3 ms·

You think criminalizing guessing URLs is unreasonable. What about guessing passwords? Should someone be prosecuted for just trying to bruteforce them until one

by vkou 11mo ago

You think criminalizing guessing URLs is unreasonable. What about guessing passwords? Should someone be prosecuted for just trying to bruteforce them until one works?

nkrisc 11mo ago
How do I know which URLs of a website are legal to visit and which are illegal?
- vkou 11mo ago
  I can't say I've ever struggled to make this determination, but I don't make a habit of trying random ports, endpoints, car doors, or brute-force guessing URLs.
  - sayamqazi 11mo ago
    But it was very tempting when i saw that my national exam results were sent to us in a mail as nationalexam.com/results/2024/my-roll-number. Why would i not try different values in the last part.
    - monerozcash 11mo ago
      Try it once to see if it works, you'll probably be fine. Find out that it works, and then proceed to look up various other people? Whether you're fine depends entirely on whether or not you genuinely believe that you're supposed to be accessing that stuff.
wakawaka28 11mo ago
Passwords are different from URLs because URLs are basically public, whereas passwords aren't supposed to be. Furthermore, this is not 1995. Everyone who is in the industry providing IT services is supposed to know that basic security measures are necessary. The physical analogy would be, walking through an unlocked and unmarked door that faces the street in a busy city, versus picking a lock on that door and then walking through it.
- vkou 11mo ago
  > Everyone who is in the industry providing IT services is supposed to know that basic security measures are necessary. And everyone who doesn't have wool for brains knows to not carry large rolls of cash around in a bad part of town, but we can still hold the mugger at fault.
  - wakawaka28 11mo ago
    Nevertheless, URLs are as public as door knobs. If someone is merely observing that a door is unlocked and they have not stolen anything, they have done nothing wrong. People being prosecuted over discovery and disclosure of horrible design flaws based on URLs should never be prosecuted. If they use the information to actually cause damage, we can be in agreement that they are responsible for the damage.
    - monerozcash 11mo ago
      >People being prosecuted over discovery and disclosure of horrible design flaws based on URLs should never be prosecuted. If they use the information to actually cause damage, we can be in agreement that they are responsible for the damage. That's literally the current state of things.
      - wakawaka28 11mo ago
        Are you sure? I seem to remember people getting burned for publicly disclosing security vulnerabilities after stubborn agencies refused to fix them for years. Stuff like, exposing thousands of SSNs through a public gateway... We are literally having this discussion on URLs because of famous cases where people DID face unfair treatment. I don't recall any actual fix for this legal chicanery either. If you do, I would be very interested.
        monerozcash 11mo ago
        > I seem to remember people getting burned for publicly disclosing security vulnerabilities after stubborn agencies refused to fix them for years. Stuff like, exposing thousands of SSNs through a public gateway.. This has never happened in the US on the federal level. Unless your definition of "getting burned" is a nasty email from a clueless non-LE government worker. > We are literally having this discussion on URLs because of famous cases where people DID face unfair treatment I don't think any reasonable person can read through the court filings in those (Auerheimer, Swartz) cases and agree with the claim that there was unfair treatment wrt the application of the CFAA, or that the CFAA was unfair because it covers those cases. I totally understand how someone who has not spent time familiarizing themselves with the actual details of the cases might be under the opposite impression; they are frequently misrepresented by people with agendas and nerds who mistakenly understand judicial process as a "Captain Kirk vs Computer" scenario. There's a trend in communities like HN to claim that the CFAA is bad because Swartz deliberately broke the law while he engaged in some pretty cool civil disobedience. That's not reasonable. Two things can be true at once: what Swartz did was in fact cool and laudable, it still shouldn't be legal. Similarly, a reasonable person might consider it cool and laudable to punch a nazi, doesn't mean it should be legal. In any case, there's also a trend of misrepresenting the potential penalties involved. On HN, you'll see people posting about how Swartz was facing 30 years in prison, which is an outright lie. Swartz had, in fact, behaved as described in the indictment; he had two plea deals on the table. One for 6 months with the opportunity to argue for further leniency from the judge, and another for 4 months outright. Lawyers familiar with the case have stated that it was very likely that he wouldn't have gone to prison at all. Swartz killed himself, so the CFAA must be bad, but it's probably realistic to assume that Swartz did not kill himself because he was scared of spending a few months in prison. He was likely seriously mentally ill, and a victim of the poor state of the US healthcare system, not of the CFAA or the DOJ.
BobbyTables2 11mo ago
Guessing URLs is equivalent to ordering an item not on the menu in a restaurant. The request may or may not be granted.
- monerozcash 11mo ago
  This same logic is easily extended to SQL injection, or just about any other software vulnerability. How do you propose the line should be drawn?
  - tadfisher 11mo ago
    Probably somewhere short of incarcerating someone for what they typed in a browser's URL bar.
    - monerozcash 11mo ago
      So if I deliberately exploit a bug on your website and download your customer database by typing things in my browsers URL bar, I should not be prosecuted?
      - JuniperMesos 11mo ago
        No, and I would support a law explicitly making it illegal for prosecutor to prosecute you for this.
        monerozcash 11mo ago
        I'd be totally down for that, but I reckon it would be kind of shitty for the vast majority of the people who are not CTF enthusiasts.
        deleted 11mo ago
        [deleted]
  - amypetrik8 11mo ago
estimator7292 11mo ago
Guessing passwords is an attempt to access privileged information you have no right to access, and could not otherwise access without bypassing security measures. Guessing a URL is an attempt to access (potentially) privileged information which was not secured or authenticated to begin with. A password is a lock you have to break. An unlisted URL is a sticky note that says "private" on the front of a 40" screen. It's literally impossible for that information to stay private. Someone will see it eventually.
irilesscent 11mo ago
I think criminalising both is unreasonable, what you do with the URL you accessed or the password you guessed however is different.
Dylan16807 11mo ago
It depends on stuff. Sometimes a URL can have a password in it. But when it's just a sequential-ish ID number, you have to accept that people will change the ID number. If you want security, do something else. No prosecuting.

by vkou 11mo ago

You think criminalizing guessing URLs is unreasonable. What about guessing passwords? Should someone be prosecuted for just trying to bruteforce them until one works?

nkrisc 11mo ago

How do I know which URLs of a website are legal to visit and which are illegal?

vkou 11mo ago
I can't say I've ever struggled to make this determination, but I don't make a habit of trying random ports, endpoints, car doors, or brute-force guessing URLs.
- sayamqazi 11mo ago
  But it was very tempting when i saw that my national exam results were sent to us in a mail as nationalexam.com/results/2024/my-roll-number. Why would i not try different values in the last part.
  - monerozcash 11mo ago
    Try it once to see if it works, you'll probably be fine. Find out that it works, and then proceed to look up various other people? Whether you're fine depends entirely on whether or not you genuinely believe that you're supposed to be accessing that stuff.

wakawaka28 11mo ago

Passwords are different from URLs because URLs are basically public, whereas passwords aren't supposed to be. Furthermore, this is not 1995. Everyone who is in the industry providing IT services is supposed to know that basic security measures are necessary. The physical analogy would be, walking through an unlocked and unmarked door that faces the street in a busy city, versus picking a lock on that door and then walking through it.

vkou 11mo ago
> Everyone who is in the industry providing IT services is supposed to know that basic security measures are necessary. And everyone who doesn't have wool for brains knows to not carry large rolls of cash around in a bad part of town, but we can still hold the mugger at fault.
- wakawaka28 11mo ago
  Nevertheless, URLs are as public as door knobs. If someone is merely observing that a door is unlocked and they have not stolen anything, they have done nothing wrong. People being prosecuted over discovery and disclosure of horrible design flaws based on URLs should never be prosecuted. If they use the information to actually cause damage, we can be in agreement that they are responsible for the damage.
  - monerozcash 11mo ago
    >People being prosecuted over discovery and disclosure of horrible design flaws based on URLs should never be prosecuted. If they use the information to actually cause damage, we can be in agreement that they are responsible for the damage. That's literally the current state of things.
    - wakawaka28 11mo ago
      Are you sure? I seem to remember people getting burned for publicly disclosing security vulnerabilities after stubborn agencies refused to fix them for years. Stuff like, exposing thousands of SSNs through a public gateway... We are literally having this discussion on URLs because of famous cases where people DID face unfair treatment. I don't recall any actual fix for this legal chicanery either. If you do, I would be very interested.
      - monerozcash 11mo ago
        > I seem to remember people getting burned for publicly disclosing security vulnerabilities after stubborn agencies refused to fix them for years. Stuff like, exposing thousands of SSNs through a public gateway.. This has never happened in the US on the federal level. Unless your definition of "getting burned" is a nasty email from a clueless non-LE government worker. > We are literally having this discussion on URLs because of famous cases where people DID face unfair treatment I don't think any reasonable person can read through the court filings in those (Auerheimer, Swartz) cases and agree with the claim that there was unfair treatment wrt the application of the CFAA, or that the CFAA was unfair because it covers those cases. I totally understand how someone who has not spent time familiarizing themselves with the actual details of the cases might be under the opposite impression; they are frequently misrepresented by people with agendas and nerds who mistakenly understand judicial process as a "Captain Kirk vs Computer" scenario. There's a trend in communities like HN to claim that the CFAA is bad because Swartz deliberately broke the law while he engaged in some pretty cool civil disobedience. That's not reasonable. Two things can be true at once: what Swartz did was in fact cool and laudable, it still shouldn't be legal. Similarly, a reasonable person might consider it cool and laudable to punch a nazi, doesn't mean it should be legal. In any case, there's also a trend of misrepresenting the potential penalties involved. On HN, you'll see people posting about how Swartz was facing 30 years in prison, which is an outright lie. Swartz had, in fact, behaved as described in the indictment; he had two plea deals on the table. One for 6 months with the opportunity to argue for further leniency from the judge, and another for 4 months outright. Lawyers familiar with the case have stated that it was very likely that he wouldn't have gone to prison at all. Swartz killed himself, so the CFAA must be bad, but it's probably realistic to assume that Swartz did not kill himself because he was scared of spending a few months in prison. He was likely seriously mentally ill, and a victim of the poor state of the US healthcare system, not of the CFAA or the DOJ.

BobbyTables2 11mo ago

Guessing URLs is equivalent to ordering an item not on the menu in a restaurant. The request may or may not be granted.

monerozcash 11mo ago
This same logic is easily extended to SQL injection, or just about any other software vulnerability. How do you propose the line should be drawn?
- tadfisher 11mo ago
  Probably somewhere short of incarcerating someone for what they typed in a browser's URL bar.
  - monerozcash 11mo ago
    So if I deliberately exploit a bug on your website and download your customer database by typing things in my browsers URL bar, I should not be prosecuted?
    - JuniperMesos 11mo ago
      No, and I would support a law explicitly making it illegal for prosecutor to prosecute you for this.
      - monerozcash 11mo ago
        I'd be totally down for that, but I reckon it would be kind of shitty for the vast majority of the people who are not CTF enthusiasts.
        deleted 11mo ago
        [deleted]
- amypetrik8 11mo ago

estimator7292 11mo ago

Guessing passwords is an attempt to access privileged information you have no right to access, and could not otherwise access without bypassing security measures. Guessing a URL is an attempt to access (potentially) privileged information which was not secured or authenticated to begin with. A password is a lock you have to break. An unlisted URL is a sticky note that says "private" on the front of a 40" screen. It's literally impossible for that information to stay private. Someone will see it eventually.

irilesscent 11mo ago

I think criminalising both is unreasonable, what you do with the URL you accessed or the password you guessed however is different.

Dylan16807 11mo ago

It depends on stuff. Sometimes a URL can have a password in it. But when it's just a sequential-ish ID number, you have to accept that people will change the ID number. If you want security, do something else. No prosecuting.