Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

331–340 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#331

Post by bwbw223 »

harryh wrote: post #309
cecilpl2 wrote: post #243

Earlier quoted context omitted.

Except this teenager was explicitly authorized to access all those files. He literally asked the web server "can I have these files" and it responded with "yes, you are authorized, here you go". If he wasn't authorized, the server should have responded with a 403 Forbidden! Web servers are built around authentication and access rights! It is not the teen's fault that the government doesn't know how to configure them…

Failure to properly secure one's private property does not make it legal for someone else to access it.

Sorry- I edited. What I’m saying is that the server represents its owner, so when the server grants someone access in normal operation it’s not intrusion.

Re: Teenager facing prison for downloading unsecured files from government website

#332

Post by FundThrowaway »

gruez wrote: post #113
astrodust wrote: post #70

Earlier quoted context omitted.

Instead of actual security why not have a spec for /humans.txt which can say things like "Please don't read anything in the /secret directory."

and what would that achieve? all it's going to do is force companies to add legal boilerplate (eg. those "this message is intended for the recipient only..." that you see in email signatures) to every imaginable place to cover their ass, meanwhile doing nothing to improve security.

Talk about no sense of humour.

Re: Teenager facing prison for downloading unsecured files from government website

#333

Post by harryh »

bwbw223 wrote: post #331
harryh wrote: post #309

Earlier quoted context omitted.

Failure to properly secure one's private property does not make it legal for someone else to access it.

Sorry- I edited. What I’m saying is that the server represents its owner, so when the server grants someone access in normal operation it’s not intrusion.

Servers don't grant access. People grant access. People can make mistakes and set up servers to mistakenly allow access to things.

Making a mistake doesn't revoke someone's property rights.

Re: Teenager facing prison for downloading unsecured files from government website

#335

Post by EamonnMR »

rayiner wrote: post #175
hug wrote: post #151

Earlier quoted context omitted.

Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet. So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, si…

If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.

If the filing cabinet was labeled "public information" you bet I would.

Re: Teenager facing prison for downloading unsecured files from government website

#336

Post by pdonis »

harryh wrote: post #271
ljm wrote: post #256

Earlier quoted context omitted.

I can see where you're coming from but you're also describing the purpose of an API, documented or not. Ultimately, if you want to secure the boundaries of your property (whether that's your app or your domain or your honest to god physical land) it's up to you. If you find yourself in the position where other people are revealing information you or your company should have protected then you are accountable. You hav…

The guy who found the problem or abused it is not accountable. This is clearly wrong. If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission.

> If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission.

This doesn't seem like an apt analogy for the actual case described in the article, though. That case seems more like: you left a bunch of stuff at the curb with a sign that says "free for the taking", but didn't realize that you left some stuff there that you actually didn't want taken.

Re: Teenager facing prison for downloading unsecured files from government website

#337

Post by EamonnMR »

harryh wrote: post #317
ozzmotik wrote: post #313

Earlier quoted context omitted.

i would say that those things are certainly relevant, but it would be perhaps very myopic to say they are the only relevant concepts. one should also keep in mind the intent of the individual attempting to access the property, and the perception of what they're doing when they do within their mind as an expression of that intent, for instance. if i have been to led to believe that your property is public through a me…

I hear what you are saying about the intent of the actor, but that's tricky. What if the actor doesn't believe in private property? What if the actor accidentally misreads "private" as "public."? These things aren't really mitigating. This is why the law tends to fall back on what a hypothetical "reasonable person" would think. I'm not as much of a hardliner as rayiner on this particular case as I think there are som…

Let's say he picked his first random URL and got someone's tax documents. A reasonable person would probably report it and quit prying. But it sounds like the bad documents where mixed in with good documents that he was downloading programmatically, so a reasonable person probably would not have the time to read every single document to determine if it contained personal information.

Re: Teenager facing prison for downloading unsecured files from government website

#338

Post by harryh »

EamonnMR wrote: post #337
harryh wrote: post #317

Earlier quoted context omitted.

I hear what you are saying about the intent of the actor, but that's tricky. What if the actor doesn't believe in private property? What if the actor accidentally misreads "private" as "public."? These things aren't really mitigating. This is why the law tends to fall back on what a hypothetical "reasonable person" would think. I'm not as much of a hardliner as rayiner on this particular case as I think there are som…

Let's say he picked his first random URL and got someone's tax documents. A reasonable person would probably report it and quit prying. But it sounds like the bad documents where mixed in with good documents that he was downloading programmatically, so a reasonable person probably would not have the time to read every single document to determine if it contained personal information.

Yes, that's what I was getting at when I said:

"the data in the documents was not easily identifiable as private"

as a mitigating factor.

Re: Teenager facing prison for downloading unsecured files from government website

#339

Post by gitgud »

PretzelPirate wrote: post #239
rayiner wrote: post #192

Earlier quoted context omitted.

The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.

When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes". This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".

Totally agree with this. If the web resource is available to anyone, then how could you be mad that some one saw it.

Re: Teenager facing prison for downloading unsecured files from government website

#340

Post by pdonis »

rayiner wrote: post #186
iak8god wrote: post #149

Earlier quoted context omitted.

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in th…

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on a…

> I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed.

I think most people don't have an intuitive understanding of this at all, which means you can get them to give any answer you want by crafting your description of the problem appropriately. That doesn't make such a procedure reasonable.

Post reply on HN