Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

511–520 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#511

Post by ajmurmann »

photochemsyn wrote: post #373
0x262d wrote: post #246

Earlier quoted context omitted.

wow, what fraction of websites leak data I want to look at? should I be poking at every non-tech-giant site I go to?

The analogy is going up to a house and checking all the doors and windows to see if they are locked. That's rather like port scanning, a form of 'poking'. If you go to a state government web site and do that, even if you don't exfiltrate data or load it up with ransomware, it's definitely very shady behavior, although it seems there are no laws against it in the USA (some ISPs will ban users caught doing this however…

The data was send to my browser. The more fitting analogy to me is that I get a letter and a huge pile of documents in a giant binder. Some of the documents are referenced in the letter. Now the sender gets upset because I started looking at the documents in the binder that weren't referenced in their cover letter.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#512

Post by jameshart »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to.

Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search.

All the analogies about ‘it’s like asking the IRS for another document’ are all wonderfully applicable to this comment, but not remotely applicable to the actual article.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#513

Post by _dain_ »

mcbutterbunz wrote: post #441
_dain_ wrote: post #362

Earlier quoted context omitted.

People have gone to jail for incrementing integers in URLs like that (most famously, weev).

Didn't he also give the data he found to Gawker before notifying AT&T of the issue? That seems like a pretty key difference here, but I don't know what weev was charged and convicted for.

"Conspiracy to access a computer without authorization", which was and is completely preposterous. The Gawker part is completely immaterial, it was still a total travesty of justice. The judgement was later overturned on procedural grounds rather than on the merits (which it should have been). He did nothing that merited imprisonment, and even less so his mistreatment there.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#514

Post by dbish »

Yet another example of how political leaders are completely out of the loop on all things tech. Software is such a large part of the world nowadays that we need to change this or the US is going to have even more issues going forward. I don’t think the current parties are amenable to making changes and bringing in tech-savvy people anymore, and I firmly believe the only way forward is going to be to find a way to create a new party that can get traction at the grassroots level that is tech-forward and led by people who aren’t career politicians/lawyers. The two party system makes this very hard though

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#515

Post by benlivengood »

kelnos wrote: post #440
formerly_proven wrote: post #245

Earlier quoted context omitted.

The closest real-life equivalent to asking a computer server for a document and getting it is asking a human server (e.g. office clerk, archivist) for a document and getting it. If I go to the IRS to do some paperwork and notice it says "File #7881991" in the top right corner and I go to the clerk and ask them "Hey, can I have files 7881992 and 7881993, too?" and they give them to me , who is liable for that? It's qu…

No, it's not, because computers and humans are not the same. A computer might give away too much information because someone misconfigured it. The closet human analog to that would be if the human was improperly trained in what information they're supposed to give out. But the human also has other options: they could be tricked into giving out more information than they should, or they could be giving out more inform…

> Yes, it is obvious: the clerk is liable for giving you something they shouldn't have, and you are liable for fraudulently representing yourself as someone who should have access to those files.

It's always okay to ask for things. There would be no way for society to adapt, progress, or change if people were limited to only asking for things that they knew in advance they were allowed to have. If it's legal for a telemarketer, pollster, reporter, cop, or recruiter to contact me and ask me questions then it's just as legal for me to contact and ask a web server a question. The correct response to unauthorized requests is a 4xx, not a lawsuit.

More to the point, what makes it okay to ask a new web server for "/" without permission? Even if browse-through terms of service were legally enforceable they aren't known to the user or the browser before making the first connection and request.

If a web server doesn't want to answer questions then don't connect it to the Internet.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#516

Post by mcguire »

jerf wrote: post #250
kamkazemoose wrote: post #187

Earlier quoted context omitted.

Say you are invited to your friends apartment in an apartment building, but none of the apartments have locks. So you decide to open up some other random apartments and look through their things, who is responsible?

Analogies are never helpful for things like this. We don't need to reach for analogies to observe that while the theoretical ideal is to report it after just one false access, that no significant damage was done by accessing just a few more via human manipulation of the browser URL, with no recording or sharing of the results. From a human perspective, no damage was done. Whether that legally crosses a line involves…

There's no evidence from the original comment that anyone invoked any legal lines. Instead, they seem to be upset that the person they reported the incident to asked them questions about exactly what they did rather than being effusively grateful.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#517

Post by handrous »

jeremyjh wrote: post #489
handrous wrote: post #275

Earlier quoted context omitted.

I know a lot of people who regard it as a hybrid southern/midwestern state. Plenty of confederate flags to be found in Missouri, certainly, and the MU/KU rivalry is, on our side at least, heavy on "bleeding Kansas" rhetoric and imagery, which keeps Missouri's Southern-sympathizing role in the war alive in our popular culture (such as it is). Lots and lots of our local icons, oft-mentioned historical figures, et c., r…

You can find racists and rebels anywhere. If you order a sweet tea in any restaurant in Missouri they will look at you like you have three heads.

Not true at all, but the sweet tea they serve you will probably be mediocre at best, that's true. A few places will serve you unsweet tea (all they have, as a cost-savings measure) with sugar packets, as if that's the same thing, which admittedly is an offense worthy of challenging your server and/or the restaurant owner to a duel.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#518

Post by andrei_says_ »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

Fear. The IT person is likely scared of (fill in the blank - blame, losing their job etc. )

They are scared because their leadership is likely also afraid - and so unable to provide protection by taking responsibility.

This is the vibe of an organization where mistakes lead to blame and punishment instead of quick resolution and learning.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#519

Post by throwaway894345 »

ajmurmann wrote: post #484
throwaway894345 wrote: post #173

Earlier quoted context omitted.

It’s not a nice response, but IT needs to be able to answer questions about the extent of a given breach (what info was accessed by whom and when). This is a legal requirement in the case of health information. Ideally people could be courteous while fulfilling their legal obligations, but IT folks aren’t generally chosen for their public relations or customer service skills.

Assessing the scope of the breach, sure. "Fixing" the breach by monitoring a single IP addresses access patterns not so much. The site needed to be taken down till a mitigation has been deployed.

Agreed.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#520

Post by andrei_says_ »

watchdogtimer wrote: post #494
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I found a similar vulnerability in one of our vendors' online order system. I noticed after placing an order an integer in the order confirmation page URL. I reduced it by one and refreshed the page. Sure enough, I got all the order details of the previous customer's sale. Reducing _that_ URL by one got the next previous sale details etc. I notified the company about it. They fixed it, and in gratitude sent me a smal…

I think the main difference is the one between acknowledgment, action + (small) gratitude vs. fear, paralysis and scare tactics / trying to control the environment instead of fixing the issue.
Post reply on HN