8 ms·

Didn't he use an unpublished link? That would be "unauthorized" to me.

by sigzero 14y ago

cheald 14y ago
http://en.wikipedia.org/wiki/Security_through_obscurity http://en.wikipedia.org/wiki/Security_through_obscurity
- rayiner 14y ago
  The fact that a security mechanism is poor shouldn't mean that it doesn't create a legally enforceable boundary. If I tape my door shut instead of buying a proper lock, that doesn't give you the right to walk in.
  - cheald 14y ago
    Bad analogy. A door is an access control mechanism. A Uniform Resource Locator is not. A more apt analogy would claiming that having your phone number not published in the phone book constitutes a legally enforceable boundary against being contacted by phone.
    - rayiner 14y ago
      We can debate about whether URLs have elements of an access control mechanism or not, but if obscured URLs don't create a legally protect-able boundary, the argument should be because they're not an access control mechanism, not that they're a poor access control mechanism (which is the usual implication of "security through obscurity"). In other words, the argument should be about how clearly the boundaries are drawn, not how effective the security mechanisms are.
      - cheald 14y ago
        Granted. The security-through-obscurity link was an oversimplification.
    - aqme28 14y ago
      Here's an analogy for you: I don't publish my address in the phonebook or anywhere, but because you know that 4001 Example streeet is a house and 4003 Example street is a house, you're still able to solicit me at 4005 Example street.
jonathanwallace 14y ago
Can you clarify what "published" means in the context of a http link? Preferably citing the appropriate section in the RFC, http://www.w3.org/Protocols/rfc2616/rfc2616.html http://www.w3.org/Protocols/rfc2616/rfc2616.html?
ghshephard 14y ago
Curious - did I do something "unauthorized" by entering: https://news.ycombinator.com/item?id=5419914 https://news.ycombinator.com/item?id=5419914 Into the URL bar? (One less than this article's URL)
- rayiner 14y ago
  It's absurdly reductionist to make arguments like this. There are lots of things that are okay or not okay based on context. Is it unauthorized to type the above into a URL bar? Almost certainly not. Might it be unauthorized if you type it into a URL bar, see that it contains private information that by its nature was probably not intended to be public, then do it 10,000 more times? Then that might be unauthorized. There is no reason to reduce the world to absurd simplicities when even children would be able to distinguish between various courses of action.
  - doppel 14y ago
    Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script. The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).
    - jerf 14y ago
      I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage. However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.
mcherm 14y ago
That strikes me as a very surprising position to take. So you consider it a felony to enter in a browser some URL that has not been been "published". What exactly counts as published? For instance, if I created another page that links to it, is that "published"? Is it still "published" if I later delete that other page? Is it "published" if someone else somewhere in the world creates a page linking to it, but I never create one? What if I print a riddle in the newspaper, which says that the answer to the riddle is the URL in question... is that "publishing" it? What if it's a really HARD riddle? What if I don't print the riddle in the newspaper, but it's a really easy riddle... something like "just add one"? I honestly do not think that whether you "publish" a URL should be used as an indicator of whether access is authorized. Every web server I have ever heard of has the ability to return a "401 Unauthorized" error code, and to do so or not based on the credentials of the person connecting. If I were writing the law, I would say that guessing a password to put in such a box, or accessing it with a malformed request used a bug in the server to bypass such a credential check would certainly qualify as "unauthorized access", but that "AT&T didn't bother to require a check before returning the data to any browser that asked for it" would be evidence that it was explicitly authorized.
mk3 14y ago
basically if he looses the court. 404 page may result in getting orange jumpsuit and nice check to be paid. In my opinion leaving personal information accessible to general public (i.e. no authentication needed) is a crime. Letting journalists know is not a crime. In this case AT&T is responsible for misplacing personal data, and not the guy who had free access to it. In some ways it's really similar to Aaron Swartz case, as both guys found a way to get the data, and both got sued. I would suggest looking into this case more closelly as if he ends up in jail or pays a dime, a simple misuse of some companies website and/or public API (think Google Maps, etc.) Could land you in jail

Didn't he use an unpublished link? That would be "unauthorized" to me.

by sigzero 14y ago

Didn't he use an unpublished link? That would be "unauthorized" to me.

cheald 14y ago

http://en.wikipedia.org/wiki/Security_through_obscurity http://en.wikipedia.org/wiki/Security_through_obscurity

rayiner 14y ago
The fact that a security mechanism is poor shouldn't mean that it doesn't create a legally enforceable boundary. If I tape my door shut instead of buying a proper lock, that doesn't give you the right to walk in.
- cheald 14y ago
  Bad analogy. A door is an access control mechanism. A Uniform Resource Locator is not. A more apt analogy would claiming that having your phone number not published in the phone book constitutes a legally enforceable boundary against being contacted by phone.
  - rayiner 14y ago
    We can debate about whether URLs have elements of an access control mechanism or not, but if obscured URLs don't create a legally protect-able boundary, the argument should be because they're not an access control mechanism, not that they're a poor access control mechanism (which is the usual implication of "security through obscurity"). In other words, the argument should be about how clearly the boundaries are drawn, not how effective the security mechanisms are.
    - cheald 14y ago
      Granted. The security-through-obscurity link was an oversimplification.
  - aqme28 14y ago
    Here's an analogy for you: I don't publish my address in the phonebook or anywhere, but because you know that 4001 Example streeet is a house and 4003 Example street is a house, you're still able to solicit me at 4005 Example street.

jonathanwallace 14y ago

Can you clarify what "published" means in the context of a http link? Preferably citing the appropriate section in the RFC, http://www.w3.org/Protocols/rfc2616/rfc2616.html http://www.w3.org/Protocols/rfc2616/rfc2616.html?

ghshephard 14y ago

Curious - did I do something "unauthorized" by entering: https://news.ycombinator.com/item?id=5419914 https://news.ycombinator.com/item?id=5419914 Into the URL bar? (One less than this article's URL)

rayiner 14y ago
It's absurdly reductionist to make arguments like this. There are lots of things that are okay or not okay based on context. Is it unauthorized to type the above into a URL bar? Almost certainly not. Might it be unauthorized if you type it into a URL bar, see that it contains private information that by its nature was probably not intended to be public, then do it 10,000 more times? Then that might be unauthorized. There is no reason to reduce the world to absurd simplicities when even children would be able to distinguish between various courses of action.
- doppel 14y ago
  Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script. The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).
  - jerf 14y ago
    I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage. However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.

mcherm 14y ago

That strikes me as a very surprising position to take. So you consider it a felony to enter in a browser some URL that has not been been "published". What exactly counts as published? For instance, if I created another page that links to it, is that "published"? Is it still "published" if I later delete that other page? Is it "published" if someone else somewhere in the world creates a page linking to it, but I never create one? What if I print a riddle in the newspaper, which says that the answer to the riddle is the URL in question... is that "publishing" it? What if it's a really HARD riddle? What if I don't print the riddle in the newspaper, but it's a really easy riddle... something like "just add one"? I honestly do not think that whether you "publish" a URL should be used as an indicator of whether access is authorized. Every web server I have ever heard of has the ability to return a "401 Unauthorized" error code, and to do so or not based on the credentials of the person connecting. If I were writing the law, I would say that guessing a password to put in such a box, or accessing it with a malformed request used a bug in the server to bypass such a credential check would certainly qualify as "unauthorized access", but that "AT&T didn't bother to require a check before returning the data to any browser that asked for it" would be evidence that it was explicitly authorized.

mk3 14y ago

basically if he looses the court. 404 page may result in getting orange jumpsuit and nice check to be paid. In my opinion leaving personal information accessible to general public (i.e. no authentication needed) is a crime. Letting journalists know is not a crime. In this case AT&T is responsible for misplacing personal data, and not the guy who had free access to it. In some ways it's really similar to Aaron Swartz case, as both guys found a way to get the data, and both got sued. I would suggest looking into this case more closelly as if he ends up in jail or pays a dime, a simple misuse of some companies website and/or public API (think Google Maps, etc.) Could land you in jail