5 ms·

I really doubt modifying a GET URL would be considered criminal in any court. It's far too easily accessible to everyone. It's two physical actions, a click and

I really doubt modifying a GET URL would be considered criminal in any court. It's far too easily accessible to everyone. It's two physical actions, a click and a keypress.

tptacek 14y ago
I'm pretty sure you're wrong. Ease has absolutely nothing to do with the statute. If a reasonable person could be expected to know that the pages they were accessing were unauthorized (or more precisely if a prosecutor or plaintiff's counsel could make a convincing argument), that's the ball game. This is a very common misconception among tech people about how the CFAA works.
- chc 14y ago
  I think they could make a reasonable argument that they didn't know they would just be given the documents upon request if they weren't authorized. If I ask you for a hundred dollars and you give it to me with no force or trickery, that is not theft, because your giving it to me implies consent. That's where I see ease of access coming into it: If you really don't take any effort to keep me out of something (even as little as telling me "stay out"), how do I distinguish that unauthorized content from content I'm authorized to access — and not only that, but make the distinction before I access it?
  - tptacek 14y ago
    Do I think you'd be convicted for manipulating URLs idly to prove a point? No. Do I think you'd be convicted for manipulating URLs and grabbing their entire database? Very possibly. Do I think you could incur five figures of legal headache in either scenario? Yes, I think you could, depending on how savvy the "victim" is and how close to "fight or flight" you push them.
- danso 14y ago
  Yes, but that's with many, many laws, right? It depends on the prosecutor, defense, and jury. The way it's been described so far, the reporter thought he had found an undocumented API...which, totally speaking out of guesswork here, could be as simple as seeing the json file being passed through the web inspector, seeing that there's an id field, and then iterating across it. The person has no expectation that when the id is of a private object, that the service would actually return that data.
  - tptacek 14y ago
    As with most (but not all) criminal statutes, the intent matters. If you can clearly demonstrate that you had no intention of actually accessing information you weren't authorized to see, and, better yet, that you didn't set out with an express purpose of abusing someone else's application in order to gin up the material for a for-profit news story, you'll almost certainly end up OK... if by "end up OK" you mean "excruciating legal drama that concludes in your favor". Let me be clear: I don't think Kickstarter is going to go after the WSJ, or even that most companies would raise a huge stink about this.
- mparlane 14y ago
  To be honest, if I changed an ID on a URL, I expect it to say "not found" or "not authorised" if I am not allowed to see it. If it doesn't say such things, than I can expect that it is ok to view. That is what I have come to expect of such web pages.
  - tptacek 14y ago
    Good luck.
    - mparlane 14y ago
      So if I made a website called http://thisisstep1.com/ http://thisisstep1.com/ And it said "Coming soon." And someone found out they can goto http://thisisstep2.com/ http://thisisstep2.com/. Should I be able to say "But.. you aren't meant to go there!" ? At what point does your legal boundary lie for what is considered a public webpage and what is considered "not authorised."
      - statictype 14y ago
        What matters is intent. Did you intend to go there with the purpose of violating some agreement? Or did you stumble there by accident. I think that makes a difference.

I really doubt modifying a GET URL would be considered criminal in any court. It's far too easily accessible to everyone. It's two physical actions, a click and a keypress.

tptacek 14y ago

I'm pretty sure you're wrong. Ease has absolutely nothing to do with the statute. If a reasonable person could be expected to know that the pages they were accessing were unauthorized (or more precisely if a prosecutor or plaintiff's counsel could make a convincing argument), that's the ball game. This is a very common misconception among tech people about how the CFAA works.

chc 14y ago
I think they could make a reasonable argument that they didn't know they would just be given the documents upon request if they weren't authorized. If I ask you for a hundred dollars and you give it to me with no force or trickery, that is not theft, because your giving it to me implies consent. That's where I see ease of access coming into it: If you really don't take any effort to keep me out of something (even as little as telling me "stay out"), how do I distinguish that unauthorized content from content I'm authorized to access — and not only that, but make the distinction before I access it?
- tptacek 14y ago
  Do I think you'd be convicted for manipulating URLs idly to prove a point? No. Do I think you'd be convicted for manipulating URLs and grabbing their entire database? Very possibly. Do I think you could incur five figures of legal headache in either scenario? Yes, I think you could, depending on how savvy the "victim" is and how close to "fight or flight" you push them.
danso 14y ago
Yes, but that's with many, many laws, right? It depends on the prosecutor, defense, and jury. The way it's been described so far, the reporter thought he had found an undocumented API...which, totally speaking out of guesswork here, could be as simple as seeing the json file being passed through the web inspector, seeing that there's an id field, and then iterating across it. The person has no expectation that when the id is of a private object, that the service would actually return that data.
- tptacek 14y ago
  As with most (but not all) criminal statutes, the intent matters. If you can clearly demonstrate that you had no intention of actually accessing information you weren't authorized to see, and, better yet, that you didn't set out with an express purpose of abusing someone else's application in order to gin up the material for a for-profit news story, you'll almost certainly end up OK... if by "end up OK" you mean "excruciating legal drama that concludes in your favor". Let me be clear: I don't think Kickstarter is going to go after the WSJ, or even that most companies would raise a huge stink about this.
mparlane 14y ago
To be honest, if I changed an ID on a URL, I expect it to say "not found" or "not authorised" if I am not allowed to see it. If it doesn't say such things, than I can expect that it is ok to view. That is what I have come to expect of such web pages.
- tptacek 14y ago
  Good luck.
  - mparlane 14y ago
    So if I made a website called http://thisisstep1.com/ http://thisisstep1.com/ And it said "Coming soon." And someone found out they can goto http://thisisstep2.com/ http://thisisstep2.com/. Should I be able to say "But.. you aren't meant to go there!" ? At what point does your legal boundary lie for what is considered a public webpage and what is considered "not authorised."
    - statictype 14y ago
      What matters is intent. Did you intend to go there with the purpose of violating some agreement? Or did you stumble there by accident. I think that makes a difference.