4 ms·

Aaron's initial script may well have been illegal in and of itself, because it was bypassing JSTOR's limits on how many articles you can download. Aaron took s

Aaron's initial script may well have been illegal in and of itself, because it was bypassing JSTOR's limits on how many articles you can download. Aaron took so many more steps after that that it's hardly worth talking about his first action. Two questions you need to seriously answer to make changing your MAC address on Comcast's network to be the exact same thing as what Aaron did: 1. Are you bypassing a security mechanism by changing your MAC address? 2. Did you gain something and/or cause them losses exceeding $5,000?

jlgreco 14y ago
At the risk of being mildly self-incriminating... > 1. Are you bypassing a security mechanism by changing your MAC address? As far as I can tell? Quite possibly. If I don't make my router use my laptop's MAC address then I get hit with a captive portal at random times. This appears to be a security measure, though in my unresearched opinion I believe it to be a mis-firing of a security measure. > 2. Did you gain something and/or cause them losses exceeding $5,000? Considering the cost of my bill, it won't take me all that long to cross that limit.
- danielweber 14y ago
  1. So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today? It's the intent to be somewhere you know (or ought to know) you aren't wanted that matters. 2. It's not just "I did $5,000 worth of business." If Comcast had a program where they sold "router-attached Internet" for a price difference that totaled $5,000 over the price you paid for "computer-attached Internet" then you would hit CFAA levels.
  - jlgreco 14y ago
    > So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today? Their captive portal demands that I install client side software. If they didn't want me to do this, there are definitely better ways of letting me know about this than a captive portal. Why would they captive portal someone they intend to let use their service? What concerns me here is the degree to which I seemingly have to guess at Comcast's motives. > It's not just "I did $5,000 worth of business." So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for. How is a layman, who is apparently responsible for evaluating the legality of his own actions, supposed to make a distinction?
    - danielweber 14y ago
      1. I don't understand about the captive portal. Do you really think they don't want you on their network with a router? The fact that their motives are unclear would be a good argument in your favor in case you were in court. Note that there wasn't any doubts about MIT's motives. Aaron isn't an idiot and he knew they were trying to keep him off the network. 2. So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for. I don't understand how this is a reply. If I use fraud to buy something you would sell for $8000 for $6000 instead, that's only $2000 worth of damages.
      - jlgreco 14y ago
        Do you know what a captive portal is or something? Comcast is preventing me from accessing their network unless I install their client side software. I am circumventing the technical measure in place to enforce this demand by changing my MAC address such that they think I have their software installed. Am I in violation of their ToS for doing this? The hell if I know, but it seems entirely plausible.
- snowwrestler 14y ago
  If you are paying Comcast, and not exceeding the level of access for which you are paying, then you are not costing them any money at all, and arguably not defeating security since you have a legal right (by virtue of your contract with them) to the resource you are accessing. The situation would be different if you were not paying Comcast, but still using technical trickery to defeat their network security and access their bandwidth.
ynniv 14y ago
Are you bypassing a security mechanism by changing your MAC address? This question seriously calls into question your profile description of "security guy". A security mechanism based on MAC is as effective as a security mechanism based on asking a stranger whether their name is Aaron Swartz, because Aaron Swartz isn't allowed on this network. Please stop.
- rayiner 14y ago
  The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. That's why the strength of the security measure isn't relevant. If I don't want Bob Dylan walking on my lawn, and I post guards who simply ask "are you Bob Dylan?" that shouldn't be any different than if I put up retinal and finger print scanners. Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn.
  - ynniv 14y ago
    Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn. Agreed, which is one reason it is important in this conversation to separate false identity from trespassing. The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. Ah! Exactly! Which is why this conversation is important. The OP has said that he effectively always says no when asked if he is "Insert Name". My example is also poor, because asking someone if they are Bob Dylan also informs them that Bob Dylan is restricted from entry, which means something to the law. A better example would be a security system based on something fleeting and baseless, like your favorite color. You might have always liked the same color, or you might change favorite colors every year, or you might just tell people a different color because no one really knows what your favorite color is but you anyway. If the security call box asked you what your favorite color was, you told them something random, and they let you in, is that illegal? The security guard never said that people whose favorite color is X are not allowed, he just asked what your favorite color was, and then he let you in.
    - 14y ago

jlgreco 14y ago

At the risk of being mildly self-incriminating... > 1. Are you bypassing a security mechanism by changing your MAC address? As far as I can tell? Quite possibly. If I don't make my router use my laptop's MAC address then I get hit with a captive portal at random times. This appears to be a security measure, though in my unresearched opinion I believe it to be a mis-firing of a security measure. > 2. Did you gain something and/or cause them losses exceeding $5,000? Considering the cost of my bill, it won't take me all that long to cross that limit.

danielweber 14y ago
1. So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today? It's the intent to be somewhere you know (or ought to know) you aren't wanted that matters. 2. It's not just "I did $5,000 worth of business." If Comcast had a program where they sold "router-attached Internet" for a price difference that totaled $5,000 over the price you paid for "computer-attached Internet" then you would hit CFAA levels.
- jlgreco 14y ago
  > So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today? Their captive portal demands that I install client side software. If they didn't want me to do this, there are definitely better ways of letting me know about this than a captive portal. Why would they captive portal someone they intend to let use their service? What concerns me here is the degree to which I seemingly have to guess at Comcast's motives. > It's not just "I did $5,000 worth of business." So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for. How is a layman, who is apparently responsible for evaluating the legality of his own actions, supposed to make a distinction?
  - danielweber 14y ago
    1. I don't understand about the captive portal. Do you really think they don't want you on their network with a router? The fact that their motives are unclear would be a good argument in your favor in case you were in court. Note that there wasn't any doubts about MIT's motives. Aaron isn't an idiot and he knew they were trying to keep him off the network. 2. So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for. I don't understand how this is a reply. If I use fraud to buy something you would sell for $8000 for $6000 instead, that's only $2000 worth of damages.
    - jlgreco 14y ago
      Do you know what a captive portal is or something? Comcast is preventing me from accessing their network unless I install their client side software. I am circumventing the technical measure in place to enforce this demand by changing my MAC address such that they think I have their software installed. Am I in violation of their ToS for doing this? The hell if I know, but it seems entirely plausible.
snowwrestler 14y ago
If you are paying Comcast, and not exceeding the level of access for which you are paying, then you are not costing them any money at all, and arguably not defeating security since you have a legal right (by virtue of your contract with them) to the resource you are accessing. The situation would be different if you were not paying Comcast, but still using technical trickery to defeat their network security and access their bandwidth.

ynniv 14y ago

Are you bypassing a security mechanism by changing your MAC address? This question seriously calls into question your profile description of "security guy". A security mechanism based on MAC is as effective as a security mechanism based on asking a stranger whether their name is Aaron Swartz, because Aaron Swartz isn't allowed on this network. Please stop.

rayiner 14y ago
The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. That's why the strength of the security measure isn't relevant. If I don't want Bob Dylan walking on my lawn, and I post guards who simply ask "are you Bob Dylan?" that shouldn't be any different than if I put up retinal and finger print scanners. Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn.
- ynniv 14y ago
  Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn. Agreed, which is one reason it is important in this conversation to separate false identity from trespassing. The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property. Ah! Exactly! Which is why this conversation is important. The OP has said that he effectively always says no when asked if he is "Insert Name". My example is also poor, because asking someone if they are Bob Dylan also informs them that Bob Dylan is restricted from entry, which means something to the law. A better example would be a security system based on something fleeting and baseless, like your favorite color. You might have always liked the same color, or you might change favorite colors every year, or you might just tell people a different color because no one really knows what your favorite color is but you anyway. If the security call box asked you what your favorite color was, you told them something random, and they let you in, is that illegal? The security guard never said that people whose favorite color is X are not allowed, he just asked what your favorite color was, and then he let you in.
  - 14y ago