9 ms·

I've seen plenty of links (including this one) to passwordless HTTP servers on the front page. A reasonable person would assume that a server with no password,

I've seen plenty of links (including this one) to passwordless HTTP servers on the front page. A reasonable person would assume that a server with no password, intentionally has no password.

tptacek 11y ago
Yeah good luck with that.
girvo 11y ago
The legal system really doesn't like "cute", "technically-correct" arguments, as a general rule. If you fell afoul of the CFAA on this and were dragged in front of a judge, I'd put good money on that argument being laughed out of court for this particular case. An HTTP server is very different to a VNC server. Misconfiguration doesn't typically grant right to access, in a legal sense anyway.
- jsprogrammer 11y ago
  The problem is that it's not obvious that there is a misconfiguration. Public sandbox environments are not uncommon on the Internet. I do not support malice or vandalism, but there is no indication that a system is misconfigured merely because it does not have password protection. Users should not be expected to know the intricacies and technical details of every program they use. The responsibility for ensuring that servers are not publicly accessible is on the person running the server. Not requiring a password to access a system on a public network, when you require that only certain people are allowed access to that system, is negligence at best. I'd argue gross negligence.
  - girvo 11y ago
    > but there is no indication that a system is misconfigured merely because it does not have password protection And there is no indication it's not a misconfiguration. Look, I completely agree with what you're saying, but judges won't (and don't).
ori_b 11y ago
Would they? Or would they assume that a VNC server was left open either through malice or incompetence, and it's presence therefore not an invitation to be accessed? This is the difference between a storefront being left unlocked, versus a private home being left unlocked. An unlocked storefront is likely to be open for business, so entering is reasonable. An unlocked house is a security mistake, and entering is trespassing.
bradleyland 11y ago
You might think you're clever. Hell, you probably are clever. Unfortunately, that's not what matters. What matters is how the owner of the server will react, and how important they are. If you're identified and charged, the DA will levy absurdly burdensome charges against you. You'll be forced to spend thousands of dollars on defense. You'll spend months distracted by the proceedings, and will inevitably be asked about it by peers/employers when the news hits the streets. But you're right. You may never be convicted. Go ahead and try your luck.

I've seen plenty of links (including this one) to passwordless HTTP servers on the front page. A reasonable person would assume that a server with no password, intentionally has no password.

tptacek 11y ago

Yeah good luck with that.

girvo 11y ago

The legal system really doesn't like "cute", "technically-correct" arguments, as a general rule. If you fell afoul of the CFAA on this and were dragged in front of a judge, I'd put good money on that argument being laughed out of court for this particular case. An HTTP server is very different to a VNC server. Misconfiguration doesn't typically grant right to access, in a legal sense anyway.

jsprogrammer 11y ago
The problem is that it's not obvious that there is a misconfiguration. Public sandbox environments are not uncommon on the Internet. I do not support malice or vandalism, but there is no indication that a system is misconfigured merely because it does not have password protection. Users should not be expected to know the intricacies and technical details of every program they use. The responsibility for ensuring that servers are not publicly accessible is on the person running the server. Not requiring a password to access a system on a public network, when you require that only certain people are allowed access to that system, is negligence at best. I'd argue gross negligence.
- girvo 11y ago
  > but there is no indication that a system is misconfigured merely because it does not have password protection And there is no indication it's not a misconfiguration. Look, I completely agree with what you're saying, but judges won't (and don't).

ori_b 11y ago

Would they? Or would they assume that a VNC server was left open either through malice or incompetence, and it's presence therefore not an invitation to be accessed? This is the difference between a storefront being left unlocked, versus a private home being left unlocked. An unlocked storefront is likely to be open for business, so entering is reasonable. An unlocked house is a security mistake, and entering is trespassing.

bradleyland 11y ago

You might think you're clever. Hell, you probably are clever. Unfortunately, that's not what matters. What matters is how the owner of the server will react, and how important they are. If you're identified and charged, the DA will levy absurdly burdensome charges against you. You'll be forced to spend thousands of dollars on defense. You'll spend months distracted by the proceedings, and will inevitably be asked about it by peers/employers when the news hits the streets. But you're right. You may never be convicted. Go ahead and try your luck.