5 ms·

Say I am not allowed on your premises, and I wear a fake mustache in order to get past a mechanism you put in place to stop me (such as guards with my picture),

Say I am not allowed on your premises, and I wear a fake mustache in order to get past a mechanism you put in place to stop me (such as guards with my picture), and I get charged with fraud for deceiving your guards because I gained access to something valuable. This doesn't mean "oh noes! fake mustaches are against the lawz!!!11 they are going to lock up all the actors!"

jlgreco 14y ago
In this hypothetical moustache example, is the "gained access to something valuable" the sticking point, or is it the "deceiving guards"? I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass... Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? Was Aaron's curl script A-okay right up until the point that he deceived?
- danielweber 14y ago
  Aaron's initial script may well have been illegal in and of itself, because it was bypassing JSTOR's limits on how many articles you can download. Aaron took so many more steps after that that it's hardly worth talking about his first action. Two questions you need to seriously answer to make changing your MAC address on Comcast's network to be the exact same thing as what Aaron did: 1. Are you bypassing a security mechanism by changing your MAC address? 2. Did you gain something and/or cause them losses exceeding $5,000?
  - jlgreco 14y ago
    At the risk of being mildly self-incriminating... > 1. Are you bypassing a security mechanism by changing your MAC address? As far as I can tell? Quite possibly. If I don't make my router use my laptop's MAC address then I get hit with a captive portal at random times. This appears to be a security measure, though in my unresearched opinion I believe it to be a mis-firing of a security measure. > 2. Did you gain something and/or cause them losses exceeding $5,000? Considering the cost of my bill, it won't take me all that long to cross that limit.
    - danielweber 14y ago
      1. So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today? It's the intent to be somewhere you know (or ought to know) you aren't wanted that matters. 2. It's not just "I did $5,000 worth of business." If Comcast had a program where they sold "router-attached Internet" for a price difference that totaled $5,000 over the price you paid for "computer-attached Internet" then you would hit CFAA levels.
      - jlgreco 14y ago
        > So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today? Their captive portal demands that I install client side software. If they didn't want me to do this, there are definitely better ways of letting me know about this than a captive portal. Why would they captive portal someone they intend to let use their service? What concerns me here is the degree to which I seemingly have to guess at Comcast's motives. > It's not just "I did $5,000 worth of business." So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for. How is a layman, who is apparently responsible for evaluating the legality of his own actions, supposed to make a distinction?
        danielweber 14y ago
        1. I don't understand about the captive portal. Do you really think they don't want you on their network with a router? The fact that their motives are unclear would be a good argument in your favor in case you were in court. Note that there wasn't any doubts about MIT's motives. Aaron isn't an idiot and he knew they were trying to keep him off the network. 2. So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for. I don't understand how this is a reply. If I use fraud to buy something you would sell for $8000 for $6000 instead, that's only $2000 worth of damages.
        14y ago
  - ynniv 14y ago
    Are you bypassing a security mechanism by changing your MAC address? This question seriously calls into question your profile description of "security guy". A security mechanism based on MAC is as effective as a security mechanism based on asking a stranger whether their name is Aaron Swartz, because Aaron Swartz isn't allowed on this network. Please stop.
    - rayiner 14y ago
      The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. That's why the strength of the security measure isn't relevant. If I don't want Bob Dylan walking on my lawn, and I post guards who simply ask "are you Bob Dylan?" that shouldn't be any different than if I put up retinal and finger print scanners. Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn.
      - ynniv 14y ago
        Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn. Agreed, which is one reason it is important in this conversation to separate false identity from trespassing. The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. Ah! Exactly! Which is why this conversation is important. The OP has said that he effectively always says no when asked if he is "Insert Name". My example is also poor, because asking someone if they are Bob Dylan also informs them that Bob Dylan is restricted from entry, which means something to the law. A better example would be a security system based on something fleeting and baseless, like your favorite color. You might have always liked the same color, or you might change favorite colors every year, or you might just tell people a different color because no one really knows what your favorite color is but you anyway. If the security call box asked you what your favorite color was, you told them something random, and they let you in, is that illegal? The security guard never said that people whose favorite color is X are not allowed, he just asked what your favorite color was, and then he let you in.
        14y ago
- andylei 14y ago
  > I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass... Is this activity illegal? Like most questions in law, the answer is, "it depends". Are you paying Comcast for internet? If so, its probably not illegal because they have authorized you to access the internet through their networks. However, if Comcast's network authentication was based on MAC addresses and you spoofed yours to match a paying customer's, that would probably be wire fraud. > Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? I'm not sure what other laws would be relevant if there was no deception, but it certainly wouldn't be wire fraud. Deception is a pretty integral component to fraud.
ynniv 14y ago
Well that's a poorly constructed straw-man. Why would you be charged for fraud for wearing a fake mustache? I don't think you have any idea what you're saying.

jlgreco 14y ago

In this hypothetical moustache example, is the "gained access to something valuable" the sticking point, or is it the "deceiving guards"? I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass... Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? Was Aaron's curl script A-okay right up until the point that he deceived?

danielweber 14y ago
Aaron's initial script may well have been illegal in and of itself, because it was bypassing JSTOR's limits on how many articles you can download. Aaron took so many more steps after that that it's hardly worth talking about his first action. Two questions you need to seriously answer to make changing your MAC address on Comcast's network to be the exact same thing as what Aaron did: 1. Are you bypassing a security mechanism by changing your MAC address? 2. Did you gain something and/or cause them losses exceeding $5,000?
- jlgreco 14y ago
  At the risk of being mildly self-incriminating... > 1. Are you bypassing a security mechanism by changing your MAC address? As far as I can tell? Quite possibly. If I don't make my router use my laptop's MAC address then I get hit with a captive portal at random times. This appears to be a security measure, though in my unresearched opinion I believe it to be a mis-firing of a security measure. > 2. Did you gain something and/or cause them losses exceeding $5,000? Considering the cost of my bill, it won't take me all that long to cross that limit.
  - danielweber 14y ago
    1. So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today? It's the intent to be somewhere you know (or ought to know) you aren't wanted that matters. 2. It's not just "I did $5,000 worth of business." If Comcast had a program where they sold "router-attached Internet" for a price difference that totaled $5,000 over the price you paid for "computer-attached Internet" then you would hit CFAA levels.
    - jlgreco 14y ago
      > So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today? Their captive portal demands that I install client side software. If they didn't want me to do this, there are definitely better ways of letting me know about this than a captive portal. Why would they captive portal someone they intend to let use their service? What concerns me here is the degree to which I seemingly have to guess at Comcast's motives. > It's not just "I did $5,000 worth of business." So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for. How is a layman, who is apparently responsible for evaluating the legality of his own actions, supposed to make a distinction?
      - danielweber 14y ago
        1. I don't understand about the captive portal. Do you really think they don't want you on their network with a router? The fact that their motives are unclear would be a good argument in your favor in case you were in court. Note that there wasn't any doubts about MIT's motives. Aaron isn't an idiot and he knew they were trying to keep him off the network. 2. So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for. I don't understand how this is a reply. If I use fraud to buy something you would sell for $8000 for $6000 instead, that's only $2000 worth of damages.
        14y ago
- ynniv 14y ago
  Are you bypassing a security mechanism by changing your MAC address? This question seriously calls into question your profile description of "security guy". A security mechanism based on MAC is as effective as a security mechanism based on asking a stranger whether their name is Aaron Swartz, because Aaron Swartz isn't allowed on this network. Please stop.
  - rayiner 14y ago
    The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. That's why the strength of the security measure isn't relevant. If I don't want Bob Dylan walking on my lawn, and I post guards who simply ask "are you Bob Dylan?" that shouldn't be any different than if I put up retinal and finger print scanners. Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn.
    - ynniv 14y ago
      Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn. Agreed, which is one reason it is important in this conversation to separate false identity from trespassing. The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. Ah! Exactly! Which is why this conversation is important. The OP has said that he effectively always says no when asked if he is "Insert Name". My example is also poor, because asking someone if they are Bob Dylan also informs them that Bob Dylan is restricted from entry, which means something to the law. A better example would be a security system based on something fleeting and baseless, like your favorite color. You might have always liked the same color, or you might change favorite colors every year, or you might just tell people a different color because no one really knows what your favorite color is but you anyway. If the security call box asked you what your favorite color was, you told them something random, and they let you in, is that illegal? The security guard never said that people whose favorite color is X are not allowed, he just asked what your favorite color was, and then he let you in.
      - 14y ago
andylei 14y ago
> I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass... Is this activity illegal? Like most questions in law, the answer is, "it depends". Are you paying Comcast for internet? If so, its probably not illegal because they have authorized you to access the internet through their networks. However, if Comcast's network authentication was based on MAC addresses and you spoofed yours to match a paying customer's, that would probably be wire fraud. > Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? I'm not sure what other laws would be relevant if there was no deception, but it certainly wouldn't be wire fraud. Deception is a pretty integral component to fraud.

ynniv 14y ago

Well that's a poorly constructed straw-man. Why would you be charged for fraud for wearing a fake mustache? I don't think you have any idea what you're saying.