4 ms·

Isn't logging into any system unauthorized - in practice - a violation of the Computer Fraud & Abuse Act?

roguecoder 2y ago
The EFF has a good guide about the relevant laws: https://clinic.cyber.harvard.edu/wp-content/uploads/2020/10/Security_Researchers_Guide-2.pdf https://clinic.cyber.harvard.edu/wp-content/uploads/2020/10/...
- Validark 2y ago
  Such ridiculous laws. The real crime here is that the software vendor lets people use the software without creating a new password. Even that is suspect, since I bet most people's password would be 1234 anyway. So really they should force people to set up passkeys to access the system. Or, cut out the setup, and just send them a couple of USB's which allow them to access the system. This "manufacturer" is not doing its due diligence in any way, shape, or form. They are the ones who should face jail time for not implementing bare minimum security practices. The idea that the guy revealing a complete lack of security is committing a crime is like saying a guy informing someone that they're naked is guilty of forcibly stripping that person. Or that telling someone there's a giant red button that drains the landlord's bank account is guilty of pressing it. Maybe they should remove the giant red button?! Or at least put it in a locked room?
  - kube-system 2y ago
    It might be harsh, but the general premise is good that we should not blame the victims of unauthorized access to computer systems. We should also, as you point out, require vendors to implement minimum security standards.
mihaaly 2y ago
It is, like getting into a home with open doors without the consent of the inhabitants. Which is keeping away only the honest and polite persons.
- kube-system 2y ago
  These pages weren't wide open, they had weak and ineffective authentication. If you bypass a very shitty lock on a house, you've likely committed a crime.
  - mihaaly 2y ago
    "Key under the mat" sign for you then. Same thing.
ChoGGi 2y ago
Not in Canada. Bring that the article mentioned Vancouver. For us it'd be Section 342.1/2 of the CCC.

The EFF has a good guide about the relevant laws: https://clinic.cyber.harvard.edu/wp-content/uploads/2020/10/Security_Researchers_Guide-2.pdf https://clinic.cyber.harvard.edu/wp-content/uploads/2020/10/...

Validark 2y ago
Such ridiculous laws. The real crime here is that the software vendor lets people use the software without creating a new password. Even that is suspect, since I bet most people's password would be 1234 anyway. So really they should force people to set up passkeys to access the system. Or, cut out the setup, and just send them a couple of USB's which allow them to access the system. This "manufacturer" is not doing its due diligence in any way, shape, or form. They are the ones who should face jail time for not implementing bare minimum security practices. The idea that the guy revealing a complete lack of security is committing a crime is like saying a guy informing someone that they're naked is guilty of forcibly stripping that person. Or that telling someone there's a giant red button that drains the landlord's bank account is guilty of pressing it. Maybe they should remove the giant red button?! Or at least put it in a locked room?
- kube-system 2y ago
  It might be harsh, but the general premise is good that we should not blame the victims of unauthorized access to computer systems. We should also, as you point out, require vendors to implement minimum security standards.

mihaaly 2y ago

It is, like getting into a home with open doors without the consent of the inhabitants. Which is keeping away only the honest and polite persons.

kube-system 2y ago
These pages weren't wide open, they had weak and ineffective authentication. If you bypass a very shitty lock on a house, you've likely committed a crime.
- mihaaly 2y ago
  "Key under the mat" sign for you then. Same thing.

ChoGGi 2y ago

Not in Canada. Bring that the article mentioned Vancouver. For us it'd be Section 342.1/2 of the CCC.