4 ms·

Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorize

by doppel 14y ago

Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script. The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).

jerf 14y ago
I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage. However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.
- sneak 14y ago
  It also spoofed the user-agent of an iPad. Still, it made a request to a webserver, and the webserver gave up the data. That's not the requester's fault.
  - fnordfnordfnord 14y ago
    I use a spoofed user agent all of the time.
- alxndr 14y ago
  > However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. What if you did it by hand? Where's the line between what's ok and what's not?
  - rayiner 14y ago
    Ultimately the line is drawn based on what the evidence implies about intent. What does downloading 10 URLs by hand to get a proof of concept say about intent versus downloading 10,000 with a script? If we're going to give "security researchers" license to test other people's systems without consent, shouldn't we at least have some understanding that such actions will be narrowly tailored to prove the necessary point?
    - wnight 14y ago
      It says nothing to people in the know. It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific set, and it avoids having to pick known good IDs. You aren't giving anyone license anyone than the tide needs license to use the beach. You need to recognize that unpassworded sequential URLs are a vulnerability even if you shoot the messenger. And thus, shooting the messenger, and justifying it, is evidence of someone who doesn't get "it".
- warfangle 14y ago
  > However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior How is this different than using Facebook's graph URI endpoints ---- excepting the fact that Facebook publishes the schema? What if Facebook had some URIs that were not covered in the schema? Are you then liable for a federal felony if you access them? Or are they liable for failing to protect personal information by not keeping it behind an encryption interface?
  - jerf 14y ago
    I just said it's a qualitative difference. I deliberately did not opine on the legality or the ethics, I simply reject the idea that we can say that there's no difference between a by-hand downloading of a couple of URLs and a massive by-script downloading of thousands+. As is so often the case, there's no bright shining line, but there is a line here, and trying to be reductionistic and claim there's no difference is, in my opinion, not a valid argument. It may very well be the case that it should also not be illegal, or that we want the common sense solution where it's still "illegal" but not a criminal felony but rather a civil matter (illegal is not a binary flag, after all).
- flyinRyan 14y ago
  >However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. So, a search engine then. Let Google, Bing and DuckDuckGo know they're wanted for questioning.
  - jerf 14y ago
    As I observe elsewhere, all I'm saying is that there's a qualitative difference, not that the qualitative difference implies illegality. Are you going to defend the proposition that there is no legal, moral, or philosophical distinction that can be made between Google and a guy downloading a web page once by hand? Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose. I consider this a criticism of the law, not the search engines.
    - flyinRyan 14y ago
      >. Are you going to defend the proposition that there is no legal, moral, or philosophical distinction that can be made between Google and a guy downloading a web page once by hand? I'm not a lawyer so I can't speak directly to "legally" but I believe there shouldn't be a legal difference between a search engine loading a page and me doing it by hand. After all, how would I hand verify what my search engine is saying if doing so might be illegal? >Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose. I consider this a criticism of the law, not the search engines. You could be right and I would agree the law today is horribly screwed up.
      - jerf 14y ago
        No, not "Google pulling one page"... Google. The whole thing. We've been talking about the difference between grabbing one page and grabbing thousands+ of pages all along... are you reading what I'm actually saying or just knee-jerking here?

by doppel 14y ago

jerf 14y ago

I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage. However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.

sneak 14y ago
It also spoofed the user-agent of an iPad. Still, it made a request to a webserver, and the webserver gave up the data. That's not the requester's fault.
- fnordfnordfnord 14y ago
  I use a spoofed user agent all of the time.
alxndr 14y ago
> However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. What if you did it by hand? Where's the line between what's ok and what's not?
- rayiner 14y ago
  Ultimately the line is drawn based on what the evidence implies about intent. What does downloading 10 URLs by hand to get a proof of concept say about intent versus downloading 10,000 with a script? If we're going to give "security researchers" license to test other people's systems without consent, shouldn't we at least have some understanding that such actions will be narrowly tailored to prove the necessary point?
  - wnight 14y ago
    It says nothing to people in the know. It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific set, and it avoids having to pick known good IDs. You aren't giving anyone license anyone than the tide needs license to use the beach. You need to recognize that unpassworded sequential URLs are a vulnerability even if you shoot the messenger. And thus, shooting the messenger, and justifying it, is evidence of someone who doesn't get "it".
warfangle 14y ago
> However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior How is this different than using Facebook's graph URI endpoints ---- excepting the fact that Facebook publishes the schema? What if Facebook had some URIs that were not covered in the schema? Are you then liable for a federal felony if you access them? Or are they liable for failing to protect personal information by not keeping it behind an encryption interface?
- jerf 14y ago
  I just said it's a qualitative difference. I deliberately did not opine on the legality or the ethics, I simply reject the idea that we can say that there's no difference between a by-hand downloading of a couple of URLs and a massive by-script downloading of thousands+. As is so often the case, there's no bright shining line, but there is a line here, and trying to be reductionistic and claim there's no difference is, in my opinion, not a valid argument. It may very well be the case that it should also not be illegal, or that we want the common sense solution where it's still "illegal" but not a criminal felony but rather a civil matter (illegal is not a binary flag, after all).
flyinRyan 14y ago
>However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. So, a search engine then. Let Google, Bing and DuckDuckGo know they're wanted for questioning.
- jerf 14y ago
  As I observe elsewhere, all I'm saying is that there's a qualitative difference, not that the qualitative difference implies illegality. Are you going to defend the proposition that there is no legal, moral, or philosophical distinction that can be made between Google and a guy downloading a web page once by hand? Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose. I consider this a criticism of the law, not the search engines.
  - flyinRyan 14y ago
    >. Are you going to defend the proposition that there is no legal, moral, or philosophical distinction that can be made between Google and a guy downloading a web page once by hand? I'm not a lawyer so I can't speak directly to "legally" but I believe there shouldn't be a legal difference between a search engine loading a page and me doing it by hand. After all, how would I hand verify what my search engine is saying if doing so might be illegal? >Also, I've long been of the opinion that if we had somehow gotten to today with no search engines, and Google tried to start up today, that they would be slammed to the ground by lawsuits, which they would probably lose. I consider this a criticism of the law, not the search engines. You could be right and I would agree the law today is horribly screwed up.
    - jerf 14y ago
      No, not "Google pulling one page"... Google. The whole thing. We've been talking about the difference between grabbing one page and grabbing thousands+ of pages all along... are you reading what I'm actually saying or just knee-jerking here?