Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

331–340 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#331

Post by DebtDeflation »

MrPatan wrote: post #238
joshenberg wrote: post #19

Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.

You left out the best bit: "through a multi-step process"

Right click.

View Page Source.

That's 2 steps. Hence, multi-step.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#332

Post by jjav »

bawolff wrote: post #236
Dylan16807 wrote: post #222

Earlier quoted context omitted.

Asking for the next file isn't false pretenses. I don't know if this analogy works quite right. Even rifling through a file cabinet wouldn't be false pretenses, it would be something else. And you have to cause injury for it to be fraud. Is "Help I was too honest to a customer." a valid injury claim?

I think the analogy would be going up to the desk and saying: my id number is X (when its really Y), can i have my file. If you convince them that you really are X and they give you the file, i think that would be considerd fraudulent. Whether or not an injury takes place to raise it to the level of fraud i guess depends on what was in the file, but in countries with strong privacy laws, someone would probably be in…

> I think the analogy would be going up to the desk and saying: my id number is X (when its really Y), can i have my file.

Not at all because what you describe involves impersonating someone else.

In the OP case, they were authenticated in the session as themselves and always acted under the truthful identity and asked for a document and access was granted.

So the analogy would be going up to the desk and saying: I'm John Doe, my id number is X (truthful value), could I see file ABC? And the attendant checks that id==X does have access to document ABC, and thus hands it over.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#333

Post by dymax78 »

bawolff wrote: post #265
bleachedsleet wrote: post #234

Earlier quoted context omitted.

Language cheapens itself when spoken cheaply. Abusing over the top terminology on minute areas of controversy will ultimately lesson the impact of your outrage when something actually bad comes along. Someone browsing healthcare plans available to other employees of different companies is not something that should win you the label “malicious actor” and come associated with other implications. This data leaking harms…

I used the word "malicious". Its not like i used the word "murderer" or "evil overlord". I'm not saying OP should go to jail or anything. All i'm saying is if you find an exploit, and after you verify it works, you contunue to use it for your own personal ends, you're no longer benign and you shouldn't expect a warm welcome from the security team. The line is when you start to use exploits on computers not owned by y…

> ... and you shouldn't expect a warm welcome from the security team.

The appropriate response from the security team (after verification) is to pull the site down or immediately patch the vulnerability, if possible. Making an outbound call to a third-party is pointless and irresponsible.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#334

Post by White_Wolf »

bawolff wrote: post #284
formerly_proven wrote: post #245

Earlier quoted context omitted.

The closest real-life equivalent to asking a computer server for a document and getting it is asking a human server (e.g. office clerk, archivist) for a document and getting it. If I go to the IRS to do some paperwork and notice it says "File #7881991" in the top right corner and I go to the clerk and ask them "Hey, can I have files 7881992 and 7881993, too?" and they give them to me , who is liable for that? It's qu…

Users don't normally construct urls by hand. Wouldn't the equivalent more be like: You filled out some form to request a document from the irs. You give the form to the person they give you the document. You notice they dont check ids, so you change the name on the form, and get someone else's document. This definitely seems to fit the definition of fraud: 380 (1) Every one who, by deceit, falsehood or other fraudule…

"deceit, falsehood or other fraudulent means" => editing the URL is neither of those. Forgig a cookie for access is, just like randomly trying passwords and usernames.

The closest real life example I can think of would be along the lines of: - your car is in a public parking space and someone look inside vs - the same car is in the garrage and someone breaks the door to look inside your car

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#335

Post by SamPatt »

kmlx wrote: post #307
jeremyjh wrote: post #199

Earlier quoted context omitted.

Nearly all politicians prosecute reporters? No, I'm pretty sure that is just the fascists.

> pretty sure that is just the fascists. i’m not from the US, but is it common in the US to use these kinds of accusations? seems ultra far fetched.

Yes. Most online discourse about politics will eventually have someone claim fascism or make a Hilter reference.

If you aren't among one of the two sides it can be humorous to watch at times.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#336

Post by stronglikedan »

kmlx wrote: post #307
jeremyjh wrote: post #199

Earlier quoted context omitted.

Nearly all politicians prosecute reporters? No, I'm pretty sure that is just the fascists.

> pretty sure that is just the fascists. i’m not from the US, but is it common in the US to use these kinds of accusations? seems ultra far fetched.

From the extremists, yes, it is common. The "other" side's elected officials are nearly always labelled "fascists". However, the majority of the electorate is smart enough to recognize that it's just a failed appeal to emotion, and nothing more. (except maybe exhausting)

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#337

Post by heavymark »

"In a press release Wednesday, the Office of Administration Information Technology Services Division said that through a multi-step process, a “hacker took the records of at least three educators, decoded the HTML source code, and viewed the social security number of those specific educators.” Ha, or summarized a user clicked "View Source" in their browser. Well I guess the first of the multi-set process is open said browser.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#338

Post by websap »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

Obviously this person from the IT department has very little understanding of how computers work, and I'm not saying they should.

Each time a breach like this or in the original post happens, it makes me feel that our tools are just not there yet. If there were simple tools that caught vulnerabilities like this we would improve the standard of security.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#339

Post by cortesoft »

formerly_proven wrote: post #180
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

Umm, this seems to imply that these security vulnerabilities are intentional, which doesn't seem like what is happening. In your mayor example, you wouldn't go to the mayor because you know he is intentionally trying to break the law, so going to him doesn't make sense.

Incompetence is very different than malfeasance.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#340

Post by Tepix »

qwertox wrote: post #230
formerly_proven wrote: post #180

Earlier quoted context omitted.

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

All this reminds me of the case of Lilith Wittmann [1], who got sued by the CDU (Germany's majority-holding party) in May 2021 because she discovered a security flaw in their election campaign app "CDU connect". Data from around 100.000 visitors and 18.500 election campaign helpers was not sufficiently secured. She used responsible disclosure to let the CDU know of this flaw, got sued in response. After an outcry fro…

The CDU party no longer holds the majority :-)
Post reply on HN