6 ms·

Granted that this is Canada so is a bit different from where I live, I personally would still at this point fear malicious prosecution just enough that I would

Granted that this is Canada so is a bit different from where I live, I personally would still at this point fear malicious prosecution just enough that I would not have taken action. That's a little sad all by itself. Hats off to Colin for the (brave) good deed.

dmix 12y ago
As a Canadian I wouldn't be too worried about reporting a security vuln here. If I was in America on the other-hand... I'd 100% think twice.
- sarciszewski 12y ago
  As someone who was bitten by the CFAA before, you are 100% correct in being concerned. If you're going to test, do it anonymously. If you find anything, don't report it. Anonymity and good OpSec are the only things that can guarantee to keep American hackers out of prison.
cperciva 12y ago
I'm not a lawyer, but I'm confident that I could not be successfully prosecuted under Canadian law. The law in Canada states that access to computer systems must be "fraudulent and without colour of right" in order to be criminal. I'm not familiar enough with US law to know if a prosecution could be possible there, but regardless of the law might say I think juries can be influenced by the clear intentions of the accused.
- sarciszewski 12y ago
  You are blessed to not fall under American jurisdiction.
- jacques_chester 12y ago
  A few months ago, working on a system, I noticed that the URLs seemed to be based directly on a fixed, sequential user ID. It was a system that, in this case, was being used by An Important Company You Have Probably Heard Of. I was about to see what happened if I changed the number, when I realised that I am a foreign citizen in a country with notoriously unpleasantly drafted laws about computer security. And then I stopped. It's almost certain that nothing would go awry, but the mere act of gently poking might be interpreted in an unfavourable light. Losing a work visa is very easy and I very much don't want to.
  - ikeboy 12y ago
    Ever heard of tor?
    - resonantcore 12y ago
      Tor doesn't necessarily help you. If you're accessing a system a certain way (i.e. accessing certain parts of an application), then your traffic abruptly stops and a Tor exit node IP picks back up, you're hosed.
      - ikeboy 12y ago
        So you wait an hour. This is a huge company, apparently, so there's got to be other people using the same part of it.
        resonantcore 12y ago
        Sure, that works. The point we were trying to make was merely, "Tor is not a magic bullet. It must be used wisely."
        ikeboy 12y ago
        Fair point. But the post I responded to was saying to just give up. Tor may not be enough. To really be safe, use the precautions in http://pastebin.com/cRYvK4jb http://pastebin.com/cRYvK4jb (this guy hacked finfisher and got away with it, so they know what they're doing.) Mostly whonix, truecrypt, and tor. (Come to think of it, why hasn't that post been taken down? Is there nothing against pastebin's tos in there? They took down all the sony leaks.) I would never go back and forth on the same page between tor and clearnet. I assumed that level of caution was obvious, especially to a fellow hacker (we're talking about vulnerability-noticers here, after all.)
    - jacques_chester 12y ago
      It's just easier not to do something that might, vaguely, break a broadly-drafted law.
- dmix 12y ago
  > but regardless of the law might say I think juries can be influenced by the clear intentions of the accused. Indeed, in a sane country where a judge would most likely would throw it out in pretrial you could spend tens of thousands of dollars getting a jury to in a less sane country.
- grayclhn 12y ago
  > I'm not familiar enough with US law to know if a prosecution could be possible there, but regardless of the law might say I think juries can be influenced by the clear intentions of the accused. Possibly true, but US juries are explicitly instructed (ad nauseum) not to do this and potential jurors are often removed from the pool if they seem unlikely to follow through. So, you know, be careful. (addressed less to cperciva than to other readers)

dmix 12y ago

As a Canadian I wouldn't be too worried about reporting a security vuln here. If I was in America on the other-hand... I'd 100% think twice.

sarciszewski 12y ago
As someone who was bitten by the CFAA before, you are 100% correct in being concerned. If you're going to test, do it anonymously. If you find anything, don't report it. Anonymity and good OpSec are the only things that can guarantee to keep American hackers out of prison.

cperciva 12y ago

I'm not a lawyer, but I'm confident that I could not be successfully prosecuted under Canadian law. The law in Canada states that access to computer systems must be "fraudulent and without colour of right" in order to be criminal. I'm not familiar enough with US law to know if a prosecution could be possible there, but regardless of the law might say I think juries can be influenced by the clear intentions of the accused.

sarciszewski 12y ago
You are blessed to not fall under American jurisdiction.
jacques_chester 12y ago
A few months ago, working on a system, I noticed that the URLs seemed to be based directly on a fixed, sequential user ID. It was a system that, in this case, was being used by An Important Company You Have Probably Heard Of. I was about to see what happened if I changed the number, when I realised that I am a foreign citizen in a country with notoriously unpleasantly drafted laws about computer security. And then I stopped. It's almost certain that nothing would go awry, but the mere act of gently poking might be interpreted in an unfavourable light. Losing a work visa is very easy and I very much don't want to.
- ikeboy 12y ago
  Ever heard of tor?
  - resonantcore 12y ago
    Tor doesn't necessarily help you. If you're accessing a system a certain way (i.e. accessing certain parts of an application), then your traffic abruptly stops and a Tor exit node IP picks back up, you're hosed.
    - ikeboy 12y ago
      So you wait an hour. This is a huge company, apparently, so there's got to be other people using the same part of it.
      - resonantcore 12y ago
        Sure, that works. The point we were trying to make was merely, "Tor is not a magic bullet. It must be used wisely."
        ikeboy 12y ago
        Fair point. But the post I responded to was saying to just give up. Tor may not be enough. To really be safe, use the precautions in http://pastebin.com/cRYvK4jb http://pastebin.com/cRYvK4jb (this guy hacked finfisher and got away with it, so they know what they're doing.) Mostly whonix, truecrypt, and tor. (Come to think of it, why hasn't that post been taken down? Is there nothing against pastebin's tos in there? They took down all the sony leaks.) I would never go back and forth on the same page between tor and clearnet. I assumed that level of caution was obvious, especially to a fellow hacker (we're talking about vulnerability-noticers here, after all.)
  - jacques_chester 12y ago
    It's just easier not to do something that might, vaguely, break a broadly-drafted law.
dmix 12y ago
> but regardless of the law might say I think juries can be influenced by the clear intentions of the accused. Indeed, in a sane country where a judge would most likely would throw it out in pretrial you could spend tens of thousands of dollars getting a jury to in a less sane country.
grayclhn 12y ago
> I'm not familiar enough with US law to know if a prosecution could be possible there, but regardless of the law might say I think juries can be influenced by the clear intentions of the accused. Possibly true, but US juries are explicitly instructed (ad nauseum) not to do this and potential jurors are often removed from the pool if they seem unlikely to follow through. So, you know, be careful. (addressed less to cperciva than to other readers)