4 ms·

This seems weird to me. If I go to, say, the twitter homepage, I will find an authentication page, and yet most content on twitter is obviously intended to be

This seems weird to me. If I go to, say, the twitter homepage, I will find an authentication page, and yet most content on twitter is obviously intended to be public.

marcosdumay 13y ago
That, exactly that. If you have a secret document, when I come knocking on your door and ask for that document, you'll refuse to give it to me, or at least ask for something that convinces you that can access it. Nobody would be crazy enough to charge me by a crime if I ask you the document, and you give it to me without any kind of verification. But now, configure a computer to do that exact thing, and suddenly you manufacture plenty of new criminals.
- rch 13y ago
  It's more like if you walk up and find the document on my doorstep, turn around to see the 'no trespassing' sign, then leave with the document anyway. Again - I don't really agree with the ruling here - just trying to clarify.
  - lstamour 13y ago
    Except I found the documents on Google. It's the equivalent to advertising a yard sale but not realising what you were selling / showing the public.
    - ben0x539 13y ago
      I dunno, having a yard sale is 'opt-in', since you're putting up the signs etc, showing up on Google is more 'opt-out'.
      - jeza 13y ago
        Isn't it more opt-in because you need to put a link somewhere on the public www before Google can find it?
        vacri 13y ago
        If your side gate was open when the googlecar drove by and put it on streetview, does that mean that anyone else is entitled to wander in and take things should the gate be open as they pass by?
        tripzilch 13y ago
        Yes but links can leak in the most accidental fashions. Google seems to find a lot of stuff that makes me wonder how Googlebot ever found such links. Part of the explanation might be referer logs, and such. Anyway, the point is, it's smarter to be explicit and also opt-out using robots.txt or something similar.
    - rch 13y ago
      That sounds about right, actually. Half the yard is clearly free, but they failed to mention that you can't even view the other half. But wasn't the quote indicating that it was made clear somehow? Looking at the anses.fr site isn't particularly helpful, if that's even the site in question.
    - vacri 13y ago
      Except that advertising takes positive effort on your part, whereas it takes positive effort to avoid being listed on Google.
      - lstamour 13y ago
        I don't know, but I think "putting up a web server" qualifies for "positive effort" ;-) And while it does take extra work to ensure an Intranet isn't available on the public web, or that it's correctly configured to require a login to view documents ... there has to be a line somewhere. I mean, I've stumbled on FTP sites that allow anonymous users. By providing no password and still seeing content, would I have "hacked" them? It's a configuration issue, and password prompts are just that. Of course, where do you then draw the line? If you call it a security flaw that the documents were public, then accessing them could be an exploit. But... a very flimsy one, since we rarely execute injection attacks to visit websites, but we often click links on Google. The bar is clearly very low. ;-) This might, of course, change if the access was not indicated on Google but instead on a site like shodanhq.com ...
  - Dylan16807 13y ago
    More of a 'keep off the grass' sign. It's not at all obvious that the authentication is supposed to apply to other areas.
rch 13y ago
If you happened upon my 'protected' account with some mal-formed link, then saw the standard 'tweets are protected' message on my main page, you might be in a spot if you went back and save all those secret tweets. Under the interpretation being discussed anyway.
tempestn 13y ago
I don't know about France, but in many jurisdictions, a "reasonable person" standard is used. While I don't personally believe accessing publicly available files should be illegal in any case, I do think that in the situation as described (with the admission of traveling up the path hierarchy to find a login page), most "reasonable people" would indeed infer that the files were not intended to be publicly available.
- chrismcb 13y ago
  And how would a "reasonable person" decide that? That is kind of like say "if there is a lock on the door, you should know that it was meant to be locked. Yeah 7/11, open 24 hours, has a lock on the door.
  - ivanca 13y ago
    We don't even have to make analogies; if it is protected information a "reasonable person" expects some kind of _obligatory_ login authentication, not an optional one.
- frobozz 13y ago
  Not really. If I found a page that redirected me to a login, I would assume that that page is not intended to be publicly available, and that other content that I don't know about exists which is not intended to be publicly available. I wouldn't infer that just because (as noted by the parent comment) https://twitter.com/ https://twitter.com/ requires a login, I shouldn't look at https://twitter.com/twrbrdg_itself https://twitter.com/twrbrdg_itself Now, if all those pages I looked at before finding the login page had a banner saying "private, not for public consumption, don't share this with anyone who doesn't have an account", then I might think "hmm, perhaps I'm not supposed to be here".
  - tempestn 13y ago
    That's not a fair analogy though. I agree that I wouldn't expect every page on twitter to be protected. But if you find a direct link to a random document indexed by Google, then check and the page that links to that document is protected, I personally anyway would assume the document itself was exposed accidentally. Obviously not everyone agrees though, which makes the reasonable person thing difficult to decide. As for the lock on the door comment, I'd say it's more like if you noticed a store is left unlocked in the middle of the night, and therefore assume you're welcome to go in and walk around. In fact, they probably didn't leave it unlocked as an intentional invitation.

This seems weird to me. If I go to, say, the twitter homepage, I will find an authentication page, and yet most content on twitter is obviously intended to be public.

marcosdumay 13y ago

That, exactly that. If you have a secret document, when I come knocking on your door and ask for that document, you'll refuse to give it to me, or at least ask for something that convinces you that can access it. Nobody would be crazy enough to charge me by a crime if I ask you the document, and you give it to me without any kind of verification. But now, configure a computer to do that exact thing, and suddenly you manufacture plenty of new criminals.

rch 13y ago
It's more like if you walk up and find the document on my doorstep, turn around to see the 'no trespassing' sign, then leave with the document anyway. Again - I don't really agree with the ruling here - just trying to clarify.
- lstamour 13y ago
  Except I found the documents on Google. It's the equivalent to advertising a yard sale but not realising what you were selling / showing the public.
  - ben0x539 13y ago
    I dunno, having a yard sale is 'opt-in', since you're putting up the signs etc, showing up on Google is more 'opt-out'.
    - jeza 13y ago
      Isn't it more opt-in because you need to put a link somewhere on the public www before Google can find it?
      - vacri 13y ago
        If your side gate was open when the googlecar drove by and put it on streetview, does that mean that anyone else is entitled to wander in and take things should the gate be open as they pass by?
      - tripzilch 13y ago
        Yes but links can leak in the most accidental fashions. Google seems to find a lot of stuff that makes me wonder how Googlebot ever found such links. Part of the explanation might be referer logs, and such. Anyway, the point is, it's smarter to be explicit and also opt-out using robots.txt or something similar.
  - rch 13y ago
    That sounds about right, actually. Half the yard is clearly free, but they failed to mention that you can't even view the other half. But wasn't the quote indicating that it was made clear somehow? Looking at the anses.fr site isn't particularly helpful, if that's even the site in question.
  - vacri 13y ago
    Except that advertising takes positive effort on your part, whereas it takes positive effort to avoid being listed on Google.
    - lstamour 13y ago
      I don't know, but I think "putting up a web server" qualifies for "positive effort" ;-) And while it does take extra work to ensure an Intranet isn't available on the public web, or that it's correctly configured to require a login to view documents ... there has to be a line somewhere. I mean, I've stumbled on FTP sites that allow anonymous users. By providing no password and still seeing content, would I have "hacked" them? It's a configuration issue, and password prompts are just that. Of course, where do you then draw the line? If you call it a security flaw that the documents were public, then accessing them could be an exploit. But... a very flimsy one, since we rarely execute injection attacks to visit websites, but we often click links on Google. The bar is clearly very low. ;-) This might, of course, change if the access was not indicated on Google but instead on a site like shodanhq.com ...
- Dylan16807 13y ago
  More of a 'keep off the grass' sign. It's not at all obvious that the authentication is supposed to apply to other areas.

rch 13y ago

If you happened upon my 'protected' account with some mal-formed link, then saw the standard 'tweets are protected' message on my main page, you might be in a spot if you went back and save all those secret tweets. Under the interpretation being discussed anyway.

tempestn 13y ago

I don't know about France, but in many jurisdictions, a "reasonable person" standard is used. While I don't personally believe accessing publicly available files should be illegal in any case, I do think that in the situation as described (with the admission of traveling up the path hierarchy to find a login page), most "reasonable people" would indeed infer that the files were not intended to be publicly available.

chrismcb 13y ago
And how would a "reasonable person" decide that? That is kind of like say "if there is a lock on the door, you should know that it was meant to be locked. Yeah 7/11, open 24 hours, has a lock on the door.
- ivanca 13y ago
  We don't even have to make analogies; if it is protected information a "reasonable person" expects some kind of _obligatory_ login authentication, not an optional one.
frobozz 13y ago
Not really. If I found a page that redirected me to a login, I would assume that that page is not intended to be publicly available, and that other content that I don't know about exists which is not intended to be publicly available. I wouldn't infer that just because (as noted by the parent comment) https://twitter.com/ https://twitter.com/ requires a login, I shouldn't look at https://twitter.com/twrbrdg_itself https://twitter.com/twrbrdg_itself Now, if all those pages I looked at before finding the login page had a banner saying "private, not for public consumption, don't share this with anyone who doesn't have an account", then I might think "hmm, perhaps I'm not supposed to be here".
- tempestn 13y ago
  That's not a fair analogy though. I agree that I wouldn't expect every page on twitter to be protected. But if you find a direct link to a random document indexed by Google, then check and the page that links to that document is protected, I personally anyway would assume the document itself was exposed accidentally. Obviously not everyone agrees though, which makes the reasonable person thing difficult to decide. As for the lock on the door comment, I'd say it's more like if you noticed a store is left unlocked in the middle of the night, and therefore assume you're welcome to go in and walk around. In fact, they probably didn't leave it unlocked as an intentional invitation.