Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

31–40 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#31
post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

Instead of effectively designing and administrating their systems, "the powers that be" are taking the "rubber hose, lead pipe" approach. Creating in "law", what they are too distracted and incompetent and egotistical and tight-fisted (tech is a "cost center") to create in fact and systems.

They are, in essence, trying to redesign the nature of the Internet by fiat.

Historically, accessible resources are accessible. Public by their very nature. If you don't want them publicly accessible, implement (effective) authentication.

But this is far too much "trouble" for self-important, "do it my way" lawyers and executives.

So, they "define", or redefine -- in a pure fiction of language -- what is "public" and "private".

Aside from all else, these... "errors in the system" should be routed around. Denied use of the system.

Unfortunately, in this regard, tech has ended up in the position of working for them, rather than vise versa.

Personally, I won't work for them, anymore. Every thing I do for them, is against my own interests and, I've come to believe, the common good.

Re: Teenager facing prison for downloading unsecured files from government website

#32

I wonder how they noticed. Perhaps the lowest-bid contract company that made the site decided to use something like amazon glacier for storage of boring documents nobody will ever need. Then along comes someone that causes them all to be extracted at great cost, some middle manager receives a bill for $millions and wants to blame the kid rather than his own failings.

I don't think you can get from glacier in "real time", you need to prefetch it first

Re: Teenager facing prison for downloading unsecured files from government website

#33
This reminds me of a purported "hack" back in the Governor Schwarzenegger days. An employee from a rival campaign found a public-accessible FTP directory full of audio files, which they then leaked to the press. IIRC, the California Highway Patrol opened up an investigation but ended up not pursuing charges.

https://www.dailynews.com/2006/09/13/arnolds-audio-open-to-p...

edit: the other parallel, IIRC, was that part of the web site was kept private. But the user found the audio by navigating to a parent directory which was apparently open to the public:

https://www.dailynews.com/2007/02/02/chp-clears-angelides-ca...

> Essentially, aides opened the Web address, or URL, from one of Schwarzenegger’s speeches and lopped a few characters from the end of the address. That yielded a directory of audio recordings.

Re: Teenager facing prison for downloading unsecured files from government website

#35

Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?

Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.

Generally you generate a random UUID which is quite difficult to enumerate.

Re: Teenager facing prison for downloading unsecured files from government website

#36

Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?

Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.

uuidv4 is random assuming your rng source is random

Re: Teenager facing prison for downloading unsecured files from government website

#38

Seems like a move by the provincial government to shift blame from its poor security to an imaginary bad actor; this article also from the CBC goes into more detail and asserts that fraudulent intent is necessary for a conviction, so hopefully this goes nowhere. http://www.cbc.ca/news/canada/nova-scotia/concerns-teen-bein...

Yes, it's really not clear that any crime was committed. The relevant section of the Canadian Criminal Code[1] requires either fraudulent intent or some actual manipulation/destruction of the server - not simply downloading data. It seems like overreach by the police to distract from the fact that the government failed to secure private data.

[1] http://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.h...

Re: Teenager facing prison for downloading unsecured files from government website

#40
post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

Is there a Canadian version of the EFF, or does the EFF have an Canadian branch?
Post reply on HN