Remember Aaron.
Teenager facing prison for downloading unsecured files from government website
51–60 of 502 posts
Re: Teenager facing prison for downloading unsecured files from government website
#52Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?
Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.
If things should be secure, they should be behind authentication and authorization for that content. To argue about what is the best ID to be used is just trying to fix what is not broken, IMHO.
Re: Teenager facing prison for downloading unsecured files from government website
#53It isn't a breach if the administrators of the repository failed to secure the information. Regardless of the likelihood of conviction it is reprehensible to terrify some kid with the threat of losing his freedom as a means of saving face, which is what this appears to be. I certainly hope he gets out of this.
Re: Teenager facing prison for downloading unsecured files from government website
#54And this is why I'm going to route all my kids traffic through an offshore VPN by default and whitelist low latency stuff.
I'm starting a proxy project that can be used in countries where VPN is illegal. I'm looking for collaborators. https://github.com/UncleGrape/UncleGrape
Re: Teenager facing prison for downloading unsecured files from government website
#55This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-free card.
Based on what little I've read thus far, the teenager does indeed seem to have good intent. If that's the case, I'm cautiously optimistic that the court system will set him free without any consequences. But if the prosection can prove that he was aware of the data's confidentiality and was acting with malicious intent, then he deserves a conviction. Let's let the legal system run its course, before gathering our pitchforks.
Re: Teenager facing prison for downloading unsecured files from government website
#56I am absolutely incensed reading this.
The government made no reasonable effort to conceal the information and put it on a _publicly accessible_ web server. They made the information available to the public whether or not that was their intention. How can any reasonable person conclude that typing in an HTTP url qualifies as an illegal breach?
Re: Teenager facing prison for downloading unsecured files from government website
#57Earlier quoted context omitted.
Exactly. Why did this kid admit that? How astronomcally low are the odds there's nothing illegal to possess in there?
He's a 19 year old kid, not a criminal mastermind
There's quite a bit of child pornography that has graced the pages of 4chan over the years.
Re: Teenager facing prison for downloading unsecured files from government website
#58This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…
Is there a Canadian version of the EFF, or does the EFF have an Canadian branch?
[deleted]
Re: Teenager facing prison for downloading unsecured files from government website
#59Cases like this make me want to attend law school. I am well versed in technology, have acted as CISO and other capacities. I bet I could decimate many prosecuting attorneys trying to make their weak cases.
Do it! Then when you get enough experience become a Judge. So when a prosecutor brings your stupid case you can just throw out!
Re: Teenager facing prison for downloading unsecured files from government website
#60what part of _freedom of information portal_ do they not understand?