Governor vows criminal prosecution of reporter who found flaw in state website • Hacker News Board

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#691

Post by soylentnewsorg » Fri, Oct 15, 2021, 7:57 PM UTC

drdeca wrote: post #476

vadfa wrote: post #404

Earlier quoted context omitted.

And it's a public street. It's what inside the houses (URLs) that is not public.

Doors (holes-become-walls / walls-become-holes) are for controlling whether things can go through. URLs are for letting things through. A url is not a door, but an archway, or possibly a door frame.

..and you're not allowed to walk into someone's house if they only have a door frame instead of a locked door. they are for preventing criminals from forcefully breaking in. but you don't have to break in to commit the crime. that's why it's called "breaking and entering" - there are two criminal acts committed.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#692

Post by Dylan16807 » Fri, Oct 15, 2021, 8:18 PM UTC

JshWright wrote: post #619

Dylan16807 wrote: post #610

Earlier quoted context omitted.

Not on purpose, and they didn't keep or memorize it.

The GP comment says "After I shopped a few other companies to see how our plans compared". That sounds pretty "on purpose" to me. What does "keep or memorize" have to do with anything? They intentionally abused a misconfiguration to view private information. I think it's reasonable to disagree about the ethics of that, but I don't think it's really debatable that it was intentional.

They were intentionally viewing plan information. The personal information wasn't the goal and wasn't retained.

"private" information is too vague of a term.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#693

Post by zentiggr » Fri, Oct 15, 2021, 9:03 PM UTC

Spivak wrote: post #628

zentiggr wrote: post #522

Earlier quoted context omitted.

Which works great when there's some kind of access restriction in place. If you wind up putting your tax returns in the 'little free library' you set up on your front yard, you can't blame others for reading them, then handing them back to you and not telling anyone else. That's the proper analogy for what happened in the original article.

This doesn’t track at all. This is me telling you that your forms are on my desk and throwing you the keys to my office. And then after getting your papers you go rummaging around other stuff. Like sure I’m accepting a risk that you could do that but you’re still a dick if you actually do.

The point is that there's no keys involved, nothing in your private office. No rummaging either.

Publishing to a public web server is analogous to that little free library, out in the yard. No keys, anyone can look in it at any time. If you accidentally put something sensitive in there, where anyone can see it without any access control, you can't blame them for doing so.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#694

Post by gwd » Fri, Oct 15, 2021, 9:15 PM UTC

soylentnewsorg wrote: post #688

gwd wrote: post #670

Earlier quoted context omitted.

> If once you find the information on page 346, you then keep flipping and looking at people's private information on the next hundred pages like the OP did, you have now committed a crime. I agree that morally, the guy should certainly not have continued to look through what he knew was private information he wasn't meant to have access to. I'm not sure the law sees a difference between looking at pages 347-350 and…

I am sure the law sees the difference. Intent is what makes the difference between a murder charge and the death penalty, and supervision with a suspended sentence for manslaughter, when you hit a person driving drunk. Page 346 was an accident - your intent was to read Your data. In viewing Further pages, as the OP stated for the explicit purpose of viewing other people's confidential medical data, the intent is a cr…

You didn't know for sure that page 346 would have private data, and that you'd be able to turn the page; but there was a reasonable probability that you would in fact see private data. If someone died instead of having their privacy violated, it would certainly be classified as manslaughter (i.e., you were doing something you knew might be "dangerous") rather than just a plain accident where there was no fault.

I don't know what the actual law is, but given the benefits to society of "good people" reporting this kind of issue, I think that toying around with something like that should be considered not a crime at all, rather than being considered a lower-severity crime.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#695

Post by soylentnewsorg » Sat, Oct 16, 2021, 4:09 AM UTC

gwd wrote: post #694

soylentnewsorg wrote: post #688

Earlier quoted context omitted.

I am sure the law sees the difference. Intent is what makes the difference between a murder charge and the death penalty, and supervision with a suspended sentence for manslaughter, when you hit a person driving drunk. Page 346 was an accident - your intent was to read Your data. In viewing Further pages, as the OP stated for the explicit purpose of viewing other people's confidential medical data, the intent is a cr…

You didn't know for sure that page 346 would have private data, and that you'd be able to turn the page; but there was a reasonable probability that you would in fact see private data. If someone died instead of having their privacy violated, it would certainly be classified as manslaughter (i.e., you were doing something you knew might be "dangerous") rather than just a plain accident where there was no fault. I don…

I never claimed page 346 was breaking the law. I claimed after you discover that the action reveals private data, and you repeat that action a bunch of times for the explicit purpose of getting more private data, you are now a criminal. This is what the OP very clearly stated he did.

He did not report the issue after finding it. He abused the security hole for his own benefit. He is a criminal.

Low severity? In civil court, they can take every penny he has, every penny he'll ever earn, and his house. In criminal court, he can be charged with unauthorized access to a computer system, one charge each time he did it. And he did it a lot, and they have logs. Which is all literally in his post.

Viewing other people's medical information is not a low severity crime btw.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#696

Post by drdeca » Sat, Oct 16, 2021, 9:21 AM UTC

soylentnewsorg wrote: post #691

drdeca wrote: post #476

Earlier quoted context omitted.

Doors (holes-become-walls / walls-become-holes) are for controlling whether things can go through. URLs are for letting things through. A url is not a door, but an archway, or possibly a door frame.

..and you're not allowed to walk into someone's house if they only have a door frame instead of a locked door. they are for preventing criminals from forcefully breaking in. but you don't have to break in to commit the crime. that's why it's called "breaking and entering" - there are two criminal acts committed.

An arch is not something that merely isn’t locked, but something that isn’t meant to even be closed.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#697

Post by exikyut » Sat, Oct 16, 2021, 1:12 PM UTC

cryptofistMonk wrote: post #623

Something1234 wrote: post #621

Earlier quoted context omitted.

I feel like that would be a decent option for a surrogate key for public identification of an item and potentially cheaper than generating a uuid or something else. Maybe combine that with a salt and you have alright protection. How did you figure out that it was an md5 of the order number?

Presumably order numbers are easily guessable, so the md5 really offers no protection at all in this case and is no better than just using the order number

And the thing is, even if they can't be guessed, it's only 999,999 calls to try every 6-digit possibility. And you'd only take 11 days if you were nice and paced yourself to 1 req/sec.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#698

Post by exikyut » Sat, Oct 16, 2021, 1:26 PM UTC

renewiltord wrote: post #553

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

Oh there are so many things like this. Ages ago, I used this to find a whole listing of internal fax numbers for a government org I wanted to get someone's attention at and totally slow-spammed them using a fax API. Got a couple of reads based off that. There's no way I'm telling them I did that, haha! Rule 1: Never tell people they're making a mistake unless you trust them to trust you.

Serious question: how do you figure out when this is the case?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#699

Post by jjk166 » Sun, Oct 17, 2021, 11:43 PM UTC

epicide wrote: post #673

jjk166 wrote: post #506

Earlier quoted context omitted.

Well in this case I'm knocking on your door and you're opening the door saying "Come right on in!" Requesting access (ie knocking on a door/typing a url) is not illegal. If you grant that request (ie invite me in/serving a webpage), I am under no obligation to psychically infer that you didn't mean to and refuse your invitation.

Unfortunately, it's never that simple. So much of it is about intent . If I could simply use the excuse "well, the computer gave me the information", then there would be no such thing as hacking. It's always a case of the computer sending the information to you.

It's not about intent, it's about authority. If I have the authority to access something, it's legal for me to access it, regardless of my intent. I may be breaking other laws depending on what my intent is, but it's not hacking.

Compare to a restaurant: simply walking into a restaurant is not illegal, but an owner can restrict access and ban someone from their restaurant. It takes no technical skill to break into the restaurant, the door is wide open, but without authority it is trespassing. However, it is on the owner of the restaurant to actually ban someone. For a public space, be it a restaurant or a webpage, by default you are permitted access. Attempting to enter a restaurant you've never been to before is not breaking and entering, nor is accessing a URL hacking.

If a website has some user agreement saying you will not access certain portions, or even if there is just a notice on a website saying this site is not public, then they have done all they need to do to revoke someone's authority, even though they would be incredibly easy to "hack." But as laid out under Van Buren v US, you don't lose authority to access things simply because you possess some intent undesirable to the owner. If you invite me into your home and I sleep with your wife, I haven't trespassed; if you tell me to get out and I don't leave then I have.

Further, there's a distinction between accessing something by normal, legal means and accessing something by other methods. For example if you invite me into your home only after I give you a false identity, I'm trespassing because I was never legitimately given authority to enter. Likewise if you hack a system with say a stolen password, you don't have authority to access the system no matter how easy it was. But if you grant authority to someone without them having to do anything nefarious, then they have authority regardless of whether you should have done it or not. If you have something sensitive, don't put it in a place (in the real world or online) where authority to access is granted automatically and without oversight.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#700

Post by dang » Mon, Oct 18, 2021, 4:31 AM UTC

psychometry wrote: post #82

good8675309 wrote: post #67

Earlier quoted context omitted.

Polarize much? Let's just go back to the general population not trusting the government or any politician regardless of party affiliation. They're all corrupt and ignorant, it's a basic requirement.

Oh, you're one of those morons who thinks both parties are equally bad, huh?

Could you please stop posting flamewar comments? You've been doing it a lot lately, and we ban such accounts regardless of what they're flaming for or against. I don't want to ban you because you've also posted good things, but we've had to warn you about this multiple times in the past and that's not cool.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.