231–240 of 502 posts
Earlier quoted context omitted.
I think a cryptographic hash is fine. If you know the hash, you likely already know the file.
A cryptographic hash of what? Cryptographic hashes aren't random by nature.
Edit: even if they aren't PDFs, you can feed the content to the hash function.
Earlier quoted context omitted.
No OP has a point, we shouldn't talk in metaphors so much... It's not necessary. The web is in many ways a huge collection of resources that reference each other. Some of these references are explicit in links, others in text, and some are available for programmatic access. In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn'…
> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn't documented doesn't make using it illegal. The license to access private property is based on the intent of the property owner. Where the intent is made express (through a sign), that governs. Where the intent is not made express, we try to figure out what a reasonable pe…
Earlier quoted context omitted.
Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.
uuidv4 is random assuming your rng source is random
He estimates he has around 30 terabytes of online data on hard drives in his home, the equivalent of "millions" of web pages. He usually copies online forums such as 4chan and Reddit, where posts are either quickly erased or can become difficult to locate.
"I preserve things, I archive the internet. I have history on my computer, and all of that should be saved and preserved," he said.
Earlier quoted context omitted.
A cryptographic hash of what? Cryptographic hashes aren't random by nature.
The document, from what I could glean they were PDFs. Edit: even if they aren't PDFs, you can feed the content to the hash function.
Earlier quoted context omitted.
So this is a classic case of a subcontractor doing substandard work, leaving a security hole big enough to drive a truck through, and then trying to sue someone to save face... Sigh. If some of those documents weren't appropriate to be viewed by the general populace then the company was criminally negligent in their handling of the data, the "hacker" saw an open door with a sign reading "free information" on it and d…
And the cries by old geezers in charge, yet clueless of what it is they’re “in-charge of”, that he stole it are eye rolling It’s ageism but at this point I’m pretty convinced old people should be term limited from office The problems we seem to be facing are almost entirely due to their inability to move on Youth shouldn’t spend their lives kowtowing to geezers that quit thinking and are simply peddling what’s become…
God dammit. An almost identical thing happened to me after submitting a public records request to Seattle's IT department for email metadata for January 2017. Instead of sending me the email metadata I requested, they ended up accidentally sending me millions of actual emails . FBI investigations, cheating husbands' texts, SSNs, credit cards, zabbix alerts (so many 100% disk space alerts). When I contacted Seattle th…
Good for you for not having to deal with Kroll.
Earlier quoted context omitted.
This is absurd. This is not private property. Ordinary law-abiding people do walk into government offices and ask questions, and when they get answers, do continue asking questions and getting answers. Ordinary law abiding people to browse all the products on display at a store. Ordinary law abiding people do flip through all the pages of a catalog that is sent to their home. This Orwellian attitude that looking at a…
Government documents and web servers are private property. (The information within might be public, but it's illegal to access private property in an unauthorized way to get public information). Ordinary law-abiding people do the things that property owners expect them to do (or what they reasonably infer the property owners intend them to do). If there are signs (literal or figurative) that the property owner doesn'…
However, when you make those files available through a web server, you make the "public".
You then have the ability to limit the access to those files through any one of a large number of techniques to make them private again. Now if there were evidence that they tried (and failed) to use one of these techniques or that the teenager in question deliberately circumvented these techniques, then you would have a point.
One (not particularly good) way of limiting access to files without verifying identity would be to create a hash (say using the requesters email address and the request ID) and use this in the url to access the document (similar to how google docs implement sharable document links).
If they had done this, then perhaps you could legitimately claim that there was evidence of intent to restrict access.
An incremented ID is the opposite. It is a sign that you wanted people to be able to easily predict the correct url to download the next file from. Using an incremented ID is in fact evidence that this information was intended to be public.
Earlier quoted context omitted.
There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.
The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.
This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".
Earlier quoted context omitted.
>I don't lock my car, and often not my house either. I don't think that means you should be able to snoop around and see what interests you. Websites are private property Here's a better analogy; you put up a "yard sale" sign in your front yard, fill the driveway with property, and then call the police on the first person who shows up claiming they are trespassing.
When you put up a "yard sale" sign, you're conveying what is called an "implied license" to access the property. The scope of a trespasser's right to access a property is limited to what a reasonable person would consider to be granted by the license. A reasonable person would assume that a "yard sale" sign grants a license to access the yard on which the sign is posted, but not to go around to the back yard and peek…