence was too low, all he had to do was reach out and take it". That would be a proper counter-argument.
- ColoursofOSINT 3y ago
  What an interesting response. You say essentially state that my information is not a “proper counter-argument.”, while in the same response argue that I am wrong because this is “this is common sense”, rather than any real response. The court recognized there was a fence for privacy, but that is was applicable to certain situations, for example, the purpose of the recording. So it would be fine to record someone if they were in the background of your picture, but not if was for sexual purposes. Hence the numerous criteria to be considered. So its very much about making fences fuzzy, since they only apply to certain types of filming, the purpose, personal attributes....etc. Thermal imaging and its effects on the fourth are not common sense. Thermal imaging was initially ruled to be fine, then appealed, ruled fine, then it ruled to not be fine, but only with a 5 - 4 ruling. With the dissenting opinion including “Heat waves, like aromas that are generated in a kitchen, or in a laboratory or opium den, enter the public domain if and when they leave a building.” All you would have to do is read the Wikipedia article I gave to see that “Scalia's phrases "sense-enhancing technology" and "device that is not in general public use" in the Kyllo ruling have become influential in later rulings on police search procedures, but in an inconsistent fashion.[22] Several scholars and legal analysts noted the ambiguity in Scalia's use of those phrases. To use your example, a police officer could “reach over” and see the illegal activity with his own eyes through a hole in your fence and that is legal. However, they could not use binoculars to get over your fence from a public area. https://www.ojp.gov/ncjrs/virtual-library/abstracts/telescopes-binoculars-and-fourth-amendment https://www.ojp.gov/ncjrs/virtual-library/abstracts/telescop...

danpalmer 3y ago

I see your point, but I think maybe I didn't make my point very well. To follow your fence analogy, they've ruled that any fence is important, but ignored brick walls and rope tied between posts – i.e. they've picked something overly specific, but poorly fit to the behaviour they are actually trying to classify. While I'm sure that ruling against fences doesn't rule out a future ruling against walls or ropes, it probably complicates getting those rulings in the future, as one could use a defence of "if they wanted to protect it they should have built a fence" to imply security.

radu_floricica 3y ago
An edge case would be a hidden URL. Publicly accessible, but not publicly available. That's more or less the same as a rope tied between posts, with the posts maybe felled by the wind. It's a good argument that it's a misunderstanding whether it's private property or not. A password is not that. (and to be frank, to anybody in the know even a passwordless phpmyadmin is clearly private)
- TheNewsIsHere 3y ago
  I assume that this situation is why government systems will often have a notice that says something like “absence of access controls is not authorization for access.”