3 ms·
You are explicitly authorized by the specified policy that uses SSN to look up the data. If you aren't authorized, why is it sending you the data? If you make
by darkarmani 13y ago
You are explicitly authorized by the specified policy that uses SSN to look up the data. If you aren't authorized, why is it sending you the data?
If you make no effort to authenticate requests, I find it very unreasonable to act like any requests are unauthorized.
- mpyne 13y agoSo what about denial of service attacks going against just the public unauthenticated API? Just because AT&T does a boneheaded security implementation for which they deserve sanction, does not entitle weev or anyone else to go beyond ethical boundaries in discovering (and in weev's case, abusing) that security lapse.
- darkarmani 13y agoI think DoS is covered by clauses other than just authorized or unauthorized. You can't legally DoS people even if you are an authorized user. > that security lapse. I don't think you can call this a lapse. It's not like they had passwords but forgot to change them. They designed it without any security.
- mpyne 13y ago> They designed it without any security. Is that the only criterion now? You'll only do the ethical thing if someone else remembered to bake in technical safeguards?